Author: HackWatchit

In the dynamic world of cyber security, staying ahead of malicious actors is paramount. We are thrilled to introduce the GitHub Abuse Engine, a cutting-edge engine of ThreatCloud AI designed to detect and mitigate malicious abuse on GitHub. This engine leverages advanced algorithms and AI to identify accounts and repositories that are hosted on GitHub and used for credential theft attacks and drive-by downloads. Integrated with our ThreatCloud AI, it offers comprehensive protection across Quantum gateways, Harmony Email, Endpoint, and Harmony Mobile. GitHub Abuse GitHub, with its extensive collection of open-source projects, has become an attractive target for cyber criminals. Malicious…

In brief Binance chief security officer, Jimmy Su, told Decrypt that North Korean attackers are the single biggest threat to crypto companies. He said that the centralized exchange throws away suspicious resumes every single day, and sometimes catches the malicious actor red handed during a video call. That’s not all, North Korean attackers also poison public libraries of code and try to infect employees via a fake Zoom scam. Every day, Binance is inundated with fake resumes that it’s certain were written by would-be North Korean attackers, the crypto exchange’s chief security officer Jimmy Su told Decrypt. In his view,…

The Idaho National Laboratory (INL) has launched the Testing for AI Grid Resilience (TAIGR) initiative to identify and mitigate risks in AI (artificial intelligence)-driven grid management systems. The effort comes as the adoption of AI technologies gains traction across industries, including the critical realm of grid operations, where it offers the promise of greater efficiency and reliability but also introduces significant new challenges. While, these advancements are accompanied by significant risks, including believable AI hallucinations, plausible yet incorrect recommendations, and adversarial cyberattacks that manipulate data or model architectures. These risks could potentially result in incorrect decisions that destabilize the grid.…

As cyberattack techniques continue to evolve, the cybersecurity job market is inevitably expected to grow in leaps and bounds. The increasing frequency and sophistication of cybercrimes today require businesses of all sizes to hire skilled professionals to help identify and mitigate data breach impacts efficiently.According to the U.S. Bureau of Labor Statistics, job openings for Information Security Analysts alone are to rise 35 percent from 2021 to 2031, much faster than the average for all occupations (U.S. Bureau of Labor Statistics, 2022).The cybersecurity industry has seen consistent growth in terms of employment opportunities and still forecasts a huge demand. To…

For August 2025 Patch Tuesday, Microsoft has released security updates resolving 100+ security vulnerabilities in its various solutions, including a relative path traversal flaw in Windows Kerberos (CVE-2025-53779) that allows an authorized attacker to elevate privileges over a network as part of a BadSuccessor attack. The vulnerability, discovered by Akamai researcher Yuval Gordon, exploits the delegated Managed Service Account (dMSA) feature that was introduced in Windows Server 2025 and can be used to compromise any user in Active Directory (AD). “An attacker who successfully exploited this vulnerability could gain domain administrator privileges,” Microsoft confirmed. While the vulnerability has been known…

Publicly Disclosed Zero-Day Vulnerability in Windows Kerberos CVE-2025-53779 is a Moderate elevation of privilege vulnerability affecting Windows Kerberos and has a CVSS score of 7.2. This vulnerability allows authorized attackers with high privileges to further elevate privileges by exploiting relative path traversal in Windows Kerberos over a network connection without user interaction. While the vulnerability has been publicly disclosed with functional exploit code available, there is no evidence of active exploitation, and exploitation is assessed as less likely. This vulnerability requires elevated access to specific dMSA attributes including msds-groupMSAMembership and write access to msds-ManagedAccountPrecededByLink for successful exploitation. When exploited, attackers…

Fortinet has released patches for a critical OS command injection vulnerability (CVE-2025-25256) in FortiSIEM, after practical exploit code surfaced in the wild. About CVE-2025-25256 FortiSIEM is a security information and event management platform used by organizations to collect, correlate and analyze logs, events, and alerts from across an organization’s IT and security infrastructure, to help detect threats and investigate incidents. CVE-2025-25256 is caused by improper neutralization of special elements and may allow unauthenticated attackers to execute unauthorized code or commands on vulnerable devices via specially crafted command-line interface (CLI) requests. No user interaction is required to exploit the vulnerability. The…

Charon Ransomware targets Middle East with APT attack methods Pierluigi Paganini August 13, 2025 New Charon ransomware targets Middle East public sector and aviation, using APT-style tactics, EDR evasion, and victim-specific ransom notes. Cybersecurity researchers have discovered a new campaign that employs a previously undocumented ransomware family called Charon to target the Middle East’s public sector and aviation industry. The threat actor behind the activity, according to Trend Micro, exhibited tactics mirroring those of advanced persistent threat (APT) groups, such as DLL side-loading, process injection, and the ability to evade endpoint detection and response (EDR) software. Trend Micro researchers uncovered…

Hackers have released stolen data belonging to US insurance giant Allianz Life, exposing 2.8 million records with sensitive information on business partners and customers in ongoing Salesforce data theft attacks. Last month, Allianz Life disclosed that it suffered a data breach when the personal information for the “majority” of its 1.4 million customers was stolen from a third-party, cloud-based CRM system on July 16th. While the company did not name the provider, BleepingComputer first reported the incident was part of a wave of Salesforce-targeted thefts carried out by the ShinyHunters extortion group. Over the weekend, ShinyHunters and other threat actors claiming overlap…