2025년부터 한 공격자가 Salesforce와 ServiceNow 포털에서 데이터를 스크래핑하고 있다고 보고됐다.
Research by Reco reveals that a single attacker has been scraping records from both Salesforce and ServiceNow customer portals since 2025. The operation, dubbed the City Forum campaign, is linked to one specific server with the IP address 158.220.87.79. This campaign has targeted multiple industries, raising significant security concerns.
An attacker has been scraping data from Salesforce and ServiceNow since 2025, according to a security report.
A recent report by Reco indicates that a single attacker has been scraping sensitive records from Salesforce and ServiceNow customer portals since 2025. This malicious activity is called the City Forum campaign, named after a domain associated with the attacker's IP address. It appears to target various industries, highlighting ongoing security vulnerabilities in these platforms.