Author: HackWatchit

A flaw in Catwatchful spyware exposed logins of +62,000 users Pierluigi Paganini July 04, 2025 A flaw in Catwatchful spyware exposed logins of 62,000 users, turning the spy tool into a data leak, security researcher Eric Daigle revealed. A flaw in the Catwatchful Android spyware exposed its full user database, leaking email addresses and plaintext passwords of both customers and its admin, TechCrunch first reported. Security researcher Eric Daigle first discovered the vulnerability. Catwatchful is spyware masquerading as a child monitoring app that claims to be “invisible and cannot be detected,” all the while uploading the victim’s phone’s private contents to…

Lawrence Hoffman // Last week a friend stopped by my desk with a worried look on his face. He knelt down and showed me the screen of his laptop where […] The post Hacking Like It’s 1999 appeared first on Black Hills Information Security, Inc..

An OpenAI social media post reportedly impacted Robinhood’s stock price and set off a debate about the stock tokens Robinhood announced Monday (June 30). “These ‘OpenAI Tokens’ are not OpenAI equity,” the OpenAI Newsroom account said in a Wednesday (July 2) post on X. “We did not partner with Robinhood, were not involved in this, and do not endorse it. Any transfer of OpenAI equity requires our approval — we did not approve any transfer. Please be careful.” About three hours later, Robinhood CEO and Co-Founder Vlad Tenev said in a post on X that the company’s giveaway of OpenAI…

Additional Post Contributors: Mindy Schlueter On June 11, the Cisco Live San Diego SOC received a Cisco XDR Incident triggered by two Cisco Secure Firewall events. Both pointed to a Zeek detection: SNIFFPASS::HTTP_POST_Password_Seen. This is a clear sign that credentials were transmitted in unencrypted HTTP traffic. This detection is a red flag: Usernames and passwords are being sent in plaintext, making them easy targets for anyone monitoring the network. This kind of risky behavior is often caused by: Web apps using HTTP instead of HTTPS Users logging into misconfigured or outdated websites Legacy or IoT devices still using insecure protocols…

Cybersecurity firm Silent Push has exposed a massive phishing scam originating from China, which has created thousands of fake e-commerce websites designed to trick online shoppers. These fraudulent sites mimic well-known brands and aim to steal sensitive financial information, impacting both English and Spanish-speaking consumers worldwide. According to Silent Push’s research, shared with Hackread.com ahead of its publishing on July 2nd, 2025, the investigation began after a crucial tip from Mexican journalist Ignacio Gómez Villaseñor. Villaseñor’s May 26, 2025, X/Twitter post highlighted a threat actor specifically targeting Hot Sale 2025, a major annual sales event in Mexico, similar to Black…

Topic: Defending the Digital Perimeter: Modern Cybersecurity for SOC Watch Now Abstract: In the current threat landscape, where cyber threats are evolving rapidly, proactive network security is desperately needed to prevent and reduce the impact of cyber incidents. Blue teaming and cyber defense incorporate how organizations identify, detect, prevent, and mitigate cyber threats and vulnerabilities. While traditional approaches to security operations have been reactive to threats, the ever-changing nature of the threat landscape requires that organizations shift to more proactive methods. This webinar series is dedicated to understanding proactive cyber defense strategies and how to build an effective blue team…

a new model optimization method can be challenging, but the goal of this article is crystal clear: to showcase a pruning technique designed not to make models smaller, but to make them fairer. Because if an LLM is going to help you make decisions, about safety, hiring, or medical diagnoses, you can’t allow its reasoning to be skewed by a single misinterpreted demographic word. The experiment you’re about to see was conducted using a cutting-edge base model, Llama-3.2–1B, widely adopted as the foundation for many variants. But it wasn’t the only one: I also tested recent models like Gemma and…

Jordan Drysdale // ADVISORY: The techniques and tools referenced within this blog post may be outdated and do not apply to current situations. However, there is still potential for this blog entry to be used as an opportunity to learn and to possibly update or integrate into modern tools and techniques. Our community’s downtown district is approximately a five block by four block area. There are art stores, toy shops, candy retailers, restaurants, bars and hotels. Significant investment has been made in revitalizing and adding an area called “Main Street Square.” Almost all of these businesses offer some form of…

A few new code references in the ChatGPT web app and Android point to an Operator-like tool in GPT’s chain of thoughts. As spotted by Tibor on X, the Android beta has strings like “click,” “drag,” “type,” and even “terminal feed,” which seem to suggest that ChatGPT could soon call a remote browser or sandboxed environment (Operator?). For those unaware, OpenAI already has Operator, which uses an AI agent to navigate a remote browser session and execute tasks for you. These references suggest that ChatGPT’s thinking model might call a browser or APIs to execute tasks. There are also references to…