Author: HackWatchit

It’s not often you experience convergence or recognize it when it happens. For me, it wasn’t one big moment, but a series of encounters that didn’t seem connected until I looked back. An AgSec conference. A question from my daughter about wildfires. A Department of Energy conference presentation from an INL expert. A long phone conversation with an insurance industry veteran. Written out like that, I started to think, “These threads might actually tie together.” But in real time, we don’t typically think that way. That’s probably why history so often repeats itself. Last week, I had the opportunity to…

The pro-Israel “Predatory Sparrow” hacking group claims to have stolen over $90 million in cryptocurrency from Nobitex, Iran’s largest crypto exchange, and burned the funds in a politically motivated cyberattack. The attack occurred on June 18, 2025, with Nobitex first reporting the breach on X at 2:24 AM EST. “This morning, June 19, our technical team detected signs of unauthorized access to a portion of our reporting infrastructure and hot wallet,” reads Nobitex’s post. “Immediately upon detection, all access was suspended and our internal security teams are closely investigating the extent of the incident.” Soon after, Predatory Sparrow claimed responsibility for…

Jordan Drysdale // ADVISORY: The techniques and tools referenced within this blog post may be outdated and do not apply to current situations. However, there is still potential for this blog entry to be used as an opportunity to learn and to possibly update or integrate into modern tools and techniques. This article, like the IADGov link here has three major steps. First, acquire a Raspberry Pi and a VPS running CentOS 6.8. Second, configure the server and Raspberry Pi. Last, we discuss and learn how to cloak all communications that use the Pi as your new router. I will demonstrate…

Malicious Minecraft Mods Discovered: Check Point Research (CPR) uncovered a multistage malware campaign in which the malware itself was embedded within fake Minecraft mods, shared on GitHub to specifically target active players. Three-Stage Infection Chain: The attack involves a Java downloader, a second-stage stealer, and a final advanced stealer that harvests passwords, crypto wallets, and other sensitive data. Russian-Speaking Threat Actor Likely Involved: Russian-language comments and behavior aligned with the UTC+3 time zone suggest the malware was developed by a Russian-speaking attacker. With over 300 million copies sold and more than 200 million monthly active players, Minecraft is one of…

A GCHQ intern forgets the golden rule of spy school — don’t take the secrets home with you — and finds himself swapping Cheltenham for a cell. Meanwhile, an Australian hacker flies too close to the sun, hacks his way into a US indictment, and somehow walks free… only to get booted back Down Under. Plus: flow states, Bob Mortimer, and the joys of pretending to carry an owl around on a cushion. All this and more is discussed in the latest edition of the “Smashing Security” podcast by cybersecurity veterans Graham Cluley and Carole Theriault. Warning: This podcast may…

Cloudflare announced Cloudflare Log Explorer to help give businesses instant access to critical security and performance insights across their IT environments. Now, customers can analyze, investigate, and monitor for security attacks with log line level insights across their entire business–natively within the Cloudflare Dashboard–eliminating the need to forward logs to third party security analysis tools, saving security teams time and reducing overall cost. Security and operations teams rely on logs for critical insights, which enables them to troubleshoot issues, investigate security incidents, and optimize application and infrastructure performance, reliability, and security. Today, organizations often have to rely on external monitoring…

Qualys researchers have unearthed two local privilege escalation vulnerabilities (CVE-2025-6018, CVE-2025-6019) that can be exploited in tandem to achieve root access on most Linux distributions “with minimal effort.” About the vulnerabilities (CVE-2025-6018, CVE-2025-6019) CVE-2025-6018 affects the Pluggable Authentication Modules (PAM) configuration of openSUSE Leap 15 and SUSE Linux Enterprise 15, and allows anunprivileged local attacker – for example, an attacker who logs in via a remote SSH session – to gain the “allow_active” privileges of a physically present user. (The PAM framework controls how users authenticate and start sessions on Linux, and the vulnerability is effectively a misconfiguration that treats…

Cybersecurity researchers at Zimperium zLabs, led by Fernando Ortega and Vishnu Pratapagiri, have uncovered a dangerous new version of the GodFather Android malware using an advanced technique called on-device virtualization to take over legitimate mobile apps. It especially targets banking and cryptocurrency apps, effectively turning your own device into a spy. The Virtualization Trick Instead of just showing a fake image, the malware installs a hidden host app, which then downloads and runs a real copy of your banking or crypto app inside its own controlled space, a sandbox. When you try to open your actual app, the malware redirects…

New online threats emerge every day, putting our personal information, money and devices at risk. In its 2024 Internet Crime Report, the Federal Bureau of Investigation reports that 859,532 complaints of suspected internet crime—including ransomware, viruses and malware, data breaches, denials of service, and other forms of cyberattack—resulted in losses of over $16 billion—a 33% increase from 2023. That’s why it is essential to stay ahead of these threats. One way to combat these is by conducting virus scans using proven software tools that constantly monitor and check your devices while safeguarding your sensitive information. In this article, we’ll go…