Author: HackWatchit

Starting in October, Microsoft will enforce multi-factor authentication (MFA) for all Azure resource management actions to protect Azure clients from unauthorized access attempts. This change is part of the company’s Secure Future Initiative (SFI), will be applied gradually across tenants worldwide, and it requires users to enable MFA on Azure CLI, PowerShell, SDKs, and APIs to ensure that their accounts are protected against attacks. To avoid compatibility issues, users are also advised to upgrade Azure CLI to version 2.76 or later and Azure PowerShell to version 14.3 or later. Global administrators who need more time to become compliant can postpone…

Our deep appreciation to Security BSides – San Francisco and the Creators, Authors and Presenters for publishing their BSidesSF 2025 video content on YouTube. Originating from the conference’s events held at the lauded CityView / AMC Metreon – certainly a venue like no other; and via the organization’s YouTube channel. Additionally, the organization is welcoming volunteers for the BSidesSF Volunteer Force, as well as their Program Team & Operations roles. See their succinct BSidesSF ‘Work With Us’ page, in which, the appropriate information is to be had!

A TransUnion data breach exposed 4.4 million US consumers’ Social Security numbers via a Salesforce hack. The attack is linked to hacker groups UNC6395. A new data breach at credit reporting giant TransUnion has exposed the personal information of 4.4 million US consumers. The company stated the incident, which began on July 28, 2025, did not affect its core credit database or credit reports, but it did expose sensitive data, including names, birth dates, phone numbers, and Social Security numbers. The company is now offering free credit monitoring services to those impacted. According to filings with state authorities, the breach…

, Alexa, and Siri are the dominating voice assistants available for everyday use. These assistants have become ubiquitous in almost every home, carrying out tasks from home automation, note taking, recipe guidance and answering simple questions. When it comes to answering questions though, in the age of LLMs, getting a concise and context-based answer from these voice assistants can be tricky, if not non-existent. For example, if you ask Google Assistant how the market is reacting to Jerome Powell’s speech in Jackson Hole on Aug 22, it will simply reply that it does not know the answer and give a few links…

The following is a guest post and opinion from Slavik Baranov, CEO at STON.fi Dev.From Gaming Phenomenon to Financial AmbitionIn 2024, the TON blockchain became one of the most talked-about ecosystems in crypto — not because of a groundbreaking DeFi protocol, but thanks to the meteoric rise of viral tap-to-earn games on Telegram. Titles like Hamster Kombat and Notcoin drew millions virtually overnight, pushing daily active wallets to nearly 2 million by September.Telegram Active Daily Wallets (source: Tonstat).The surge proved TON can onboard users at a pace few blockchains can match. But it also exposed the fragility of hype-driven adoption:…

UNC6395 targets Salesloft in Drift OAuth token theft campaign Pierluigi Paganini August 28, 2025 Hackers breached Salesloft to steal OAuth/refresh tokens for Drift AI chat; GTIG and Mandiant link the campaign to threat actor UNC6395. Google Threat Intelligence Group and Mandiant researchers investigate a large-scale data theft campaign carried out to hack the sales automation platform Salesloft to steal OAuth and refresh tokens associated with the Drift artificial intelligence (AI) chat agent. The experts discovered that threat threat actor UNC6395 stole OAuth tokens via Salesloft Drift, exfiltrating data from Salesforce between Aug 8 and 18, 2025, to harvest credentials like AWS access…

Maritime transport, the backbone of global trade, is adapting to shifting economic, political, and technological conditions. Advances in technology have improved efficiency, bringing innovations such as remote cargo monitoring, advanced energy management systems, and automation of various onboard operations. But modernization also comes with new security challenges. Ships equipped with new technologies have become attractive targets for criminals. Any attack on these systems can compromise safety and put human lives at risk. In March 2024, the MV Dali lost power and collided with Baltimore’s Francis Scott Key Bridge, causing the bridge to collapse. Investigators traced the problem to electrical blackouts,…

Here’s a look at the most interesting products from the past month, featuring releases from: Black Kite, Brivo, Cloudflare, Descope, Doppel, Druva, Elastic, ExtraHop, LastPass, Prove, Riverbed, Rubrik, StackHawk, and Trellix. StackHawk empowers security teams to expand their API testing coverage StackHawk releaseed LLM-Driven OpenAPI Specifications, a powerful new capability that creates API documentation directly from source code. With this new capability, StackHawk analyzes source code repositories, extracts API details using homegrown LLMs, and produces accurate OpenAPI specifications automatically. Doppel Simulation combats social engineering attacks Informed by real-world threats and built with autonomous AI phishing agents, Simulation generates customized, hyper-realistic…

Threat actors have been using multiple websites promoted through Google ads to distribute a convincing PDF editing app that delivers an info-stealing malware called TamperedChef. The campaign is part of a larger operation with multiple apps that can download each other, some of them tricking users into enrolling their system into residential proxies. More than 50 domains have been identified to host deceiving apps signed with fraudulent certificates issued by at least four different companies. The campaign appears to be widespread and well-orchestrated as the operators waited for the ads to run their course before activating the malicious components in…