The "City-Forum" campaign has been active since at least March 2025 and has targeted organizations across multiple sectors with custom tooling.
Originally published at darkreading.com
SecurityAI-assisted1 min read
Long-running Data Theft Campaign Targeting Salesforce, ServiceNow
A sophisticated data theft campaign dubbed 'City-Forum' has been actively targeting enterprise cloud platforms Salesforce and ServiceNow since at least March 2025. The campaign employs custom-built tooling to compromise organizations across multiple industry sectors, representing a significant threat to enterprise SaaS environments.
▸ Want a deeper look?
Talk to an architect about applying this to your stack.
60-minute technical evaluation, no obligation. We'll map the ideas in this article to your environment.
▸ Continue reading
