Stealthy ‘City-Forum’ Attacks Target Salesforce and ServiceNow With Custom Toolset. Security researchers identified a novel attack campaign targeting Salesforce and ServiceNow platforms using a custom toolset designed for stealth. The attack exploited unauthenticated guest access to silently enumerate and exfiltrate exposed data from both platforms.

This campaign represents a sophisticated approach to initial access, leveraging poorly configured guest access features that many organizations leave unhardened. The custom toolset was designed specifically to avoid detection by standard monitoring tools, making it difficult for security teams to identify the campaign in real time. Organizations running Salesforce or ServiceNow should review their guest access configurations and monitor for unusual enumeration activity.