Author: HackWatchit

A weakness in Apple’s Safari web browser allows threat actors to leverage the fullscreen browser-in-the-middle (BitM) technique to steal account credentials from unsuspecting users. By abusing the Fullscreen API, which instructs any content on a webpage to enter the browser’s fullscreen viewing mode, hackers can exploit the shortcoming to make guardrails less visible on Chromium-based browsers and trick victims into typing sensitive data in an attacker-controlled window. SquareX researchers observed an increase use of this type of malicious activity and say that such attacks are particularly dangerous for Safari users, as Apple’s browser fails to properly alert users when a browser window enters fullscreen…

The world of investing is undergoing a quiet revolution, and at its heart lies tokenization, the practice of digitizing real-world assets on blockchain networks. Recent developments, including remarks by SEC Commissioner Hester Peirce emphasizing the urgent need for regulatory clarity, underscore the critical turning point at which tokenization stands today. Amidst uncertainty, some innovators have proactively established robust legal frameworks, positioning themselves as pioneers in the emerging ecosystem.Real estate, traditionally one of the most illiquid yet valuable asset classes, is at the forefront of this transformation. Tokenization promises to convert property ownership from a rigid and opaque market to a…

Traditional PKI creates bottlenecks that slow digital transformation due to manual processes and limited integration. As organizations adopt cloud, DevOps, and Zero Trust, scalable and automated certificate management becomes essential. Modern PKI should offer automation, policy enforcement, and integration with existing tools to reduce risk and boost agility. Upgrading PKI turns it from a barrier into a driver of secure innovation. Why crypto-agility is now a business imperative Enterprises are under increasing pressure to adapt quickly to evolving cryptographic standards. As new threats emerge—from quantum computing to sophisticated cyberattacks—organizations must be prepared to update cryptographic algorithms and certificates without disrupting…

Cybersecurity leaders and consultants identified AI-driven automation and cost optimization as top organizational priorities, according to Wipro. 30% of respondents are investing in AI automation to enhance their cybersecurity operations. AI-driven automation can help in detecting and responding to threats more quickly and accurately, thereby reducing the need for extensive manual intervention. 26% of respondents are focusing on tools rationalization. This approach involves evaluating and consolidating duplicate security tools across platforms to eliminate redundancies and improve efficiency while reducing costs. Another significant area is security and risk management process optimization, with 23% of organizations targeting this for cost savings. Streamlining…

isn’t dying, but it is evolving. Fast. AI-related jobs are projected to grow ~40% year-over-year, creating over a million new roles by 2027. In this article, I’ll take you through my transition from Data Science to Ai Engineering, as well as give you some practical advice on how to transition or to learn more about this area. My path through Data Science to AI Engineering has been interesting and full of learnings. Here is a short snapshot of my journey so far: I graduated from Physics and Astrophysics (bachelor’s and master’s) and transitioned to Data Science; Performed two internships abroad…

Kent Ickler // Referrer-Policy, What-What? Referrer-Policy is a security header that can (and should) be included on communication from your website’s server to a client. The Referrer-Policy tells the web browser how to handle referrer information that is sent to websites when a user clicks a link that leads to another page or website. The Referrer-Policy can be configured to cause the browser to not inform the destination site any URL information, some information, or a full URL path. Having a policy set is good practice. The policy can be set a number of ways, including in website code (PHP, etc).…

Two flaws in vBulletin forum software are under attack  |  SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 47  |  Security Affairs newsletter Round 526 by Pierluigi Paganini – INTERNATIONAL EDITION  |  Meta stopped covert operations from Iran, China, and Romania spreading propaganda  |  US Treasury sanctioned the firm Funnull Technology as major cyber scam facilitator  |  ConnectWise suffered a cyberattack carried out by a sophisticated nation state actor  |  Victoria’s Secret ‘s website offline following a cyberattack  |  China-linked APT41 used Google Calendar as C2 to control its TOUGHPROGRESS malware  |  New AyySSHush botnet compromised over 9,000 ASUS routers, adding a persistent…

rush to integrate large language models (LLMs) into customer service agents, internal copilots, and code generation helpers, there’s a blind spot emerging: security. While we focus on the continuous technological advancements and hype around AI, the underlying risks and vulnerabilities often go unaddressed. I see many companies handling a double standard when it comes to security. OnPrem IT set-ups are subjected to intense scrutiny, but the use of cloud AI services like Azure OpenAI studio, or Google Gemini are adopted quickly with the click of a button. I know how easy it is to just build a wrapper solution around…

Lee Kagan* // ADVISORY: The techniques and tools referenced within this blog post may be outdated and do not apply to current situations. However, there is still potential for this blog entry to be used as an opportunity to learn and to possibly update or integrate into modern tools and techniques. Deploying an offensive infrastructure for red teams and penetration tests can be repetitive and complicated. One of my roles on our team is to build-out and maintain the red team systems and control accesses to and from them. There’s an endless variety of what you may wish to deploy…