Ankura CTIX FLASH Update – August 14, 2026

Malware Activity

Cybersecurity Alert Misconfigured Portals and Compromised AI Tools Create Growing Enterprise Risk

Security researchers have identified two significant cyber threats that highlight how attackers are increasingly exploiting trust and configuration weaknesses rather than traditional software vulnerabilities. In the first campaign, known as City-Forum, threat actors are harvesting sensitive data from Salesforce Experience Cloud and ServiceNow portals by taking advantage of misconfigured guest-user permissions and publicly accessible settings. This allows anonymous users to access records that should not be exposed. At the same time, investigators discovered that malicious versions of the widely used AI gateway LiteLLM were briefly uploaded to PyPI. The malicious version contained hidden code designed to steal cloud credentials, API keys, database passwords, SSH keys, and other sensitive secrets. Although the malicious packages were removed quickly, thousands of