City-Forum Campaign Uses Custom Go Tool to Steal SaaS Data
Reco uncovered a long-running campaign that exploits guest-user access in Salesforce Experience Cloud and ServiceNow Service Portals. Using a bespoke Go-based toolset, the attacker enumerates Aura, LWR and ServiceNow search endpoints, exfiltrating records from telecoms, banks and public-sector sites. The operation has been active since March 2025, targeting any organization with over-permissive guest access.