Long-running Data Theft Campaign Targeting Salesforce, ServiceNow
City-Forum campaign targets Salesforce and ServiceNow with custom tools since March 2025.
A long-running data theft campaign dubbed 'City-Forum' has been active since at least March 2025, employing custom malware and techniques to target organizations using Salesforce and ServiceNow. The campaign has impacted various sectors, indicating a broad and persistent threat actor.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Salesforce?
Get an email when a new story names Salesforce, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe 'City-Forum' campaign demonstrates how threat actors are increasingly targeting cloud-based SaaS platforms that house sensitive business data, customer records, and operational information. By deploying custom malware and tailored techniques against widely-used platforms like Salesforce and ServiceNow, attackers can achieve broad organizational impact across multiple industries simultaneously. The campaign's longevity — active since at least March 2025 — suggests that many organizations lacked sufficient monitoring to detect the intrusion in a timely manner. This matters because SaaS platforms often hold an organization's most critical data assets, yet security teams frequently underestimate the need to apply traditional security controls in cloud environments.
What helps against this
How we list vendors- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- SaaS security posture management (SSPM)
Business apps like Microsoft 365 and Salesforce stop leaking through risky settings and connected apps.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.