Security researchers have identified two significant cyber threats that highlight how attackers are increasingly exploiting trust and configuration weaknesses rather than traditional software vulnerabilities. In the first campaign, known as City-Forum, threat actors are harvesting sensitive data from Salesforce Experience Cloud and ServiceNow portals by taking advantage of misconfigured guest-user permissions and publicly accessible settings. This allows anonymous users to access records that should not be exposed. At the same time, investigators discovered that malicious versions of the widely used AI gateway LiteLLM were briefly uploaded to PyPI. The malicious version contained hidden code designed to steal cloud credentials, API keys, database passwords, SSH keys, and other sensitive secrets. Although the malicious packages were removed quickly, thousands of organizations may have been exposed, and stolen credentials could remain usable for extended periods. Together, these incidents demonstrate the growing risks associated with cloud platform misconfigurations and software supply chain attacks, where legitimate systems and trusted tools can become pathways for large-scale data theft. Organizations are urged to immediately review portal access controls, remove unnecessary public exposure, identify affected LiteLLM installations, rotate potentially compromised credentials, and monitor for signs of unauthorized activity to reduce the risk of long-term compromise. CTIX analysts will continue to report on the latest malware strains and attack methodologies.