Mystery Attacker Targeting Salesforce and ServiceNow Portals for Over a Year

For more than a year, an attacker has been exploiting Salesforce and ServiceNow portals worldwide, collecting data inadvertently exposed by organizations. Researchers at Reco dubbed the operation "City-Forum" and noted that the attacker has been active in various sectors, including telecoms and finance. The attacker employs advanced techniques and a custom toolset to enumerate data available to guest users, raising concerns about security configurations.