Author: HackWatchit
Citizen Lab’s new report, Hidden Links, uncovers a network of VPN providers like Turbo VPN and VPN Monster that are controlled by a single company and use dangerous security practices, including hard-coded passwords and weak encryption. A new research paper titled “Hidden Links: Analyzing Secret Families of VPN Apps” has exposed how some popular Virtual Private Network (VPN) providers intentionally hide their true ownership and share security flaws. The paper was co-authored by Benjamin Mixon-Baca, Jeffrey Knockel, and Jedidiah Crandall and published by Citizen Lab. Their study involved a deep analysis of apps from the Google Play Store, looking at…
Customer support is crucial throughout information technology, and nowhere more so than cybersecurity. As customers defend their environments from sophisticated, well-funded adversaries and an ever-evolving threat landscape, cybersecurity vendors become true partners in the process, ensuring that customers continuously field solutions and services that provide the necessary outcomes. But threats come from many places these days: external adversaries, insiders (intentional and unintentional), and even software itself, in the form of supply chain attacks and vendor errors. Recently we have seen the impacts that can result when cybersecurity tools fail and interfere with customer operations. As vendors, how we respond to…
The Python Package Index (PyPI) has introduced new protections against domain resurrection attacks that enable hijacking accounts through password resets. PyPI is the official repository for open-source Python packages. It is used by software developers, product maintainers, and companies working with Python libraries, tools, and frameworks. Accounts of project maintainers publishing software on PyPI are linked to email addresses. In the case of some projects, the email address is tied to a domain name. If a domain name expires, an attacker can register it and use it to take control of a project on PyPi after setting up an email server and issuing a…
A 22-year-old Oregon man has been arrested on suspicion of operating “Rapper Bot,” a massive botnet used to power a service for launching distributed denial-of-service (DDoS) attacks against targets — including a March 2025 DDoS that knocked Twitter/X offline. The Justice Department asserts the suspect and an unidentified co-conspirator rented out the botnet to online extortionists, and tried to stay off the radar of law enforcement by ensuring that their botnet was never pointed at KrebsOnSecurity. The control panel for the Rapper Bot botnet greets users with the message “Welcome to the Ball Pit, Now with refrigerator support,” an apparent…
, you have probably wondered several times how to improve your workflows, how to speed up tasks, and how to output better results. The dawn of LLMs has helped numerous data scientists and ML engineers to not only improve their models but also to help them iterate faster, learn and focus on the tasks that really matter. In this article, I am sharing with you my favorite prompts and prompt engineering tips that help me tackle Data Science and AI tasks. Besides, soon Prompt Engineering will be a required skill in almost all DS and ML job descriptions. This guide walks you…
In brief Lloyds is hosting an auction for more than 280 Bitcoin-themed domain names, all in a single bundle. Domains available include BitcoinWallets.com and BitcoinExchanges.com, among others. The auction follows Lloyds’ $3 million sale of XBT.com. A collection of more than 280 Bitcoin-themed domain names is up for auction via a single sale at Lloyds, the famed auction house announced on Tuesday. The collection includes dozens of geographical themed Bitcoin domains, like JapanBitcoin.com and AustraliaBitcoin.com, as well as more functional domains like BitcoinExchanges.com and BitcoinWallets.com.Other notable (and/or amusing) names in the bunch include BitcoinforPizza.com, EmailBitcoin.com, BitcoinSpotETF.com, BitcoinSeedPhrase.com, TokenizedBitcoins.com, and BitcoinNetzwerk.com.“This isn’t…
The lines between SaaS and AI are vanishing. AI agents are now first-class citizens in your SaaS universe: accessing sensitive data, triggering workflows, and introducing new risks that legacy SaaS security posture management tools (SSPM) miss. Security teams are discovering that managing SaaS in isolation from AI is a recipe for dangerous blind spots. What you’ll learn in this webinar: How SaaS and AI have converged into a single, dynamic attack surface Key findings from 451 Research’s latest SaaS security research The ShinyHunters Salesforce attack and the new reality of “shared fate” in SaaS and AI security The gap between…
Noodlophile Stealer evolution Pierluigi Paganini August 19, 2025 Noodlophile malware spreads via copyright phishing, targeting firms in the U.S., Europe, Baltics & APAC with tailored spear-phishing lures. The Noodlophile malware campaign is expanding globally, using spear-phishing emails disguised as copyright notices. Threat actors tailor lures with details like Facebook Page IDs and company ownership data. Active for over a year, it now targets enterprises in the U.S., Europe, the Baltics, and APAC. In May, Morphisec researchers observed attackers exploiting AI hype to spread malware via fake AI tools promoted in viral posts and Facebook groups. Users seeking free AI video…
HBO Max is home to an impressive catalogue of hit TV shows and Hollywood movies including The White Lotus, Friends, Mickey 17, and the Harry Potter collection. Although HBO Max is available in dozens of countries worldwide, the UK isn’t one of them due to an existing agreement between Warner Bros, Discovery, and Sky. As such, if you’re in the UK and want to watch HBO Max, you’ll find it region-locked unless you use a VPN to access it. A VPN, or Virtual Private Network, lets you spoof your location so you can access geo-restricted content such as HBO Max from anywhere. Connecting to a…