Author: HackWatchit

Lawrence Hoffman // ADVISORY: The techniques and tools referenced within this blog post may be outdated and do not apply to current situations. However, there is still potential for this blog entry to be used as an opportunity to learn and to possibly update or integrate into modern tools and techniques. The list this week is a little shorter, I didn’t include a tool or POC link as I usually do. No particular reason, just didn’t run across one I felt like I could talk about directly. Among the articles this week we see legal actions, leaked data, an openssh…

Terry Gerton Well, I know you’ve got a lot of experience in this, but I just want to start with some background. The Cybersecurity Information Sharing Act (CISA 15) created an information sharing and legal protections framework, but it didn’t mandate participation, did it? John Miller No, no, it did not mandate participation back in 2015 and the several years prior that the bill was being negotiated by Congress as well as private sector and other stakeholders. The thinking was that it was really important to have voluntary information sharing. So I think the bill with structured really so as…

CoinMarketCap, the popular cryptocurrency price tracking site, suffered a website supply chain attack that exposed site visitors to a wallet drainer campaign to steal visitors’ crypto. On Friday evening, January 20, CoinMarketCap visitors began seeing Web3 popups asking them to connect their wallets to the site. However, when visitors connected their wallets, a malicious script drained cryptocurrency from them. The company later confirmed threat actors utilized a vulnerability in the site’s homepage “doodle” image to inject malicious JavaScript into the site. “On June 20, 2025, our security team identified a vulnerability related to a doodle image displayed on our homepage. This doodle image…

Want to know how to change privacy settings on X (formerly Twitter)? Many people enjoy using X for personal or professional reasons, but they don’t always know how to make their Twitter secure. Following Elon Musk’s changes, Twitter’s privacy and security settings became more confusing, especially for users switching between iPhone, Android, and desktop. That’s where our Twitter privacy settings guide comes in! Whether you’re trying to protect your posts on X, block trolls, or view sensitive content that’s hidden by default, we’ll walk you through everything step by step. From X account security to two-factor authentication on X, we’ll…

Qilin ransomware gang now offers a “Call Lawyer” feature to pressure victims Pierluigi Paganini June 22, 2025 Qilin ransomware gang now offers a “Call Lawyer” feature to help affiliates pressure victims into paying, per Cybereason. The Qilin ransomware group is now offering legal support to its affiliates through a “Call Lawyer” feature to pressure victims into paying. This move, reported by cybersecurity firm Cybereason, shows Qilin stepping up its operations and trying to take over space left by rival cybercrime groups. The Qilin ransomware group has been active since at least August 2022 but gained attention in June 2024 for attacking Synnovis, a…

A coordinated crypto theft operation targeting CoinMarketCap users has been exposed after leaked images surfaced from a Telegram channel known as TheCommsLeaks. The attack used a convincing wallet connection prompt embedded in CoinMarketCap’s own interface, tricking users into handing over access to their wallets. The result? more than $43,000 worth of crypto funds drained in hours. According to Tammy H, a Senior Threat Intelligence Researcher and Certified Dark Web Investigator at Flare.io, a Canada-based cybercrime intelligence firm, the attack was carried out using Inferno Drainer, a known wallet-draining toolkit that’s been linked to previous campaigns. A Pop-Up with a Price…

It’s tough to keep tabs on the ever-changing crypto gaming space, thanks to the constant flow of news: everything from big game launches and fun degen experiments to token price swings and occasional project collapses. It’s a lot to follow.Luckily, we’re plugged in at Decrypt’s GG. We cover the biggest happenings throughout the week, and then this weekly roundup provides a quick way to catch up, as well as find a bunch of other little bits of news from throughout the week.Top storiesSelf-destruct crypto PC: B3, a layer-3 gaming protocol built on Ethereum’s Base network by former Coinbase employees, has…

Sierra Ward // The other day I went to get some food with a co-worker.  When the counter boy asked for my name I told him.  The co-worker said she could tell I wasn’t a pentester because after realizing how vulnerable the world is, they have a difficult time being open with their personal information on ANY level. In an industry that deals on a daily basis with the threat of evil it’s easy to become jaded and cynical about the world.  Perhaps that is part of the draw that John has. He bucks the norm and is more open than…

Fresh off a series of recent attacks targeting major retail companies in the United States and the UK, the notorious Scattered Spider cybercrime group is now targeting insurance companies and earlier this month apparently bagged a high-profile victim in Aflac.The intrusion in Aflac, which was detected June 12 when the insurance company’s security team identified suspicious activity on its network in the United States, was stopped within hours and there was no ransomware found in its systems, the company said in a public statement and a filing with the U.S. Securities and Exchange Commission (SEC) eight days later.“This attack, like…