One Attacker Has Scraped Both Salesforce and ServiceNow Portals Since 2025

A single server has been systematically scraping data from Salesforce and ServiceNow customer portals since March 2025, targeting industries including telecoms, finance, and public sector. The attacker, operating under the ‘City Forum’ campaign, utilizes a Go-based tool to exploit persistent guest user accounts and byp…