Author: HackWatchit

Online scams are evolving faster than ever, with cybercriminals using AI, deepfake technology, and social engineering to trick unsuspecting users. In the past year, Americans have been targeted by an average of 14 scam messages per day, and deepfake scams have surged 1,740% in North America, according to McAfee’s State of the Scamiverse report.  These scams go beyond simple phishing emails—scammers now impersonate trusted companies, friends, and even loved ones, making it critical to recognize the warning signs before falling victim. Here’s how you can spot an online scam and protect yourself:     5 tips to help you recognize an…

Tim Fowler // Do you know what could be lurking in your Windows event logs? In May of 2022, I was sent a Threat Post article about a new technique that had been discovered in the wild for maintaining persistence using Windows event logs. I immediately started skimming the article, which can be found here: https://threatpost.com/attackers-use-event-logs-to-hide-fileless-malware/179484/ and the original Kaspersky report here: https://securelist.com/a-new-secret-stash-for-fileless-malware/106393/. I found myself both surprised and frustrated at how simple it was to leverage Windows event logs for storing offensive payloads that could in turn be used to maintain persistence. At the time the article was published,…

The CYFIRMA research and advisory team uncovered the VanHelsing ransomware while monitoring various underground forums as part of their threat discovery efforts. The ransomware strain encrypts files and demands a ransom for their decryption. It also uses double extortion tactics, threatening to leak stolen data to coerce victims into paying. Targeting the prevalent Windows operating system, VanHelsing presents a major threat to industries and organizations. It has been observed attacking sectors such as government, manufacturing, and pharmaceuticals across the U.S. and France. “Once executed, VanHelsing appends the ‘[dot]vanhelsing’ extension to encrypted files, modifies the desktop wallpaper, and drops a ransom…

How can blockchain handle complex AI computations without losing its core promise of transparency? The Flare x Google Cloud Hackathon, held from March 7-9, 2025, at UC Berkeley’s California Memorial Stadium, tackled this question head-on. Over 460 developers and researchers from institutions like UC Berkeley, the University of Waterloo, and ETH Zurich participated, showcasing how blockchain and AI can integrate using verifiable off-chain computation. The Flare x Google Cloud Hackathon, held from March 7-9 in collaboration with Blockchain at Berkeley, demonstrated how verifiable AI can be seamlessly integrated with blockchain technology. Addressing Blockchain’s Computational Limitations Blockchain excels at decentralized consensus…

Founded by Jeff Moss as a gathering that delved into the hacker mindset, to its current stature as a global industry-leading cybersecurity conference, Black Hat has been a beacon for both the establishment and underground innovators. As a longstanding partner, Palo Alto Networks is proud to play a critical role in securing Black Hat Asia 2025. Our engagement at the Network Operations Center (NOC) and Security Operations Center (SOC) ensures that the conference not only operates without disruption to you, the attendees, but also remains a step ahead of emerging cyberthreats. By providing advanced network security services and cutting-edge AI-driven…

A report published today by Zimperium, a provider of a platform for securing mobile devices and applications, today finds devices running the Android operating system that have enabled root-level privileges are 3.5 times more likely to be attacked, resulting in 250 times more cybersecurity incidents.The granting of privileged access on mobile devices, known as rooting, has significantly declined since the providers of these devices have added capabilities that limit who can modify system files, install specialized applications, or remove restrictions put in place by the manufacturer or a telecommunications carrier.However, there are still enterprise IT organizations that for one reason…

As cybercriminals have moved to a mobile-first attack strategy, rooting and jailbreaking mobile devices remain a powerful attack vector. Such mobile devices bypass critical security protocols, leaving organizations vulnerable to mobile malware, data breaches, and complete system compromises. Threats reported by rooted devices vs stock devices. Source: Zimperium Recent data from Zimperium underscores the growing risks, with rooted Android mobile devices facing 3.5 times more mobile malware attacks and system compromise incidents rising by 250 times compared to non-rooted devices. The security risk of rooted devices While mobile operating systems have implemented stronger defenses, the community behind mobile rooting tools…

Buy now, pay later (BNPL) options from Klarna will soon be available for DoorDash orders. The payments company announced its new integration partnership with the delivery platform in a Thursday (March 20) press release, saying it offers DoorDash customers in the U.S. flexibility and convenience when paying for delivery of restaurant food, groceries and retail goods. According to the release, in the coming months (it didn’t specify when), DoorDash.com and DoorDash app users will have access to three payment options: “Pay in Full,” “Pay in 4” and “Pay Later.” As it implies, Pay in Full means the customer pays the…

​A newly identified custom backdoor deployed in several recent ransomware attacks has been linked to at least one RansomHub ransomware-as-a-service (RaaS) operation affiliate. Symantec researchers who named this malware Betruger describe it as a “rare example of a multi-function backdoor” that was likely engineered for use in ransomware attacks. The malware’s capabilities include a wide range of capabilities that overlap with features commonly found in malicious tools dropped before deploying ransomware payloads, including keylogging, network scanning, privilege escalation, credential dumping, screenshotting, and uploading files to a command and control (C2) server. “The functionality of Betruger indicates that it may have…