Long-running Data Theft Campaign Targeting Salesforce, ServiceNow

The ongoing 'City-Forum' campaign highlights the persistent threat of sophisticated data theft efforts targeting major enterprise platforms like Salesforce and ServiceNow. This underscores the urgent need for enhanced cybersecurity measures among organizations to protect sensitive data and maintain trust in digital infrastructure.

• The campaign has been active since March 2025, demonstrating its prolonged persistence.
• Targeted organizations span multiple sectors, indicating broad industry vulnerability.
• Custom tooling suggests advanced, well-resourced threat actors behind the campaign.