Author: HackWatchit

In a new threat discovered by cybersecurity firm Sublime Security, which was observed on the Microsoft 365 email platform, hackers are using a clever malware campaign to trick users with fake OneDrive emails. In the research, shared with Hackread.com, the firm found that this sophisticated attack installs two separate remote-control programs on a victim’s computer, making it very difficult to stop. Sublime Security’s AI-powered system detected the attack by spotting several subtle clues. These included the email claiming to share a file but being sent to an undisclosed recipient list, the misleading file extension (saying .docx but being a .msi),…

SpecterOps has released BloodHound 8.0, the latest iteration of its open-source attack path management platform, featuring major enhancements and expanded capabilities. BloodHound OpenGraph The release introduces BloodHound OpenGraph, a major advancement in identity attack path management that uncovers attack paths across the entire technology stack. It enables users to ingest data from diverse systems such as GitHub, Snowflake, and Microsoft SQL Server and build tailored threat models that reflect their environments. “To date, most of the innovation in attack path management has focused on Microsoft Active Directory and Entra ID, given the widespread adoption of those identity platforms,” said Jared…

CVE-2025-54136 –  MCPoison Key Insights Critical RCE Flaw in Popular AI-powered IDECheck Point Research uncovered a persistent remote code execution vulnerability in Cursor, a fast-growing AI-powered coding platform trusted by developers worldwide. MCP VulnerabilityCursor allows attackers to gain long-term, silent access to developer environments by altering previously approved Model Context Protocol (MCPs), with no additional user prompt. Real-World Attack ScenarioIn shared repositories, a benign-looking MCP configuration can be weaponized after approval, triggering malicious code execution every time a project is opened in Cursor. Broader AI Supply Chain RiskThe flaw exposes a critical weakness in the trust model behind AI-assisted development…

Cybersecurity experts say Sean Cairncross faces a litany of key tasks as the White House’s new national cyber director, including championing the reauthorization of a key information sharing law and grappling with China-linked hacks into U.S. critical infrastructure networks. The Senate voted 59-35 to confirm Cairncross’s nomination on Saturday. He’s now the third Senate-confirmed national cyber director since Congress established the position in 2021. “As the cyber strategic environment continues to evolve, we must ensure our policy efforts and capabilities deliver results for our national security and the American people,” Cairncross said in a statement provided by the White House…

Today, Hugging Face adds a new model on average every 7 seconds, and the platform now hosts nearly 1.9 million models available to developers worldwide. This unprecedented scale — driven by contributors globally, spanning both trusted institutions and independent creators — fuels a wave of innovation while also reinforcing the need to secure the AI supply chain. As highlighted in our previous analysis, AI supply chain risks now permeate every stage of the AI lifecycle — from vulnerable software dependencies and malicious or backdoored model files to poisoned or non-compliant datasets. Given this complexity, it is increasingly challenging for any…

Visibility is the foundation of effective cybersecurity. Without it, detecting and responding to malicious activity becomes a guessing game, leaving attackers free to exploit weaknesses unnoticed. Security tools such as firewalls and endpoint agents play a critical role, offering essential insights into network and host-level activity. However, these tools are often focused on specific areas and are limited in the broader context they can provide. Security Information and Event Management (SIEM) solutions address these limitations by consolidating and analysing data from across an organisation’s entire infrastructure. This provides a more complete view of potential threats and attack patterns, connecting dots…

When a major breach makes headlines, the impact ripples far beyond the individuals whose data has been compromised. It shakes consumer trust, triggers urgent internal questions from staff, and lands squarely on the shoulders of the CISO.  And although cybersecurity leaders have long been focused on preventing and responding to attacks, the missing piece in many programs isn’t technological. It’s behavioral. We have reached a pivotal moment in the data security conversation. Despite record-breaking investments in cybersecurity tools, the most vulnerable part of the equation remains underprioritized – the human element. So, what does that mean for the modern CISO?…

SonicWall has warned customers to disable SSLVPN services due to ransomware gangs potentially exploiting an unknown security vulnerability in SonicWall Gen 7 firewalls to breach networks over the past few weeks. The warning comes after Arctic Wolf Labs reported on Friday that it had observed multiple Akira ransomware attacks, likely using a SonicWall zero-day vulnerability, since July 15th. “The initial access methods have not yet been confirmed in this campaign,” the Arctic Wolf Labs researchers said. “While the existence of a zero-day vulnerability is highly plausible, credential access through brute force, dictionary attacks, and credential stuffing have not yet been definitively ruled out in…

SonicWall investigates possible zero-day amid Akira ransomware surge Pierluigi Paganini August 05, 2025 SonicWall probes possible new zero-day after spike in Akira ransomware attacks on Gen 7 firewalls with SSLVPN enabled. SonicWall is investigating a potential new zero-day after a surge in Akira ransomware attacks targeting Gen 7 firewalls with SSLVPN enabled. The company is working to determine if the incidents stem from an existing flaw or a newly discovered vulnerability. “Over the past 72 hours, there has been a notable increase in both internally and externally reported cyber incidents involving Gen 7 SonicWall firewalls where SSLVPN is enabled.” reads the statement published…