Chairman and chief executive of Salesforce.com Marc Benioff told investors on a quarterly conference call that Citi selected the firm's CRM suite following a "lengthy evaluation process" to assess functionality, availability, security and integration capabilities.

He said Citibank selected the Salesforce.com technology over every other major CRM package, including those offered by Oracle, SAP and Microsoft.

The bank will become the vendor's fifth largest customer with more than 25,000 subscribers. The vendor's other big clients include US investment bank Merrill Lynch which earlier this year ordered the Salesforce.com financial adviser desktop product for 25,000 staff.

News of the Citi deal came as the San Francisco-based vendor reported a sharp rise in third quarter net income, which jumped to $6.5 million compared with $339,000, or break-even in the year ago period. The vendor's third quarter revenue rose 48% to $192.8 million.

However the release of the glowing results follow an embarrassing incident last week when the vendor admitted that it had been targeted by cyber fraudsters and hit with a number of phishing and malware attacks designed to get end-users of its software to divulge confidential financial data.

In a letter to customers, the vendor said one its staff had been taken in by a phishing scam that resulted in a customer contact list being copied after the worker handed over a password.

Information on the contact list included first and last names, company names, e-mail addresses, telephone numbers and related administrative data. As a result of this breach, a number of customers began receiving phishing emails that looked like salesforce.com invoices.

The vendor said a "small number" of customer end users were duped into revealing their passwords to the fraudsters. The company said its support and security teams were working with customers to "trace what occurred and prevent further attempts".

However following the first attacks, Salesforce.com said it had identified a new wave of phishing attempts targeted at a broader group of customers. The new scam e-mails included attached malware.

The vendor said it had warned its system administrators of the new, more malicious attack and was sending the letter to customers "with the goal of increasing awareness".