City-Forum Campaign Targets Salesforce and ServiceNow Environments in Long-Running Data Theft Operation

A sophisticated, long-running data theft campaign designated "City-Forum" has been active since at least March 2025, targeting organizations across multiple sectors with custom tooling aimed at Salesforce and ServiceNow environments. According to reporting, the threat actor has been conducting operations focused on unauthorized access and data exfiltration from customer relationship management and IT service management platforms. The campaign has targeted organizations globally across various sectors, though specific victim organizations and the exact volume of data stolen remain unconfirmed. The campaign leverages custom tooling for unauthorized access, with no specific vulnerability or zero-day attributed to the operation. Instead, the reported exploitation method appears consistent with credential-based access or misconfiguration exploitation of Salesforce and ServiceNow instances. As of now, no specific patch has been identified; mitigation guidance emphasizes credential hygiene, API security, and monitoring for anomalous activity within Salesforce and ServiceNow environments.