← Back to Feed
Long-running Data Theft Campaign Targeting Salesforce, ServiceNow
August 12, 2026 · Dark Reading · Severity: MEDIUM
A long-running data theft campaign called City-Forum has been active since at least March 2025. It targets organizations across multiple sectors using custom tooling to compromise Salesforce and ServiceNow environments.
Key Takeaways
- The City-Forum campaign has been stealing data from Salesforce and ServiceNow since March 2025
- Custom tooling is used to target organizations across multiple industries
- This long-running campaign poses a significant threat to enterprise cloud platforms