City-Forum Campaign Hits Salesforce, ServiceNow Since 2025

Introduction

In early 2025, a covert threat actor identified as City‑Forum emerged and launched a sustained data‑theft operation that has continued unabated. The campaign’s primary focus is on extracting sensitive information from organizations that rely on Salesforce and ServiceNow, employing custom‑crafted tooling to remain hidden from standard security controls. This prolonged activity highlights the evolving tactics of cyber‑espionage in the cloud era and underscores the need for vigilant, adaptive defenses.

City-Forum Campaign: A Prolonged Data‑Theft Operation

The City‑Forum operation has been active since the beginning of 2025 and shows no signs of stopping. Its longevity indicates a well‑organized effort that continuously refines its techniques to stay ahead of detection mechanisms. By deploying bespoke modules that modify API calls and masquerade as legitimate processes, the actors have successfully infiltrated both Salesforce and ServiceNow environments. The group harvests user credentials, configuration settings, and confidential records, targeting a wide range of industries from finance to healthcare, education to manufacturing, thereby demonstrating its cross‑sector adaptability and strategic intent to gather valuable intellectual property and operational details.

Targeted Platforms: Salesforce and ServiceNow Under Fire

The campaign’s main victims are users of Salesforce, the dominant customer relationship management platform, and ServiceNow, the leading IT service management system. Both services store extensive personal and operational data, making them attractive targets for espionage and financial gain. Attackers have developed payloads that impersonate trusted login interfaces, allowing them to bypass native authentication checks and exfiltrate information without triggering immediate alerts. This sophisticated approach exploits the deep integration of these platforms with enterprise workflows, enabling the theft of not only records but also configuration metadata that can be leveraged for further attacks.

Custom Tooling and Sector‑Wide Impact

The campaign relies on a suite of custom‑built tools that are tailored to each target environment. Key capabilities include:

• Tailored malware that modifies API requests to siphon data silently, remaining invisible to traditional endpoint detectors.
• Phishing kits that replicate trusted login interfaces for both platforms, deceiving users into surrendering credentials.
• Scripts that harvest active session tokens and credentials, enabling attackers to move laterally within the cloud environment.
• Payloads that encrypt critical datasets after extraction, adding a ransomware‑like dimension to the theft.

These capabilities have been observed across a diverse set of sectors, including finance, healthcare, education, manufacturing, and professional services. The breadth of impact illustrates how the attackers leverage the widespread adoption of Salesforce and ServiceNow to reach a broad audience, making the campaign a significant concern for any organization that depends on these cloud services. The campaign’s ability to pivot between platforms and maintain persistence over many months reflects a high level of operational sophistication, requiring organizations to adopt layered defenses rather than relying on a single security control.

Response and Mitigation Strategies

Security teams are urged to strengthen identity verification by enforcing multi‑factor authentication and monitoring for anomalous API activity. Regular audits of third‑party integrations, timely patching of underlying systems, and deployment of behavior‑based detection platforms are essential steps. Sharing indicators of compromise (IOCs) with industry groups and participating in threat‑intel feeds can accelerate detection and containment. Additionally, implementing automated response playbooks that trigger alerts and isolate compromised accounts can dramatically reduce the campaign’s effectiveness and limit potential damage.

Conclusion

In summary, the City‑Forum data‑theft initiative represents a persistent, sophisticated threat targeting Salesforce and ServiceNow users across diverse sectors. Its reliance on custom tooling underscores the need for robust identity controls, vigilant monitoring, and collaborative threat intelligence. By strengthening security postures and leveraging advanced analytics, businesses can protect themselves against this and similar long‑running campaigns, ensuring a resilient digital environment.