threat-intel Long-running Data Theft Campaign Targeting Salesforce, ServiceNow The "City-Forum" campaign, active since March 2025, has seen a threat actor targeting Salesforce and ServiceNow instances with custom tools to steal data. Unlike traditional attacks relying on publicly available tools, this actor has developed unique techniques to exploit less-documented interfaces, specifically the da… Dark Reading · Aug 12, 2026 High USCAGBsalesforceservicenowguest access
threat-intel Stealthy ‘City-Forum’ Attacks Target Salesforce and ServiceNow With Custom Toolset A sophisticated and innovative campaign, dubbed ‘City-Forum,’ is targeting Salesforce and ServiceNow using a custom multi-platform toolset. The attackers are exploiting unauthenticated guest user access to gather data, p… SecurityWeek · Aug 12, 2026 High guest userunauthenticated accessdata exfiltration
threat-intel Bug Bounty Research Triggers ServiceNow Security Alert ServiceNow experienced a situation where bug bounty research was mistakenly identified as a security breach targeting their customer instances. The issue involved unauthorized access to instance tables, but ServiceNow de… Dark Reading · Jun 10, 2026 Low AUbug bountyresearchsecurity
