Author: HackWatchit

App Store Security: Apple stops $2B in fraud in 2024 alone, $9B over 5 years Pierluigi Paganini May 28, 2025 Apple blocked over $9B in fraud in 5 years, including $2B in 2024, stopping scams from deceptive apps to fake payment schemes on the App Store. In the past five years alone, Apple says it has blocked over $9 billion in fraudulent transactions, more than $2 billion of that in 2024, highlighting its ongoing efforts to keep users safe. Since its 2008 launch, Apple’s App Store has grown into a trusted platform for users and a thriving space for developers.…

In this Help Net Security video, Lee Archinal, Senior Threat Hunter at Intel 471, walks through practical strategies for detecting malicious activity involving Living Off The Land binaries (LOLBins). These are legitimate tools built into operating systems, such as PowerShell, that can be hijacked by attackers to evade detection. Archinal explains how to identify suspicious usage based on user roles, abnormal behavior, and log data, and dives into techniques such as encoded command detection, process injection, and time stomping. He also highlights key resources like MITRE ATT&CK and Sysmon logs to help security teams build effective, data-driven threat hunting hypotheses.

In brief New York Mayor Eric Adams used his speech at Bitcoin 2025 to call for the repeal of the BitLicense and encouraged crypto businesses to return to the city. Adams invoked American patriotism and symbolism, comparing the Bitcoin movement to Betsy Ross sewing the first American flag. He urged attendees to engage in local politics to protect crypto innovation, saying New York must lead as a pro-Bitcoin city. New York Mayor Eric Adams continued his push to shepherd the crypto community to the Big Apple on Wednesday, calling for the creation of a Bitcoin Bond in the city and…

A threat actor wielding the DragonForce ransomware has compromised an unnamed managed service provider (MSP) and pushed the malware onto its client organizations via SimpleHelp, a legitimate remote monitoring and management (RMM) tool. “Sophos MDR has medium confidence the threat actor exploited a chain of vulnerabilities that were released in January 2025,” the company’s incident responders shared on Tuesday. The vulnerabilities in question are CVE-2024-57727, CVE-2024-57728 and CVE-2024-57726, which can be used to compromise SimpleHelp server instances and, through them, push malicious payloads to machines with the client software installed. Earlier this year, the vulnerabilities have been exploited by ransomware…

Why is a cute Star Wars fan website now redirecting to the CIA? How come Cambodia has become the world’s hotspot for scam call centres? And can a WhatsApp image really drain your bank account with a single download, or is it just a load of hacker hokum? All this and much more is discussed in the latest edition of the award-winning “Smashing Security” podcast by computer security veterans Graham Cluley and Carole Theriault, joined this week by Allan Liska. Warning: This podcast may contain nuts, adult themes, and rude language. Hosts: Graham Cluley:  @grahamcluley.com  @[email protected] Carole Theriault:  @caroletheriault Guest:…

Cloud security isn’t just about merely collecting data. You need to extract meaning from it if you want to actually improve your defenses. And while this may sound simple in practice, any seasoned cloud security practitioner will be quick to tell you otherwise. The challenge today isn’t about what you’re not seeing. Your traffic logs probably capture terabytes of data, but when analyzing them, you could easily miss or find that the most critical security insights are obscured. These are the small, subtle anomalies that could make the difference between detecting an attack and becoming another breach statistic. In other…

Beau Bullock, Brian Fehrman, & Derek Banks // Pentesting organizations as your day-to-day job quickly reveals commonalities among environments. Although each test is a bit unique, there’s a typical path to “winning” that presents itself over and over. Expensive, difficult to configure, and cumbersome to maintain tools exist to help prevent and alert on some of these attacks. Wouldn’t it be great if there was an open-source solution available that was just the opposite of that? Well, here it is! A defense and alerting toolkit from the perspective of pentesters. Beau, Brian, and Derek are all Security Analysts and Researchers for…

New research from Microsoft identifies Void Blizzard, also tracked as LAUNDRY BEAR, as a Russia-affiliated threat actor engaged in cyberespionage campaigns that support Russian strategic interests. Active since at least last April, the hacker group has been observed targeting critical sectors including government, defense, transportation, media, NGOs, and healthcare, with a primary focus on organizations in Europe, North America, NATO member states, and Ukraine. Void Blizzard frequently gains access by using stolen credentials, likely purchased from online marketplaces. Once inside, they siphon off large volumes of emails and sensitive files. Microsoft has also uncovered a global pattern of cloud service…

A recent investigation by cybersecurity researchers at Oasis Security has revealed a data overreach in how Microsoft’s OneDrive File Picker handles permissions, opening the door for hundreds of popular web applications, including ChatGPT, Slack, Trello, and ClickUp, to access far more user data than most people realize. According to the report, the problem comes from how the OneDrive File Picker requests OAuth permissions. Instead of limiting access to just the files a user selects for upload or download, the system grants connected applications broad read or write permissions across the user’s entire OneDrive. This means that when you click to…