negativeSYS.SOURCE: The Hacker News• 2026-08-18T17:00:00+05:30

Unauthorized Data Extraction from Salesforce and ServiceNow Portals via Over-Privileged Guest Accounts

#saas_security #data_exposure #api_security #cloud_security #identity_security

A single attacker has been scraping data from Salesforce and ServiceNow portals since 2025 using a server with a consistent fingerprint, exploiting over-privileged guest profiles to access sensitive information across multiple industries. The campaign highlights vulnerabilities in SaaS platforms' guest access configurations, requiring remediation through tighter access controls rather than endpoint changes.

A single piece of infrastructure has been pulling records out of Salesforce and ServiceNow customer portals across multiple industries for more than a year, according to research published this week by agent security platform Reco.

The activity, which Reco has named the City Forum campaign after a domain tied to the attacker's IP address, traces back to one server: 158.220.87.79, hosted on a

Read original article

*** END OF TRANSMISSION ***

> CHERENKOV RADIATION: UNDERSTANDING SUPERLUMINAL PARTICLE EMISSION > NEIJUAN: A SOCIOLOGICAL CONCEPT OF INTENSIFIED COMPETITION WITHOUT COLLECTIVE BENEFIT > US DIESEL PRICES SURGE TO RECORD $6 PER GALLON AMID IRAN SUPPLY DISRUPTION > EXPLOITATION OF JFROG ARTIFACTORY VULNERABILITIES ENABLES ADMIN PRIVILEGE ESCALATION AND BACKDOOR DEPLOYMENT > CHINA-LINKED UNC3569 EXPLOITS SOGOU INPUT METHOD VULNERABILITY TO DEPLOY GRAYRABBIT BACKDOOR > PAPERCUT ADDRESSES ACTIVELY EXPLOITED VULNERABILITIES WITH NEW SECURITY RELEASES > CRITICAL ANALYSIS OF GPT-6 ASTRA'S CODING CAPABILITIES > CISCO FMC VULNERABILITIES EXPLOITED FOR CREDENTIAL THEFT AND QILIN RANSOMWARE DEPLOYMENT > OPENAI'S GPT-LIVE-1 API ENHANCES REAL-TIME LANGUAGE PROCESSING CAPABILITIES > GOOGLE UNVEILS GEMINI APP FOR WINDOWS PLATFORM> CHERENKOV RADIATION: UNDERSTANDING SUPERLUMINAL PARTICLE EMISSION > NEIJUAN: A SOCIOLOGICAL CONCEPT OF INTENSIFIED COMPETITION WITHOUT COLLECTIVE BENEFIT > US DIESEL PRICES SURGE TO RECORD $6 PER GALLON AMID IRAN SUPPLY DISRUPTION > EXPLOITATION OF JFROG ARTIFACTORY VULNERABILITIES ENABLES ADMIN PRIVILEGE ESCALATION AND BACKDOOR DEPLOYMENT > CHINA-LINKED UNC3569 EXPLOITS SOGOU INPUT METHOD VULNERABILITY TO DEPLOY GRAYRABBIT BACKDOOR > PAPERCUT ADDRESSES ACTIVELY EXPLOITED VULNERABILITIES WITH NEW SECURITY RELEASES > CRITICAL ANALYSIS OF GPT-6 ASTRA'S CODING CAPABILITIES > CISCO FMC VULNERABILITIES EXPLOITED FOR CREDENTIAL THEFT AND QILIN RANSOMWARE DEPLOYMENT > OPENAI'S GPT-LIVE-1 API ENHANCES REAL-TIME LANGUAGE PROCESSING CAPABILITIES > GOOGLE UNVEILS GEMINI APP FOR WINDOWS PLATFORM