City-Forum

notes

Long-running Data Theft Campaign Targeting Salesforce, ServiceNow

1. Executive summary The "City-Forum" campaign has been active since at least March 2025, conducting a long-running data theft operation targeting Salesforce

13 Aug 2026 · 5 min read read →

notes

Stealthy ‘City-Forum’ Attacks Target Salesforce and ServiceNow With Custom Toolset

1. Executive summary A sophisticated, ongoing campaign designated "City-Forum" has been actively exploiting unauthenticated guest user access in Salesforce and ServiceNow portals to

12 Aug 2026 · 6 min read read →

page 1 of 1