Critical

Stealthy ‘City-Forum’ Attacks Target Salesforce and ServiceNow With Custom Toolset

SecurityWeek

August 12, 2026 at 1:00 PM

Actively Exploited

Overview

Researchers have discovered a new campaign dubbed 'City-Forum' that targets Salesforce and ServiceNow platforms. This attack takes advantage of unauthenticated guest access to silently gather and extract sensitive data from these services. The attackers use a specialized toolset to carry out their operations, which raises concerns about the security of user information on these widely used platforms. Since Salesforce and ServiceNow host critical business data for many organizations, this incident could have serious implications for data privacy and security. Companies using these platforms are urged to review their access controls and security measures to prevent unauthorized data access.

Key Takeaways

Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
Affected Systems: Salesforce, ServiceNow
Action Required: Companies should review and tighten access controls, especially for unauthenticated guest access.
Timeline: Newly disclosed

Original Article Summary

Researchers observed the novel campaign exploiting unauthenticated guest access to quietly enumerate and exfiltrate exposed data from both platforms. The post Stealthy ‘City-Forum’ Attacks Target Salesforce and ServiceNow With Custom Toolset appeared first on SecurityWeek.

Impact

Salesforce, ServiceNow

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Newly disclosed

Remediation

Companies should review and tighten access controls, especially for unauthenticated guest access.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to Data Breach, Critical.

Read Original Article

Related Coverage

Researchers observe first ‘near-autonomous’ AI attack on government target in Taiwan

CyberScoop

Researchers from the Israeli cyber firm Dream have reported the first observed instance of a 'near-autonomous' AI attack targeting a government entity in Taiwan. The AI framework used in the attack demonstrated the ability to adjust its tactics during the operation, correcting its errors and expanding its approach as it progressed. This incident raises significant concerns about the evolving capabilities of AI in cyber warfare, particularly in how it can autonomously adapt to overcome defenses. The implications are serious for national security and highlight the need for governments and organizations to bolster their cybersecurity measures against such advanced threats. As AI technology continues to develop, the potential for similar attacks could increase, posing a risk to various sectors worldwide.

Aug 12, 2026

Hackers are hunting for your private photos, FBI warns: 6 ways to avoid a sextortion nightmare

WindRelay Malware Pairs With SpyNote RAT in Live-Call Scam

Infosecurity Magazine

A new type of malware known as WindRelay is being used in conjunction with the SpyNote Remote Access Trojan (RAT) to execute live-call scams. This combination allows fraudsters to clone credit cards during phone calls, posing a significant risk to unsuspecting victims. The attackers can manipulate information in real-time, making it easier for them to deceive individuals and potentially steal their financial information. This incident serves as a reminder for users to be cautious during phone conversations, especially when discussing sensitive information. Awareness and vigilance are key to preventing falling victim to such scams.

Aug 12, 2026

FBI: Hackers target online accounts to steal nude photos

BleepingComputer

The FBI has issued a warning regarding a growing trend where hackers are targeting social media and online accounts of both adults and children to steal explicit images and videos. These cybercriminals use various tactics to gain access to accounts, raising concerns about the safety and privacy of users online. The stolen content can be used for blackmail or shared publicly, which can have severe emotional and psychological impacts on the victims. This incident is particularly alarming given the increasing prevalence of such cyber crimes, especially as more people share personal content online. Users are urged to enhance their account security by using strong passwords and enabling two-factor authentication to protect their private information from these malicious actors.

Aug 12, 2026

Zoom vulnerabilities could enable RCE against meeting participants

SCM feed for Latest

Researchers recently identified vulnerabilities in Zoom's screenshare annotation feature that could allow attackers to execute remote code on devices of meeting participants. These flaws were uncovered with the help of AI tools, which indicates a growing trend of using advanced technology in security research. Users of Zoom, particularly those who frequently use the screenshare feature, are at risk. If exploited, these vulnerabilities could lead to unauthorized access to sensitive information or control over user devices. It's crucial for Zoom to address these flaws promptly to protect their users and maintain trust in their platform.

Aug 12, 2026

A stranger has been reading Salesforce and ServiceNow portals worldwide for 17 months

Help Net Security

For the past 17 months, an unknown individual has been accessing Salesforce and ServiceNow portals worldwide, according to researchers from Reco who are tracking this ongoing campaign dubbed 'City-Forum.' The campaign began using a domain that was registered back in 2002 but has since been linked to a generic server hosted in Germany. This unauthorized access has allowed the attacker to pull sensitive records from these widely used platforms, which could potentially compromise the data of numerous organizations. This situation raises serious concerns about the security measures in place for cloud-based services and highlights the need for companies to review their access controls and monitoring practices to protect against such long-term intrusions.

Aug 12, 2026