AN ADVANCED ATTACKER IS TARGETING SALESFORCE AND SERVICENOW

Summary from the TLDR IT newsletter

There is an ongoing campaign targeting guest-accessible Salesforce Experience Cloud sites and ServiceNow Service Portals from infrastructure linked to the IP address 158.220.87[.]79. The actor uses Salesforce Aura and previously undocumented Salesforce LWR UI-API techniques, plus a ServiceNow search endpoint, to extract records.