Author: HackWatchit

Despite the AI hype, many tech companies still rely heavily on machine learning to power critical applications, from personalized recommendations to fraud detection.  I’ve seen firsthand how undetected drifts can result in significant costs — missed fraud detection, lost revenue, and suboptimal business outcomes, just to name a few. So, it’s crucial to have robust monitoring in place if your company has deployed or plans to deploy machine learning models into production. Undetected Model Drift can lead to significant financial losses, operational inefficiencies, and even damage to a company’s reputation. To mitigate these risks, it’s important to have effective model…

Discover essential reads for CISOs in this curated list of books covering cybersecurity leadership, risk management, zero trust, board communication, and more. Why CISOs Fail, 2nd Edition Author: Barak Engel Barak Engel expands on the ideas from his original 2017 book, offering a fresh perspective on why security leaders struggle to make a lasting impact. With a central thesis that security is more about human behavior than technology, Engel challenges traditional views of cybersecurity management. This updated edition revisits key areas where CISOs often falter—spanning business enablement, sales, legal, compliance, technology, and executive leadership—while introducing new insights into the evolving…

Researchers from Cisco Talos have discovered multiple cyber espionage campaigns that target various sectors, including government, manufacturing, telecommunications, and media, delivering Sagerunex and other hacking tools for post-compromise activities. Talos attributes these attacks to the threat actor, Lotus Blossom, which has been conducting cyber espionage operations since at least 2012 and remains active today. It confidently assesses that Lotus Blossom, also known as Spring Dragon, Billbug, or Thrip, is responsible for these campaigns.  “Based on our examination of the tactics, techniques, and procedures (TTPs) utilized in these campaigns, alongside the deployment of Sagerunex, a backdoor family used exclusively by Lotus…

​Microsoft has taken down an undisclosed number of GitHub repositories used in a massive malvertising campaign that impacted almost one million devices worldwide. The company’s threat analysts detected these attacks in early December 2024 after observing multiple devices downloading malware from GitHub repos, malware that was later used to deploy a string of various other payloads on compromised systems. After analyzing the campaign, they discovered that the attackers injected ads into videos on illegal pirated streaming websites that redirect potential victims to malicious GitHub repositories under their control. “The streaming websites embedded malvertising redirectors within movie frames to generate pay-per-view…

Discover how artificial intelligence is shaping the future of workplace management, from optimizing efficiency to enhancing employee experience. Explore the evolving role of AI in transforming workplace operations and strategies for smarter, more effective decision-making. Artificial Intelligence (AI) is transforming nearly every aspect of business operations, and workplace management is no exception. The integration of AI into workplace management brings a range of benefits, from optimizing office space to improving employee productivity and engagement. However, it also introduces several challenges that organizations must address to ensure a smooth transition and successful implementation. The benefits of AI in workplace management AI…

Joseph Kingstone // Are you assigned a physical penetration test and want to fly under the radar and meet all of your objectives like the elite hacker you are? Stick around and let’s go over a few things that might help you blend in or stay undetected.  What is a Ruse?  What is a ruse exactly? A ruse is a method used to outwit someone by deceiving them. A ruse may involve a deceptive plan, statement, or device used. The context we are using here is based on what you wear and how you appear.  OSINT  The best ruse might be…

Elastic patches critical Kibana flaw allowing code execution Pierluigi Paganini March 06, 2025 Elastic fixed a critical flaw in the Kibana data visualization dashboard software for Elasticsearch that could lead to arbitrary code execution. Elastic released security updates to address a critical vulnerability, tracked as CVE-2025-25012 (CVSS score of 9.9), impacting the Kibana data visualization dashboard software for Elasticsearch. Kibana provides visualization capabilities on top of the content indexed on an Elasticsearch cluster. Users can create bar, line and scatter plots, or pie charts and maps on top of large volumes of data. An attacker could exploit the vulnerability to gain arbitrary code execution by uploading a specially crafted file…

CISO Amplitude | USA | Hybrid – View job details As a CISO, you will develop, implement, and maintain a comprehensive security strategy aligned with Amplitude’s business goals and risk tolerance. Oversee the identification, assessment, and mitigation of security risks across the organization and its product lines. Lead and coordinate investigations into security incidents, ensuring timely resolution and thorough post-incident reviews. Cloud Cyber Security Technical Advisor (GRC) – VP MUFG | USA | On-site – View job details As a Cloud Cyber Security Technical Advisor (GRC) – VP, you will oversee the design, implementation, and maintenance of the security framework…

The National Health Service (NHS) has long been plagued by cybersecurity controversies, with one of the most notable incidents being the 2017 WannaCry ransomware attack that crippled its IT infrastructure. Fast forward to 2020, as the COVID-19 pandemic swept across the globe, the NHS rapidly transitioned its IT operations from desktops to laptops to accommodate a growing remote workforce or the much discussed work from home culture. However, this shift, intended to protect staff while ensuring operational continuity, hasn’t been without its challenges—especially as the organization grapples with a new set of concerns surrounding data privacy, security, and technology upgrades.…