Author: HackWatchit

A new series of Android-based malware, BADBOX 2.0, is turning everyday smart devices into a botnet, often before they even reach users’ homes. The FBI has now flagged this malware as a global threat, and recent analysis from Point Wild’s Lat61 Threat Intelligence Team reveals over 1 million devices across 222 countries and territories have already been compromised. Led by Dr. Zulfikar Ramzan, the Lat61 team traced the infection chain to its core: a native backdoor library named libanl.so, embedded deep within device firmware. The malware is designed to survive factory resets, carry out stealthy operations, and generate profit through…

Check Point Research identifies how the new social engineering technique, FileFix, is being actively tested by threat actors in the wild. Attackers have long exploited human trust as a primary attack surface, and they’re doing it again with a new technique called FileFix. FileFix is a recently uncovered social engineering attack that builds on the widely abused ClickFix tactic. Unlike ClickFix, which tricks users into running malicious commands via the Windows Run dialog, FileFix takes a subtler approach: it opens a legitimate Windows File Explorer window from a webpage and silently loads a disguised PowerShell command into the user’s clipboard.…

Operation Eastwood disrupted operations of pro-Russian hacker group NoName057(16) Pierluigi Paganini July 16, 2025 International law enforcement operation disrupted the activities of the pro-Russia hacking group NoName057(16). European and U.S. authorities disrupted the activities of the pro-Russian hacktivist group NoName057(16) in Operation Eastwood. “Between 14 and 17 July, a joint international operation, known as Eastwood and coordinated by Europol and Eurojust, targeted the cybercrime network NoName057(16). Law enforcement and judicial authorities from Czechia, France, Finland, Germany, Italy, Lithuania, Poland, Spain, Sweden, Switzerland, the Netherlands and the United States took simultaneous actions against offenders and infrastructure belonging to the pro-Russian cybercrime…

To quash speculation of a cyberattack or BGP hijack incident causing the recent 1.1.1.1 Resolver service outage, Cloudflare explains in a post mortem that the incident was caused by an internal misconfiguration. The outage occurred on July 14 and impacted most users of the service all over the world, rendering internet services unavailable in many cases. “The root cause was an internal configuration error and not the result of an attack or a BGP hijack,” Cloudflare says in the announcement. This statement comes after people reported on social media that the outage was caused by a BGP hijack. Global outage…

In our Author Spotlight series, we chat with members of our community about their career paths in data science and AI, their writing, and their sources of inspiration. Today, we’re thrilled to share our conversation with Mauro Di Pietro. Mauro is a data scientist and content creator with a decade of experience in the banking industry across Europe and Asia. He studied quantitative finance but taught himself programming after graduation, which sparked his passion for writing tutorials that break down complex topics into simple and engaging explanations. You’ve written an impressive series on building AI agents from scratch using Python…

The National Cybersecurity Center of Excellence (NCCoE) in the U.S. National Institute of Standards and Technology (NIST) on Tuesday released a draft of the first publication in its new OT Security Series. The document provides key guidance for manufacturers and OT (operational technology) operators on managing the use of USB (universal serial bus) storage devices, essentially tools that, while useful for transferring data in isolated environments, pose serious cybersecurity risks if not properly controlled. The two-page draft is part of NIST’s broader effort to deliver concise, actionable resources tailored to the specific challenges of securing OT systems. Public comments on…

Both analyses found that the two clips, labeled “2025-05-22 16-35-21.mp4” and “2025-05-22 21-12-48.mp4,” were stitched together. The first clip is 4 hours, 19 minutes, and 16 seconds long, but only the first 4 hours, 16 minutes, and 23.368 seconds appears in the published version, meaning nearly 2 minutes and 53 seconds were cut from the end. According to the metadata, the cut occurs just at 11:58:58 pm. The cut is milliseconds before the one-minute recording gap that Bondi said was caused by a quirk of the surveillance system. The second clip, “2025-05-22 21-12-48.mp4,” picks up immediately afterward, continuing the footage…

Nmap, also known as Network Mapper, is a commonly used network scanning tool. As penetration testers, Nmap is a tool we use daily that is indispensable for verifying configurations and identifying potential vulnerabilities. With so many options and capabilities, it’s no surprise how many use cases there are for Nmap. Everything from general TCP and UDP port scanning, verifying running versions of software for a service, brute forcing commonly used credentials, and validating vulnerabilities found with other tools.   In this blog, we will cover basic vulnerability scanning with Nmap using built-in Nmap NSE scripts. This blog assumes you have some…

For the fifth time this year, Google has patched a Chrome zero-day vulnerability (CVE-2025-6558) exploited by attackers in the wild. About CVE-2025-6558 CVE-2025-6558 is a high-severity vulnerability that stems from incorrect validation of untrusted input in ANGLE – the Almost Native Graphics Layer Engine used by the browser – and GPU, Chrome’s Graphics Processing Unit that accelerates rendering tasks. Reported on June 23 by Google Threat Analysis Group researchers Clément Lecigne and Vlad Stolyarov, CVE-2025-6558 is apparently being actively exploited by attackers to escape Chrome’s sandbox — the security feature that isolates each browser tab and plugin in a separate…