Custom tools harvested whatever over-permissioned guest accounts would surrender

Stealthy City-Forum attacks use a custom toolset to exploit guest access and extract exposed data from Salesforce and ServiceNow environments.

The "City-Forum" campaign has been active since at least March 2025 and has targeted organizations across multiple sectors.