MEDIUMVulnerability
Global

One Attacker Has Scraped Both Salesforce and ServiceNow Portals Since 2025

·Source: The Hacker News

Updated:

Executive Summary

A single piece of infrastructure has been pulling records out of Salesforce and ServiceNow customer portals across multiple industries for more than a year, according to research published this week by agent security platform Reco. The activity, which Reco has named the City Forum campaign after a domain tied to the attacker's IP address, traces back to one server: 158.220.87.79, hosted on a

Analysis

A single piece of infrastructure has been pulling records out of Salesforce and ServiceNow customer portals across multiple industries for more than a year, according to research published this week by agent security platform Reco. The activity, which Reco has named the City Forum campaign after a domain tied to the attacker's IP address, traces back to one server: 158.220.87.79, hosted on a

Indicators of Compromise (1)

IPv4 (1)
158.220.87.79
VirusTotalShodanAbuseIPDB
Source Attribution

Originally published by The Hacker News on Aug 18, 2026.

Related Threats

MEDIUMVulnerability

FDA Weighing Possible Regs for GenAI Medical Devices

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/fda-weighing-possible-regs-for-generative-ai-medical-devices-image_small-6-a-32593.jpg" align=right hspace=4><b>Agency Seeks Public Input on Risk-Based Oversight Approach Across Product Life Cycle</b><br>The U.S. Food and Drug Administration is seeking public feedback on the varying risks and other considerations involving generat

Bank Info Security
MEDIUMVulnerability

When AI Risk Becomes a Board Liability

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/when-ai-risk-becomes-board-liability-image_small-9-a-32594.jpg" align=right hspace=4><b>CIOs Can Strengthen Oversight Through Reporting, Records and Insurance Reviews</b><br>AI failures can trigger financial, regulatory and reputational exposure that reaches the boardroom. Reed Smith partners Carolyn Rosenberg and Andy Moss explai

Bank Info Security
CRITICALVulnerability

Critical GitLab Zero-Click Flaw Poses Mitigation Challenges

A lack of technical details could make it hard for organizations running self-managed GitLab versions to detect potential exploitation of CVE-2026-19478.

CVE-2026-19478
Dark Reading