Loading story…
MeetingTV has sued Palo Alto Networks, Koi Security, and named Koi researchers over a threat-intelligence report that allegedly falsely tied the startup and its Zoomcorder product to a China-linked espionage and malware operation identified as Dark Spectre. According to the complaint, Koi used an AI-driven analysis platform called Wings to produce unsupported or fabricated findings, including references to an alleged browser extension, and published the report without first seeking verification from MeetingTV. Palo Alto Networks said it is aware of the lawsuit and expects the matter to be resolved through the legal process.
The startup alleges the report caused immediate operational harm after security vendors and service providers reportedly classified its domains and services as malware or command-and-control infrastructure, leading to blocking and disruption. The suit also claims the report was issued while Koi was negotiating its reported $400 million acquisition by Palo Alto Networks, alleging the publication helped boost Koi’s valuation and generate sales leads. References to MeetingTV and Zoomcorder were later removed from the original Koi blog post.
See attribution, scope, and your downstream exposure.
4 events from the most recent confirmed update back to the earliest known activity.
MeetingTV filed a lawsuit against Palo Alto Networks, Koi Security, and named Koi researchers over the report, alleging false links to Chinese espionage and AI-hallucinated findings. Palo Alto Networks said it was aware of the lawsuit and expected the dispute to be resolved through legal process.
Palo Alto Networks or Koi later updated the original blog/report to remove references to MeetingTV and its Zoomcorder product. This change occurred after the disputed claims had been published.
After the report's publication, MeetingTV said multiple security vendors and service providers blocked or blacklisted its domains and services as malware or command-and-control infrastructure. The company said this disrupted its operations and caused harm.
In December, Koi Security published a threat-intelligence report that allegedly linked MeetingTV and its Zoomcorder product to the China-linked threat actor Dark Spectre and related espionage activity. MeetingTV later alleged the report relied on unverified AI-generated analysis from Koi's Wings platform and included fabricated or unsupported findings.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
theregister.com
Open sourcesdxcentral.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Malwarebytes reported a social-engineering campaign that uses a **fake Zoom meeting** lure to trick victims into installing **surveillance software** without obvious user awareness, highlighting continued abuse of trusted collaboration brands as an initial access vector (CSO Online). The activity fits a broader pattern of user-targeted delivery mechanisms—such as **SEO poisoning/malvertising** that pushes trojanized admin tools (e.g., PuTTY/WinSCP) and known loaders like **Oyster/CleanUpLoader**—to compromise software professionals and business users via seemingly legitimate download paths. Several other items in the set are not about this incident and should be treated as off-topic or low-signal for incident tracking: a policy/politics discussion about US DoD pressure on Anthropic’s *Claude* for military use, a detection-engineering newsletter that includes hiring and a webinar plug, a CSIS roll-up page listing historical “significant cyber incidents,” and a Dark Reading piece focused on **cybersecurity VC/M&A** trends tied to AI. Those sources do not provide corroborating details, IOCs, or technical specifics about the fake-Zoom surveillance campaign itself.
Jun 29, 2026
Palo Alto Networks is reportedly in advanced negotiations to acquire Israeli cybersecurity startup Koi Security for approximately $400 million. While Palo Alto Networks has not officially confirmed the deal, sources indicate that a preliminary memorandum of understanding has been signed and both parties are working to finalize the terms. Koi Security, founded by former members of the IDF's 8200 Intelligence Corps, specializes in endpoint software security and has raised $48 million in funding to date. The acquisition would mark Palo Alto Networks’ first purchase of an Israeli company since the departure of its founder Nir Zuk from the CTO role. The potential deal highlights Palo Alto Networks’ ongoing strategy to expand its portfolio with advanced cybersecurity technologies, particularly those leveraging AI. If completed, the acquisition would provide a significant exit for Koi’s founders and investors, and could signal renewed confidence in Israeli cybersecurity startups amid a recovering tech sector. The move follows a series of recent acquisitions by Palo Alto Networks, including the purchase of Protect AI and ongoing negotiations to acquire CyberArk.
Jun 29, 2026Endpoint security startup Koi has secured $48 million in seed and Series A funding to expand its platform for securing non-binary software, including AI models, code packages, and containers. The company, led by former Israeli Military Intelligence soldier Amit Assaraf, differentiates itself by providing risk mapping and governance for software types often missed by traditional endpoint security tools. Koi's technology leverages large language models to classify and assess risk across distributed enterprise environments.
Jun 29, 2026