Long-running Data Theft Campaign Targeting Salesforce, ServiceNow
A data theft campaign dubbed "City-Forum" has been targeting organizations using Salesforce and ServiceNow since at least March 2025, employing custom tools to steal data across multiple sectors.
A long-running data theft campaign dubbed "City-Forum" has been targeting organizations using Salesforce and ServiceNow since at least March 2025. The operation employs custom tooling to breach multiple sectors. Attackers are believed to have exploited misconfigurations or vulnerabilities in these enterprise platforms to steal sensitive data. The campaign remains active, posing a persistent threat to affected organizations.