Author: HackWatchit
Sonatype discovered ‘crypto-encrypt-ts’, a malicious npm package impersonating the popular CryptoJS library to steal crypto and personal data. Over 1900 downloads reported so far. Cybersecurity researchers at Sonatype have recently uncovered a malicious software package on the npm registry, named ‘crypto-encrypt-ts‘. This package was designed to appear as an updated version of the widely used but now unsupported CryptoJS library and since its appearance on npm, it has been downloaded over 1,928 times. The genuine CryptoJS library, despite no longer being maintained, remains very popular, attracting millions of downloads each week. This popularity, along with similar interest in related projects…
35% of Gen Z said they never or rarely update passwords after a data breach affecting one of their accounts, according to Bitwarden. Only 10% reported always updating compromised passwords. 38% of Gen Z and 31% of Millennials only change a single character or simply recycle an existing password. 79% of Gen Z admit password reuse is risky, yet 59% recycle an existing password when updating accounts with companies that disclose data breaches. 55% of respondents have abandoned an account or created a new one simply to avoid going through the password reset process, while 30% of Gen Z often…
An employee at Elon Musk’s artificial intelligence company xAI leaked a private key on GitHub that for the past two months could have allowed anyone to query private xAI large language models (LLMs) which appear to have been custom made for working with internal data from Musk’s companies, including SpaceX, Tesla and Twitter/X, KrebsOnSecurity has learned. Image: Shutterstock, @sdx15. Philippe Caturegli, “chief hacking officer” at the security consultancy Seralys, was the first to publicize the leak of credentials for an x.ai application programming interface (API) exposed in the GitHub code repository of a technical staff member at xAI. Caturegli’s post on…
Pro-Russia hacktivist group NoName057(16) is targeting Dutch organizations Pierluigi Paganini May 01, 2025 Pro-Russia hacktivist group NoName057(16) is targeting Dutch organizations with large-scale DDoS attacks, the country’s National Cyber Security Center (NCSC) warns. This week, several Dutch and European organizations faced large-scale DDoS attacks launched by Pro-Russia hacktivists, including the NoName057(16) group. Threat actors target organizations across public and private sectors. Russian hacktivist group NoName057(16) claimed some of the attacks, citing pro-Russian ideological motives. Dutch government experts explained that identifying attackers and their exact intent remains difficult. “This week, several Dutch organizations are the target of large-scale DDoS attacks. The DDoS…
Every year, World Password Day rolls around like clockwork. Falling on the first Thursday of May every year, we cross our fingers hoping folks have finally ditched “password1” and “qwerty” for something a little more… well… secure. Spoiler alert: many haven’t. Let’s be honest, passwords are nobody’s favorite part of cybersecurity. They’re like flossing. Everyone agrees they’re important, but somehow they still fall to the bottom of the to-do list. Unfortunately, unlike skipping a bit of flossing, a weak password can lead to your entire digital life being compromised. And unlike your dentist, attackers don’t give second chances. Why Passwords…
Slides for this webcast can be found here: https://www.blackhillsinfosec.com/wp-content/uploads/2020/09/SLIDES_AttackTactics6ReturnofBlueTeam.pdf In this webcast we walk through the step-by-step defenses to stop the attackers in every step of the way we showed in Attack Tactics Part 5!!! Timecode links take you to YouTube: 2:53 Introduction, password spray toolkit, account lockout, honey accounts, canary tokens, and two factor authorization12:00 PCI #fixthefuture , two factor authorization, dumping global address lists, mailsniper20:30 Lateral movement, OWA, VPN, SSH32:54 Scanning and enumeration, Nmap, SSH Brute Force, “Find Open”, LLMNR, LLMNR Responder, and NrlmRelayX41:25 Gaining access and lateral movement, crackmapexec, how to detect if LLMNR gets turned back…
Any data, prompts, or requests you share helps teach the algorithm—and personalized information helps fine tune it further, says Jake Moore, global cybersecurity adviser at security outfit ESET, who created his own action figure to demonstrate the privacy risks of the trend on LinkedIn.Uncanny LikenessIn some markets, your photos are protected by regulation. In the UK and EU, data-protection regulation including the GDPR offer strong protections, including the right to access or delete your data. At the same time, use of biometric data requires explicit consent.However, photographs become biometric data only when processed through a specific technical means allowing the…
Image generated using Midjourney The past have been an absolute rollercoaster (or joyride) of rapidly evolving generative AI technologies. In the twenty-five years I’ve counted myself a software developer, I cannot recall a tectonic shift of a similar magnitude, one that is already fundamentally changing how software is being written. It would be shortsighted to believe that this revolution stops at simply generating code, however. With AI agents on the loose and the ecosystem opening up to new integrations, the foundations of how we monitor, understand, and optimize software are being upended as well. The tools that served us well…
A California man who used the alias “NullBulge” has pleaded guilty to illegally accessing Disney’s internal Slack channels and stealing over 1.1 terabytes of internal company data. According to the U.S. Department of Justice, a 25-year-old named Ryan Kramer created a malicious program in early 2024 that was promoted as an AI image generation tool on GitHub and other platforms. However, the DOJ says this program was actually malware that allowed Kramer to access the computer of those who installed it to steal data and passwords from the device. According to the Wall Street Journal, one of the people who downloaded…