An ongoing data theft campaign uses custom tools to steal data exposed to anonymous users through Salesforce Experience Cloud and ServiceNow customer portals.

Stealthy City-Forum attacks use a custom toolset to exploit guest access and extract exposed data from Salesforce and ServiceNow environments.

The "City-Forum" campaign has been active since at least March 2025 and has targeted organizations across multiple sectors.