-
Cybersecurity researchers have called attention to a cyber attack in which unknown threat actors deployed an open-source endpoint monitoring and digital forensic tool called Velociraptor, illustrating ongoing abuse of legitimate software for malicious purposes. “In this incident, the threat actor used the tool to download and execute Visual Studio Code with the likely intention of creating a
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
A critical zero-day vulnerability in Citrix NetScaler products, identified as CVE-2025-6543, has been actively exploited by threat actors since at least May 2025, months before a patch was made available.
While Citrix initially downplayed the flaw as a “memory overflow vulnerability leading to unintended control flow and Denial of Service,” it has since been revealed to allow for unauthenticated remote code execution (RCE), leading to widespread compromise of government and legal services worldwide.
In late June 2025, Citrix released a patch for CVE-2025-6543. However, by that time, attackers had already been leveraging the vulnerability for weeks.
The exploit was used to infiltrate NetScaler remote access systems, deploy webshells to ensure persistent access even after patching, and steal credentials.
Evidence suggests that Citrix was aware of the severity and the ongoing exploitation but failed to disclose the full extent of the threat to its customers, Kevin Beaumont said.
The company provided a script to check for compromise only upon request and under restrictive conditions, without fully explaining the situation or the script’s limitations.
The Dutch National Cyber Security Centre (NCSC) has played a pivotal role in exposing the true nature of the attacks. Their investigation confirmed that the vulnerability was exploited as a zero-day and that attackers actively covered their tracks, making forensic analysis challenging.
The NCSC’s report, released in August 2025, stated that “several critical organizations within the Netherlands have been successfully attacked” and that the vulnerability was abused since at least early May.
How the Exploit Works
The same sophisticated threat actor is also believed to be behind the exploitation of another zero-day, CVE-2025–5777, also known as CitrixBleed 2, which was used to steal user sessions.
Investigations are ongoing to determine if this actor is also responsible for exploiting a more recent vulnerability, CVE-2025-7775.
The CVE-2025–6543 vulnerability allows an attacker to overwrite system memory by supplying a malicious client certificate to the
/cgi/api/loginendpoint on a vulnerable NetScaler device.By sending hundreds of these requests, an attacker can overwrite enough memory to execute arbitrary code on the system. This method gives them a foothold in the network, which they have used to move laterally into Active Directory environments by misusing stolen LDAP service account credentials.
Security professionals urge all organizations using internet-facing Citrix NetScaler devices to take immediate action.
System administrators should check for signs of compromise, which include looking for large POST requests to
/cgi/api/loginin web access logs, often in quick succession.A corresponding NetScaler log error code of 1245184, indicating an invalid client certificate, is a strong indicator of an exploitation attempt.
The NCSC has released scripts on GitHub to help organizations check for compromise on live hosts and in coredump files.
If a system is believed to be compromised, the recommended steps are:
- Immediately take the NetScaler device offline.
- Image the system for forensic analysis.
- Change the LDAP service account credentials to prevent lateral movement.
- Deploy a new, patched NetScaler instance with fresh credentials.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2025-6543 to its Known Exploited Vulnerabilities (KEV) catalog, underscoring the urgency for organizations to apply patches and hunt for signs of malicious activity.
Find this Story Interesting! Follow us on Google News, LinkedIn, and X to Get More Instant Updates.
The post Critical Citrix 0-Day Vulnerability Exploited Since May, Leaving Global Entities Exposed appeared first on Cyber Security News.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
A new malware campaign, dubbed “Sindoor Dropper,” is targeting Linux systems using sophisticated spear-phishing techniques and a multi-stage infection chain.
The campaign leverages lures themed around the recent India-Pakistan conflict, known as Operation Sindoor, to entice victims into executing malicious files.
This activity’s standout feature is its reliance on weaponized
.desktopfiles, a method previously associated with the advanced persistent threat (APT) group APT36, also known as Transparent Tribe or Mythic Leopard.The attack begins when a user opens a malicious
.desktopfile, named “Note_Warfare_Ops_Sindoor.pdf.desktop,” which masquerades as a standard PDF document.According to Nextron system analysis, upon execution, it opens a benign decoy PDF to maintain the illusion of legitimacy while silently initiating a complex, heavily obfuscated infection process in the background.
‘Sindoor Dropper’ Malware Targets Linux Systems This process is designed to evade both static and dynamic analysis, with the initial payload reportedly having zero detections on VirusTotal at the time of its discovery.
‘Sindoor Dropper’ Malware Targets Linux Systems
The
.desktopfile downloads several components, including an AES decryptor (mayuw) and an encrypted downloader (shjdfhd).The decryptor, a Go binary packed with UPX, is intentionally corrupted by stripping its ELF magic bytes, likely to bypass security scans on platforms like Google Docs. The
.desktopfile restores these bytes on the victim’s machine to make the binary executable again.This kicks off a multi-stage process where each component decrypts and runs the next. The chain includes basic anti-virtual machine checks, such as verifying board and vendor names, blacklisting specific MAC address prefixes, and checking machine uptime.
All strings within the droppers are obfuscated using a combination of Base64 encoding and DES-CBC encryption to further hinder analysis.
The final payload is a repurposed version of MeshAgent, a legitimate open-source remote administration tool. Once deployed, MeshAgent connects to a command-and-control (C2) server hosted on an Amazon Web Services (AWS) EC2 instance at
wss://boss-servers.gov.in.indianbosssystems.ddns[.]net:443/agent.ashx.This gives the attacker full remote access to the compromised system, enabling them to monitor user activity, move laterally across the network, and exfiltrate sensitive data, Nextron said.
The Sindoor Dropper campaign highlights an evolution in threat actor tradecraft, demonstrating a clear focus on Linux environments, which phishing campaigns have less targeted.
IOCs for Sindoor Dropper
IOC Type Indicator Description File Hash 9943bdf1b2a37434054b14a1a56a8e67aaa6a8b733ca785017d3ed8c1173ac59Initial phishing payload ( Note_Warfare_Ops_Sindoor.pdf.desktop)File Hash 9a1adb50bb08f5a28160802c8f315749b15c9009f25aa6718c7752471db3bb4bDecrypted AES decryptor ( mayuw)File Hash 0f4ef1da435d5d64ccc21b4c2a6967b240c2928b297086878b3dcb3e9c87aa23Stage 2 downloader ( shjdfhd)File Hash 38b6b93a536cbab5c289fe542656d8817d7c1217ad75c7f367b15c65d96a21d4Stage 3 downloader ( inter_ddns) and the decrypted MeshAgent payload (server2)File Hash 05b468fc24c93885cad40ff9ecb50594faa6c2c590e75c88a5e5f54a8b696ac8MeshAgent final payload ( server2)File Hash ba5b485552ab775ce3116d9d5fa17f88452c1ae60118902e7f669fd6390eae97Decoy PDF document ( /tmp/Note_Warfare.pdf)Filename Note_Warfare_Ops_Sindoor.pdf.desktopThe initial weaponized .desktopfile used for phishingFilename /tmp/Note_Warfare.pdfThe benign decoy document displayed to the victim Filename mayuwAES decryptor payload Filename shjdfhdEncrypted Stage 2 downloader Filename accessAES decryptor for the next stage Filename inter_ddnsStage 3 downloader Filename server2The final MeshAgent payload Network wss://boss-servers.gov.in.indianbosssystems.ddns[.]net:443/agent.ashxCommand-and-control (C2) server URL for the MeshAgent payload Network indianbosssystems.ddns[.]netMalicious C2 domain Network 54.144.107[.]42IP address of the C2 server, hosted on AWS By combining timely, region-specific social engineering with advanced evasion techniques, the attackers increase their likelihood of successfully compromising sensitive networks.
Find this Story Interesting! Follow us on Google News, LinkedIn, and X to Get More Instant Updates.
The post New ‘Sindoor Dropper’ Malware Targets Linux Systems with Weaponized .desktop Files appeared first on Cyber Security News.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
API penetration testing has evolved dramatically in 2025. While traditional, human-led penetration testing remains critical, the scale and complexity of modern APIs have necessitated a new approach.
The companies on this list are not just offering one-time testing services; they provide automated, continuous, and intelligent API security platforms that perform dynamic testing, behavioral analysis, and real-time protection, effectively acting as an automated penetration test that runs 24/7.
These platforms are designed to “shift security left” into the development pipeline and protect APIs in production.
Why We Choose These Companies
The rise of a “platform-first” approach to API security is a response to the limitations of traditional testing. The sheer volume and frequent updates of APIs mean that a yearly or quarterly human-led test is no longer sufficient.
The top companies in this space for 2025 have embraced automation, machine learning, and continuous discovery to provide security that keeps pace with development.
They blend proactive testing (like DAST) with runtime protection (like WAF and behavioral analysis) to provide a comprehensive security posture.
How We Choose It
Our selection is based on the following criteria:
API-Specific Expertise: A deep focus on the unique risks of APIs, such as broken object-level authorization (BOLA) and business logic abuse, as outlined in the OWASP API Security Top 10.
Automation & Continuous Testing: The ability to automatically discover APIs and continuously test them for vulnerabilities without manual intervention.
Runtime Protection: The integration of real-time monitoring and protection against live attacks.
“Shift-Left” Capabilities: Tools that integrate with development workflows to find and fix issues before they reach production.
Market Leadership & Trust: Recognition from industry analysts and a proven track record with enterprise clients.
Comparison Of Key Features (2025)
Company Automated Discovery DAST Capabilities Runtime Protection Shift-Left Integration Salt Security 
Yes Yes Yes YesNoname Security Yes Yes Yes YesTraceable Yes Yes Yes YesCequence Security Yes Yes Yes Yes42Crunch Yes Yes Yes YesWallarm Yes Yes Yes YesAPIsec Yes Yes Yes YesInvicti (Netsparker) Yes Yes
No YesF5 (WAAP) Yes Yes Yes YesImperva Yes Yes Yes No1. Salt Security
Salt Security is a market leader known for its agentless, AI-powered API security platform. The company specializes in continuously discovering APIs and using machine learning to create a baseline of normal behavior.
By detecting deviations from this baseline, the platform can identify complex vulnerabilities, including business logic flaws, that traditional tools miss.
Salt’s platform provides deep, contextual insights that effectively act as a continuous, automated penetration test.
Why You Want to Buy It:
Salt’s behavioral analysis is its key differentiator. It’s designed to find and block sophisticated attacks that bypass standard security controls, giving security teams a proactive defense against even the most subtle threats.
Feature Yes/No Specification Automated Discovery YesDiscovers all APIs in real-time, including shadow APIs. DAST Capabilities YesProbes and tests for vulnerabilities in live traffic. Runtime Protection YesBlocks malicious activity and business logic attacks. Shift-Left Integration YesIdentifies and remediates issues in pre-production. Best For: Large enterprises that need a powerful, automated, and context-aware solution to protect a high volume of complex APIs.
Try Salt Security here → Salt Security Official Website2. Noname Security
.webp)
Noname Security offers a comprehensive API security platform that combines discovery, posture management, runtime protection, and API security testing.
Their platform provides a single-pane-of-glass view of the entire API attack surface.
A core strength is its proactive vulnerability detection, which uses AI to analyze API traffic and discover flaws before they can be exploited.
This makes it a powerful tool for continuous, automated penetration testing.
Why You Want to Buy It:
Noname’s platform is highly versatile, providing both in-depth testing and robust runtime protection from a single dashboard.
Its “active testing” capability allows security teams to run automated tests that simulate attacker reconnaissance, making it a strong choice for proactive security.
Feature Yes/No Specification Automated Discovery YesProvides a comprehensive API inventory. DAST Capabilities YesOffers active testing for pre-production environments. Runtime Protection YesUses behavioral analytics to block real-time threats. Shift-Left Integration YesIntegrates with CI/CD pipelines to find flaws early. Best For: Organizations that need a full-lifecycle API security platform that seamlessly integrates with their existing security and DevOps tools.
Try Noname Security here → Noname Security Official Website3. Traceable
.webp)
Traceable is an API security platform that uses distributed tracing to provide unparalleled visibility into API behavior and data flow.
By analyzing every API transaction, Traceable builds a deep, contextual understanding of each API, which allows it to detect and block complex threats like business logic abuse and data exfiltration.
Its platform is designed to help security teams prioritize the most critical risks and perform automated testing.
Why You Want to Buy It:
Traceable’s unique use of distributed tracing gives it a significant advantage in understanding the flow of data across an application.
This allows it to discover and protect sensitive data in transit and to identify threats that span multiple API calls.
Feature Yes/No Specification Automated Discovery YesProvides continuous discovery of all APIs. DAST Capabilities YesOffers context-based API security testing. Runtime Protection YesDetects and blocks business logic flaws in real-time. Shift-Left Integration YesIntegrates with DevOps and API gateways. Best For: Enterprises with complex, multi-service architectures that need deep visibility and context-aware security to protect their APIs.
Try Traceable here → Traceable AI Official Website4. Cequence Security
.webp)
Cequence Security offers a unified API Protection platform that combines discovery, risk assessment, and runtime protection.
Its key innovation is its “Intelligent Mode” which uses AI to create autonomous security test plans from OpenAPI specifications.
The platform’s ability to find coding errors, misconfigurations, and vulnerabilities in both pre-production and runtime environments makes it a highly effective tool for continuous penetration testing.
Why You Want to Buy It:
Cequence’s platform is a powerful blend of discovery, testing, and protection.
Its unique ability to auto-generate security test plans simplifies the security testing process, making it highly efficient for both development and security teams.
Feature Yes/No Specification Automated Discovery YesDiscovers and catalogs all APIs in the environment. DAST Capabilities YesAutonomous test creation from OpenAPI specs. Runtime Protection YesProvides real-time WAF and bot mitigation. Shift-Left Integration YesIntegrates with CI/CD pipelines for early testing. Best For: Organizations that want to unify multiple API security tools into a single platform that can protect against bots, fraud, and API-specific attacks.
Try Cequence Security here → Cequence Security Official Website5. 42Crunch
.webp)
42Crunch is a developer-centric API security platform that emphasizes a “shift-left” approach.
It is built to integrate directly into the development workflow, enabling developers to find and fix vulnerabilities in OpenAPI specifications and code as they are being written.
The platform uses a combination of static analysis (API Audit) and dynamic testing (API Scan) to validate API security from the earliest stages of the software development lifecycle.
Why You Want to Buy It:
42Crunch’s focus on the API contract is a unique and powerful way to prevent vulnerabilities.
By enforcing security best practices at the design stage, it significantly reduces the number of issues that make it to production.
Feature Yes/No Specification Automated Discovery YesScans repositories for OpenAPI definitions. DAST Capabilities YesOffers dynamic, live API scanning with rich context. Runtime Protection YesCan be used with gateways for runtime protection. Shift-Left Integration YesDeep integration with IDEs and CI/CD tools. Best For: DevOps and DevSecOps teams that want to embed security into their CI/CD pipelines and empower developers to build secure APIs from the start.
Try 42Crunch here → 42Crunch Official Website6. Wallarm
.webp)
Wallarm is an API security platform that provides full-stack protection from a single agent. It combines WAF, API security, and bot mitigation into a unified solution.
Wallarm’s platform automatically discovers APIs, analyzes their behavior, and protects them from a wide range of attacks, including the OWASP API Security Top 10.
Its active threat verification capabilities perform dynamic testing to confirm vulnerabilities and prioritize them for remediation.
Why You Want to Buy It:
Wallarm’s ability to combine WAF, bot, and API security into a single, unified platform simplifies security management.
It’s a great choice for companies that want to streamline their security stack and gain comprehensive visibility and control.
Feature Yes/No Specification Automated Discovery YesContinuously maps and discovers APIs. DAST Capabilities YesActively probes APIs to verify vulnerabilities. Runtime Protection YesProvides real-time WAF, bot, and API protection. Shift-Left Integration YesIntegrates with CI/CD for early testing. Best For: Organizations that need to consolidate multiple security tools into a single platform for web and API protection, with a strong focus on risk analysis and threat prevention.
Try Wallarm here → Wallarm Official Website7. APIsec
.webp)
APIsec offers an automated API penetration testing platform designed to run in CI/CD pipelines.
It goes beyond simple scanning by using an “API Attacker” to automatically generate thousands of attack scenarios, including those for business logic flaws and OWASP API Top 10 vulnerabilities.
Its “zero-touch” deployment model means it can run tests without requiring source code access, making it a highly efficient and scalable tool for developers and security teams alike.
Why You Want to Buy It:
APIsec’s core mission is to automate the work of a penetration tester.
It is a powerful platform for companies that want to perform frequent and thorough security testing without relying on resource-intensive manual engagements.
Feature Yes/No Specification Automated Discovery YesCatalogs and maps API endpoints. DAST Capabilities YesAutomatically generates and executes thousands of attack scenarios. Runtime Protection YesProvides runtime protection against threats. Shift-Left Integration YesDesigned for deep integration into CI/CD workflows. Best For: DevSecOps teams that need a tool for continuous, automated penetration testing of APIs as part of their CI/CD pipeline.
Try APIsec here → APIsec Official Website8. Invicti
.webp)
Invicti is a leader in Dynamic Application Security Testing (DAST) and has extended its proven technology to APIs.
Its platform automatically crawls and tests APIs for vulnerabilities, with a key differentiator being its Proof-Based Scanning
, which automatically verifies detected vulnerabilities. This feature eliminates false positives and provides actionable reports that are ready for immediate remediation by developers.
Why You Want to Buy It:
Invicti’s proof-based scanning is a powerful feature that gives security teams high confidence in their findings.
This allows them to automate vulnerability management and streamline communication with development teams, leading to faster remediation.
Feature Yes/No Specification Automated Discovery YesDiscovers and scans all APIs. DAST Capabilities YesProof-Based Scanning for accurate vulnerability detection.Runtime Protection NoPrimarily a testing platform, not for runtime protection. Shift-Left Integration YesIntegrates with CI/CD and bug-tracking tools. Best For: Security teams that need a reliable, accurate, and scalable DAST platform for both web applications and APIs, with a focus on eliminating false positives.
Try Invicti here → Invicti Official Website9. F5
.webp)
F5, a leader in application delivery and security, offers a comprehensive API security solution through its Distributed Cloud WAAP (Web Application and API Protection).
This platform combines a next-gen WAF with API discovery, testing, and protection.
F5’s solution is known for its ability to enforce a positive security model based on learned or imported API specifications, providing robust protection against both known and unknown threats.
Why You Want to Buy It:
F5’s WAAP solution provides a powerful combination of threat intelligence and a positive security model.
It’s an excellent choice for organizations that want to consolidate their application and API security under a single, trusted vendor.
Feature Yes/No Specification Automated Discovery YesAutomatically discovers all APIs from code and traffic. DAST Capabilities YesTargeted testing on discovered API endpoints. Runtime Protection YesProvides a WAF and positive security model. Shift-Left Integration YesIntegrates with code repositories for early discovery. Best For: Enterprises that need a unified platform for WAF and API security, leveraging F5’s global network and expertise in application delivery.
Try F5 API Security here → F5 Official Website10. Imperva
.webp)
Imperva, a long-standing leader in application security, offers a robust API security solution that integrates with its cloud WAF and bot management platforms.
Imperva API Security provides automatic discovery, classification, and continuous monitoring of APIs.
By analyzing traffic and leveraging a vast threat intelligence database, it can detect and block a wide range of attacks, from OWASP Top 10 vulnerabilities to API-specific business logic abuse.
Why You Want to Buy It:
Imperva’s solution provides a mature and trusted layer of protection for APIs.
Its integration with its core WAF and bot mitigation products simplifies security management and provides a unified view of application and API threats.
Feature Yes/No Specification Automated Discovery YesAutomatically discovers and catalogs all APIs. DAST Capabilities YesScans and tests for vulnerabilities. Runtime Protection YesProvides WAF and API-specific attack blocking. Shift-Left Integration NoPrimarily focused on runtime protection. Best For: Large enterprises that already use Imperva for their WAF or application security and want to extend that protection to their API portfolio.
Try Imperva API Security here → Imperva Official WebsiteConclusion
In 2025, the best API “penetration testing” companies have moved beyond one-off, manual services to provide continuous, automated security platforms.
The leaders on this list are those that effectively blend proactive testing with real-time runtime protection.
For a powerful, AI-driven solution that provides deep behavioral analysis, Salt Security and Noname Security are the top choices.
If your organization is focused on a “shift-left” approach and wants to empower developers, 42Crunch and APIsec are excellent platforms.
Meanwhile, vendors like F5 and Imperva offer a unified approach that is ideal for companies that need to secure both web applications and APIs.
Ultimately, the right solution depends on your existing security stack, development practices, and the scale of your API landscape.
The post Top 10 Best API Penetration Testing Companies In 2025 appeared first on Cyber Security News.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Amazon’s cybersecurity team has successfully disrupted a sophisticated watering hole campaign orchestrated by APT29, a notorious hacking group linked to Russia’s Foreign Intelligence Service. The August 2025 operation represents the latest chapter in an ongoing cyber warfare battle between tech giants and state-sponsored threat actors seeking to infiltrate global networks and harvest sensitive credentials. APT29’s […]
The post Amazon Takes Down Russian APT29 Infrastructure Targeting Users appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Security researcher Kevin Beaumont has revealed alarming details about CVE-2025-6543, a critical Citrix NetScaler vulnerability that was actively exploited as a zero-day attack for months before the company issued patches. What Citrix initially downplayed as a simple “denial of service” vulnerability has proven to be a sophisticated remote code execution flaw that compromised government and […]
The post Citrix 0-Day Flaw Under Active Exploitation Since May appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
QNAP Systems has released security patches to address multiple vulnerabilities affecting QVR firmware in legacy VioStor Network Video Recorder (NVR) systems. The company disclosed two significant security flaws on August 29, 2025, urging users to update their systems immediately to prevent potential security breaches. The security advisory reveals two distinct vulnerabilities that could compromise the […]
The post QNAP Flaw Allows Attackers to Bypass Authentication appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Google has issued a broad security alert to its 2.5 billion Gmail users, advising them to enhance their account security in the wake of a data breach involving one of the company’s third-party Salesforce systems.
The incident, which occurred in June 2025, has escalated concerns over sophisticated phishing campaigns targeting a massive user base.
In June, a threat group identified as UNC6040, also known by its extortion brand ShinyHunters, successfully infiltrated a corporate Salesforce instance used by Google. This system stored contact information and sales notes for small and medium-sized businesses.
According to Google’s analysis, the threat actor accessed and retrieved a limited set of data containing basic, largely public business information like company names and contact details.
Google has emphasized that the breach did not compromise consumer products like Gmail or Google Drive and that no passwords or financial data were exposed.
The attackers employed a social engineering tactic known as voice phishing, or “vishing,” to gain initial access. By impersonating IT support staff over the phone, they deceived an employee into granting them system privileges.
This allowed the hackers to exfiltrate data before their access was discovered and terminated by Google’s security teams. ShinyHunters is a well-known group linked to recent breaches at other major companies, including Adidas, Cisco, and LVMH.
While the stolen data itself is considered low-risk, security experts warn that it can be weaponized to create highly convincing phishing and vishing attacks.
Attackers are leveraging the news of the breach to craft scams that appear legitimate, tricking users into revealing their login credentials or two-factor authentication (2FA) codes. The threat group is known for escalating its tactics by leaking data or using it for extortion to pressure victims.
In response to the incident, Google promptly contained the breach, conducted an impact analysis, and began mitigation efforts.
On August 5, the company publicly detailed the event and the activities of UNC6040. By August 8, Google confirmed it had completed sending email notifications to all parties directly affected by the breach.
Given the heightened risk of follow-on attacks, Google is urging all Gmail users to remain vigilant and take proactive security measures. The company strongly recommends updating passwords, enabling two-factor authentication, and being wary of unsolicited emails or calls requesting personal information.
Find this Story Interesting! Follow us on Google News, LinkedIn, and X to Get More Instant Updates.
The post Google Warns 2.5B Gmail Users to Reset Passwords Following Salesforce Data Breach appeared first on Cyber Security News.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
WhatsApp has addressed a security vulnerability in its messaging apps for Apple iOS and macOS that it said may have been exploited in the wild in conjunction with a recently disclosed Apple flaw in targeted zero-day attacks. The vulnerability, CVE-2025-55177 (CVSS score: 8.0), relates to a case of insufficient authorization of linked device synchronization messages. Internal researchers on the
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
The U.S. Attorney’s Office for the District of New Mexico announced Thursday that federal authorities have executed a court-authorized seizure of two domain names and one affiliated blog associated with VerifTools, an online marketplace peddling counterfeit driver’s licenses, passports, and other state- and country-issued identity documents.
Operating under the banner of VerifTools since 2020, the enterprise leveraged the anonymity of cryptocurrency and underground DNS infrastructures to facilitate identity fraud on a global scale.
Key Takeaways
1. Seized VerifTools domains, blocking $6.4 M in fake-ID sales.
2. FBI used DNS sinkholing and Tor forensics.
3. US-Dutch law enforcement collaboration on identity theft and money laundering charges.FBI Takes Down VerifTools Dark Web Marketplace
The Federal Bureau of Investigation (FBI) initiated Operation Iron Seal in August 2022 after uncovering a conspiracy to exploit stolen Personally Identifiable Information (PII) for unauthorized access to cryptocurrency accounts and illicit transfers on the blockchain.
VerifTools advertised counterfeit digital and physical IDs for all 50 U.S. states and multiple foreign jurisdictions, accepting payments in Bitcoin (BTC) and Monero (XMR) via privacy-enhanced wallets.
VerifTools marketplace takendown According to court filings, the marketplace generated at least $6.4 million in illicit proceeds. Agents obtained and verified VerifTools’ backend source code through a controlled purchase of counterfeit New Mexico driver’s licenses priced at just $9 per document.
Using cryptocurrency mixing services and Tor‐based hidden services, operators obscured transaction trails and server locations.
FBI analysts deployed standard DNS sinkholing techniques to redirect VerifTools’ top-level domains (TLDs) to a government-controlled server, effectively neutralizing the sites and preserving evidence.
“If you build or sell tools that let offenders impersonate victims, you are part of the crime,” Acting U.S. Attorney Ryan Ellison stated, citing a seizure warrant.
Philip Russell, Acting Special Agent in Charge of the FBI’s Albuquerque Division, highlighted the technical complexity of dismantling such platforms:
“The removal of this marketplace is a major step in protecting the public from fraud and identity theft crime. We leveraged advanced cyber forensics packet capture (PCAP) analysis, deep packet inspection (DPI), and WHOIS record mapping to identify infrastructure nodes and operators.”
The sale or transfer of possession of false identification documents carries penalties of up to 15 years imprisonment.
The Justice Department’s Office of International Affairs facilitated mutual legal assistance requests, while prosecutors consolidated charges, including Conspiracy to Commit Aggravated Identity Theft and Money Laundering.
The FBI’s Albuquerque Field Office led the technical takedown, executing covert operations to seize control of VerifTools’ DNS records and preserving forensic images of server hard drives.
Domain registrars were served with ex parte seizure orders, and updated WHOIS entries now reflect registry status: “CONFISCATED BY THE UNITED STATES GOVERNMENT.”
Authorities continue to pursue the remaining cybercriminal network responsible for distributing these tools worldwide.
Find this Story Interesting! Follow us on Google News, LinkedIn, and X to Get More Instant Updates.
The post U.S. Government Seizes Online Marketplaces Used to Sell Fraudulent Identity Documents to Cybercriminals appeared first on Cyber Security News.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
