Salt Typhoon Espionage Campaign
A powerful international alert has revealed that Salt Typhoon, a sophisticated espionage group linked to Chinese state interests, has infiltrated critical infrastructure across the globe-targeting telecommunications, government, transportation, lodging, and military sectors. The advisory, co-issued by the FBI, CISA, NSA, the UK’s NCSC, and numerous other partners, exposes how this threat actor exploits backbone routers […]
WhatsApp Emergency Patch
WhatsApp recently deployed an emergency update to address a critical security flaw affecting iOS and macOS versions of its app. The vulnerability, known as CVE-2025-55177, stems from improper authorization in linked device synchronization messages, potentially allowing malicious content from arbitrary URLs to execute silently on a user’s device. This flaw was potentially exploited in combination […]
Government Takedown of VerifTools
The U.S. Attorney’s Office for the District of New Mexico has successfully seized two domains and a blog linked to VerifTools, a notorious online marketplace distributing counterfeit driver’s licenses, passports, and other identity documents. This action comes after a court-authorized operation revealing that VerifTools sold forged identity documents for as little as nine dollars via […]
Adversary-in-the-Middle (AiTM) Attacks
In the evolving cyber threat landscape, Adversary-in-the-Middle (AiTM) attacks have emerged as a sophisticated form of credential theft. Unlike traditional phishing campaigns, AiTM goes beyond simple deception by inserting a malicious proxy between the victim and a legitimate service. This enables attackers to steal not only usernames and passwords but also multifactor authentication (MFA) tokens, […]
Fake-ID Marketplace Shutdown
Law enforcement agencies, including the FBI and Dutch National Police, have dismantled VerifTools-a widespread marketplace selling counterfeit identity documents. The shutdown involved seizing both physical and virtual servers in Amsterdam and disabling multiple domains, now redirecting users to an FBI seizure notice. VerifTools made it alarmingly simple to produce fake IDs: users uploaded a photo, […]
Containing Velociraptor Abuse in the Wild
Threat actors recently elevated their tactics by weaponizing Velociraptor, a respected open-source digital forensics and incident response (DFIR) tool typically used by defenders to investigate breaches. In a sophisticated breach, attackers used the Windows msiexec utility to download a malicious Velociraptor installer from a Cloudflare Workers–hosted staging domain. The installed tool was configured to communicate […]
“Salt Typhoon” Cyber-Espionage.
The China-linked Advanced Persistent Threat (APT) group known as Salt Typhoon has waged an expansive espionage campaign against global networks, infiltrating over 600 organizations across 80 countries, including around 200 in the U.S. Key Impact & Tactics: Targeted Sectors: Telecommunications, government, transportation, lodging, and military infrastructure have all been compromised. Initial Access via Known Vulnerabilities: […]
Microsoft Teams is Being Weaponized
In today’s digital workplace, Microsoft Teams has become foundational to collaboration and productivity. Yet, its trusted role is now being exploited by cyber adversaries. Recent campaigns have seen malicious actors impersonate IT support via Teams chats or calls, tricking employees into granting remote access and deploying dangerous malware. Tactics often begin with social engineering and […]
UpCrypter Malware Targets Global Organizations
The cybersecurity landscape continues to evolve as threat actors adopt increasingly sophisticated techniques to breach defenses. A recent phishing campaign exploiting the UpCrypter malware loader has highlighted the urgency for organizations to rethink their security posture. UpCrypter, a malicious loader, has been weaponized to bypass security controls and deploy additional payloads into victim environments. This […]
Proxyware Malware as YouTube Videos
Cybercriminals are getting more creative in spreading malware, and the latest trend involves using proxyware-legitimate software that shares internet bandwidth-as a cover for malicious activities. A new campaign is leveraging YouTube videos to distribute malware disguised as proxyware installers, posing significant risks to both businesses and individual users. How the Attack Works Hackers upload videos […]