Threat Intelligence Center

AI has shifted fraud from a detection problem to an identity problem. Synthetic voice, video, and documents defeat the cues people were trained to trust, while attackers scale personalized deception at low cost. The practical response is verification that does not depend on how a message looks or sounds, but on controls that confirm identity independently.

Cisco Talos has documented UAT-10147, a Chinese-speaking intrusion actor deploying SPECTRE, a cross-platform backdoor that uses Bring Your Own Vulnerable Driver techniques to blind endpoint detection tools.

Device code phishing persists because it abuses a legitimate authentication flow rather than a software flaw. Activity tied to EvilTokens and Kali365, including the EvilTokens phishing-as-a-service kit, shows the technique is still being refined and packaged for broader use. Here is how the approach has changed and what defenders and business leaders should watch for.

The U.S. Justice Department charged 17 Iranians tied to the Mabna Institute for stealing 31.5 terabytes of academic data valued at $3.4 billion from over 100,000 professor accounts. The operation targeted 178 universities, 53 private firms, and state agencies for a decade using credential theft as its primary access method.

MacSync Stealer relies on scripting components that defenders can turn into detection material. This analysis walks through hunting the stealer's infrastructure using behavioral pivots rather than static indicators, examining how AppleScript execution, osascript invocation, and curl network activity can be correlated to surface related hosts and follow the campaign as its indicators change.

Security researchers are tracking a malware family called TWINLOOT that uses Microsoft cloud services as its command-and-control infrastructure rather than attacker-owned servers. Routing instructions and data through platforms organizations already permit means the traffic reaches trusted endpoints, complicating detection that relies on blocking unfamiliar domains.