The WhatsApp impostor.

**Executive Summary:** This CyberWire Daily digest summarizes a series of active cybersecurity incidents and developments: a fake WhatsApp app spreading government-linked spyware, CrystalRAT malware with RAT/stealer features, the EvilTokens service enabling Microsoft account phishing, a ransomware attack against a North Dakota water plant, a 250,000-record hospital data breach, critical Cisco vulnerability patches, and renewed China-linked espionage activity targeting Europe, among other items. The briefing aggregates high-impact events across malware, phishing, ransomware, data breaches, and vulnerability disclosures for situational awareness.