Long-running Data Theft Campaign Targeting Salesforce, ServiceNow

The "City-Forum" campaign, active since March 2025, has seen a threat actor targeting Salesforce and ServiceNow instances with custom tools to steal data. Unlike traditional attacks relying on publicly available tools, this actor has developed unique techniques to exploit less-documented interfaces, specifically the data-access layer of Salesforce's Lightning Web Runtime (LWR). The campaign has impacted organizations across multiple sectors globally, including telecommunications, financial services, and public-sector portals, and involves stealing sensitive data such as customer information, support tickets, and knowledge bases.