Key takeaway
The 2024 advisory lists seven impersonation domains and gives specific checks for official websites, email and incident reporting.
Why Xcitium issued the advisory
In a 2024 security advisory, Xcitium identified newly registered domains impersonating the company and its services. The addresses could be used for phishing or other malicious activity. The list included xcitiumpatch.com, xcitiumsync.com, xcitiumupdate.com, xcitiumupdater.com, xcitiumupdating.com, xcitiumupgrade.com and xcitiumpatches.com.
Actions taken by the company
Xcitium said it was working with registrars to remove the fraudulent domains, strengthening monitoring, adding protective measures and coordinating with relevant authorities. The advisory identified xcitium.com and itarian.com as the company’s official service domains at that time and said services were not hosted on alternative domains.
Checks for users
The advisory told users to access accounts through official domains and enable two-factor authentication. It said Xcitium messages should come from @xcitium.com or @itarian.com and should not request login credentials. Users were advised to inspect link destinations, type the official address directly and bookmark frequently used pages.
Reporting suspicious activity
For suspicious messages or interactions, Xcitium advised users not to open links or attachments, forward the message to security@xcitium.com, contact support through the account dashboard and document the interaction. The steps provide a route for reporting incidents involving impersonation domains.