One Attacker Has Scraped Both Salesforce and ServiceNow Portals Since 2025
Aug 18, 2026, 11:30 AM · by The Hacker News
A single piece of infrastructure has been pulling records out of Salesforce and ServiceNow customer portals across multiple industries for more than a year, according to research published this week by agent security platform Reco.
The activity, which Reco has named the City Forum campaign after a domain tied to the attacker's IP address, traces back to one server: 158.220.87.79, hosted on a
Source: The Hacker News