Wire · operational-macro
Long-running Data Theft Campaign Targets Salesforce, ServiceNow
◆ Sectors
◆ Source
◆ Verified
Fusion42 · 22 August 2026 · Fusion42 review
An advanced threat actor has been using custom tools since early 2025 to exploit overly permissive guest access in Salesforce and ServiceNow instances across multiple global sectors, stealing sensitive data by accessing poorly documented interfaces and endpoints.
This Wire brief sits within Fusion42's coverage of Cybersecurity and Enterprise Software.
◆ ◆ The Wire takeaway
You must urgently audit and restrict guest access in Salesforce and ServiceNow to avoid stealth data breaches using novel attack paths. Your security teams need to hunt the City-Forum indicators now or risk persistent data theft through overlooked platform entry points.
◆ Coverage
1 source · 13 Aug 2026
◆ Related on Wire
◆ Topics