THREATNOIR
Subscribe
Back to Feed
Threat IntelligenceAug 12, 2026

Long-running Data Theft Campaign Targeting Salesforce, ServiceNow

City-Forum campaign targets Salesforce and ServiceNow with custom tools since March 2025.

Read at source

Summary

A long-running data theft campaign dubbed 'City-Forum' has been active since at least March 2025, employing custom malware and techniques to target organizations using Salesforce and ServiceNow. The campaign has impacted various sectors, indicating a broad and persistent threat actor.

Entities

City-Forum (campaign)Salesforce (product)ServiceNow (product)