Hackers Spoof Gladinet Triofox: When Anti-Virus Becomes Pro-Virus!
Cyber threat actors have hacked Gladinet’s Triofox platform using CVE-2025-12480, a vulnerability as gaping as a plot hole in a soap opera. By spoofing localhost, they turned admin pages into their playground. Luckily, a patched version is here to save the day—just like a superhero in a last-minute rescue.
Hot Take:
Looks like UNC6485 took a page right out of the “Mission Impossible” handbook, pulling off a digital heist that would make Ethan Hunt proud! They exploited a vulnerability so thoroughly that it’s almost as if they had the Triofox source code framed on their wall. While most of us were just trying to figure out how to pronounce ‘CVSS,’ these cyber whizzes were creating admin accounts and running arbitrary code like it was no big deal. It’s a classic case of a vulnerability that was patched faster than you can say ‘anti-virus,’ but alas, not before our cyber villains had their moment in the spotlight.
Key Points:
- Google’s Mandiant and GTIG identified a cyber threat actor, UNC6485, exploiting Triofox.
- The vulnerability, CVE-2025-12480, was a critical access control flaw with a CVSS score of 9.8.
- Triofox versions prior to 16.7.10368.56560 were vulnerable.
- UNC6485 exploited this flaw starting August 2025, despite a June patch release.
- The attackers used the vulnerability to create admin accounts and execute code via the anti-virus feature.