"City-Forum" data-theft attacks target Salesforce, ServiceNow portals
Summary
A data theft campaign, dubbed "City-Forum," is actively targeting Salesforce Experience Cloud and ServiceNow customer portals. Attackers are exploiting misconfigurations that expose data to anonymous users, utilizing custom tools to exfiltrate sensitive information.
IFF Assessment
FOE
This campaign represents a direct threat to organizations by exploiting vulnerabilities to steal data, making it bad news for defenders.
Defender Context
This campaign highlights the critical need for organizations to rigorously audit their cloud-based customer portals like Salesforce and ServiceNow for misconfigurations that allow anonymous data access. Defenders should focus on implementing strict access controls and regularly testing their security posture against such exposure vectors.