Long-running Data Theft Campaign Targeting Salesforce, ServiceNow
Refract AI Intelligence Digest
BLUF
City-Forum is actively exfiltrating data from enterprise SaaS platforms using custom tools.
NEWS
Dark Reading reports the City-Forum campaign has targeted multiple sectors since at least March 2025. Attackers are leveraging specialized tooling to compromise Salesforce and ServiceNow instances for data theft.
Why I Care
This threatens sensitive customer and operational data stored in critical business platforms across all industries. Failure to detect this could lead to severe compliance violations and financial damage.
Next Steps
Security teams must audit Salesforce and ServiceNow access logs for anomalies immediately. Organizations should review API permissions and third-party integrations within the next 72 hours.
The "City-Forum" campaign has been active since at least March 2025 and has targeted organizations across multiple sectors with custom tooling.
Source: Dark Reading ·