The "City-Forum" campaign has been active since at least March 2025 and has targeted organizations across multiple sectors with custom tooling.
Long-running Data Theft Campaign Targeting Salesforce, ServiceNow
Summary + source link. No paywalls, no tracking.