Mystery attacker spent a year raiding Salesforce and ServiceNow portals