Stealthy ‘City-Forum’ Attacks Target Salesforce and ServiceNow With Custom Toolset

Researchers have discovered a novel campaign, referred to as City-Forum, that targets Salesforce and ServiceNow. The attackers are exploiting unauthenticated guest access to these platforms. They use a custom toolset to quietly enumerate and exfiltrate exposed data from both Salesforce and ServiceNow. The campaign's stealthy nature allows it to operate without detection. The attackers' use of custom tools and exploitation of guest access enables them to access sensitive data. The City-Forum campaign presents a new threat to organizations using these platforms.