Security
One Attacker Has Scraped Both Salesforce and ServiceNow Portals Since 2025
The Hacker NewsAugust 18, 20261 min readThe Hacker NewsAugust 18, 20261 min readThe Hacker NewsAugust 18, 20261 min readA single piece of infrastructure has been pulling records out of Salesforce and ServiceNow customer portals across multiple industries for more than a year, according to research published this week by agent security platform Reco. The activity, which Reco has named the City Forum campaign after a domain tied to the attacker's IP address, traces back to one server: 158.220.87.79, hosted on a
The Hacker News
thehackernews.com