Long-running Data Theft Campaign Targeting Salesforce, ServiceNow
The "City-Forum" campaign has been active since at least March 2025 and has targeted organizations across multiple sectors with custom tooling.
We haven't written up this one. Dark Reading has the full story — the link below goes straight to it.