As reported by Dark Reading, a persistent data theft operation dubbed "City-Forum" has been actively targeting organizations through Salesforce and ServiceNow environments since at least March 2025. While the article outlines the campaign's timeline and multi-sector targeting, Shield53's analysts believe the deeper story here is what this campaign reveals about the maturation of SaaS-focused threat operations — and how dangerously underprepared most organizations remain.
Why This Campaign Is More Significant Than It Appears
Historically, enterprise SaaS platforms like Salesforce and ServiceNow have been treated as inherently "safe" by security teams — after all, the vendor handles the infrastructure. This campaign is a textbook example of what we call trust exploitation: adversaries are not breaking into these platforms through zero-day vulnerabilities. They are using legitimate credentials, API tokens, and OAuth flows to blend into normal business operations. The threat actors behind City-Forum understand that security operations centers (SOCs) are tuned to detect endpoint and network anomalies — not suspicious CRM queries or ITSM record exports.
The use of custom tooling is particularly concerning. Purpose-built tools designed specifically for Salesforce and ServiceNow data exfiltration suggest significant pre-operational research, likely including reconnaissance of target-specific data models, field naming conventions, and access control configurations. This is not opportunistic attack behavior — it is deliberate, patient, and strategic.
Who Is at Risk
Any organization operating Salesforce or ServiceNow at enterprise scale should consider itself a potential target. However, the highest-risk profiles include:
The Blind Spots Attackers Are Exploiting
Most enterprise security programs invest heavily in endpoint detection, email security, and network monitoring. SaaS application telemetry, by contrast, is frequently undermonitored. Few organizations have deployed a dedicated SaaS Security Posture Management (SSPM) solution, and even fewer have integrated Salesforce or ServiceNow audit logs into their SIEM in a meaningful way. Threat actors know this. Exfiltrating thousands of records through a Salesforce API call may generate zero alerts in a conventional SOC environment.
"The perimeter has dissolved. When your CRM is your crown jewel, the security strategy must follow the data — not the network boundary."
Additionally, the long operational timeline — active since at least March 2025 — suggests the attackers are deliberately operating below detection thresholds. Low-and-slow data exfiltration from SaaS platforms is extremely difficult to identify without behavioral baselines and anomaly detection tuned specifically to application-layer activity.
Broader Implications for SaaS Security Strategy
City-Forum is unlikely to be an isolated campaign. As organizations continue migrating critical business processes to SaaS platforms, we expect threat actors — both financially motivated and state-sponsored — to increasingly invest in SaaS-native attack tooling. The same economic logic that drove ransomware groups to target backup infrastructure now applies to CRM and ITSM data: if that's where the value lives, that's where adversaries will focus.
Security leaders should also consider the supply chain implications. Many organizations share Salesforce instances with partners, resellers, or managed service providers. A compromised third-party integration or connected org could serve as the initial access vector without any direct attack on the primary tenant.
Shield53 Recommendations
Immediate Actions
- Audit active Salesforce Connected Apps and OAuth tokens — revoke any that are unused, unrecognized, or granted excessive permissions. Review who has API-only access profiles.
- Enable and review Salesforce Event Monitoring — if not already licensed, prioritize this. Focus on bulk API queries, report exports, and login anomalies from new IP ranges or unusual geographies.
- Review ServiceNow ACL and role assignments — enforce least-privilege rigorously. Audit service accounts and integration users for scope creep.
- Ingest SaaS audit logs into your SIEM — create detection rules for high-volume record access, off-hours exports, and access from new user agents or client IPs.
- Enforce MFA on all SaaS accounts without exception — including API service accounts where technically feasible, using certificate-based or IP-restriction controls as compensating measures where MFA cannot be applied.
Strategic Actions
- Evaluate and deploy a SSPM solution to continuously assess SaaS configuration drift and permission sprawl across your application portfolio.
- Conduct a data classification exercise within Salesforce and ServiceNow — understand exactly what sensitive data resides in these platforms and apply field-level security accordingly.
- Engage your Salesforce and ServiceNow administrators in tabletop exercises simulating insider threat and compromised credential scenarios specific to these platforms.
- Review third-party integration security — map all connected applications, validate their security posture, and remove any unnecessary connections.
The City-Forum campaign is a warning shot. Organizations that continue treating SaaS security as the vendor's problem will find themselves on the wrong side of the next breach disclosure. Shield53 urges security leaders to extend their detection and response capabilities explicitly into the SaaS layer — before the next campaign finds the gaps first.
