SecurityThe Hacker Newsabout 2 hours ago
Attacker Scrapes Salesforce and ServiceNow Portals Since 2025
1 min read
A single server, 158.220.87.79, has scraped Salesforce and ServiceNow customer portals since March 2025, targeting telecoms, banks, and public sector sites. Reco named the campaign City Forum. The tool exploits over-permissioned guest users, using Go's default user agent and hitting both Aura and Lightning Web Runtime APIs.
Level
Hype check
Tap to vote and see what everyone thinks.
In this storySalesforce
