Long-running Data Theft Campaign Targeting Salesforce, ServiceNow

An unknown threat actor has been using a custom toolset to probe Salesforce and ServiceNow instances with overly permissive guest access and steal data for more than a year.

The targets have spanned multiple sectors, including telecommunications, financial services, enterprise software, security and data-privacy companies, and public-sector portals worldwide. Researchers at AI cybersecurity firm Reco, who are tracking the campaign, have dubbed it "City-Forum" after the domain name linked to the attacker’s IP address, and it's been active since at least March 2025.

https://www.darkreading.com/cyberattacks-data-breaches/long-running-data-theft-campaign-salesforce-servicenow