Author: HackWatchit

Have you ever come across a website that just didn’t look quite right? Perhaps the company logo looked slightly misshapen, or the font seemed off-brand. Odds are, you landed on a phony version of a legitimate corporation’s website—a tried and true tactic relied on by many cyber criminals.   Fake Login Pages Explained   A fake login page is essentially a knock-off of a real login page used to trick people into entering their login credentials, which hackers can later use to break into online accounts. These websites mirror legitimate pages by using company logos, fonts, formatting, and overall templates. Depending on…

FBI has confirmed that North Korean hackers stole $1.5 billion from cryptocurrency exchange Bybit on Friday in the largest crypto heist recorded until now. The state-sponsored hacking group (tracked as TraderTraitor, Lazarus Group, and APT38) intercepted a scheduled transfer of funds from one of Bybit’s cold wallets into a hot wallet, subsequently redirecting the cryptocurrency to a blockchain address under their control. “The Federal Bureau of Investigation (FBI) is releasing this PSA to advise the Democratic People’s Republic of Korea (North Korea) was responsible for the theft of approximately $1.5 billion USD in virtual assets from cryptocurrency exchange, Bybit, on…

Aviatrix launched Aviatrix Kubernetes Firewall, a new solution designed to tackle the pervasive security and application modernization challenges faced by enterprises operating Kubernetes at scale, particularly those in hybrid and multicloud environments. In an era where enterprises are increasingly adopting Kubernetes for its agility and scalability, significant security challenges have emerged that threaten the integrity of cloud-native environments. While existing Kubernetes security solutions – including traditional Container Network Interfaces (CNIs) and service meshes – were built for basic networking and east-west security, they were not built for enterprise-grade security enforcement. These solutions introduce operational silos, fragmented policies, and limited visibility across…

In PART ONE and PART TWO of this blog series, we discussed common misconfigurations of Active Directory certificate templates. In this post, we will walk through exploitation of the Web Enrollment feature. Active Directory Certificate Services (ADCS) supports HTTP-based enrollment methods. If enabled, HTTP-based certificate enrollment interfaces can be vulnerable to NTLM relay attacks. If an attacker can coerce a victim account to authenticate to the attacker-controlled machine, the credential material can be relayed to the Certificate Authority to request a certificate on behalf of the victim.  In some cases, a relay attack may not even require domain credentials. For…

Today’s adversaries have long been accelerating and evolving their operations. Now they are developing a business-like structure, refining and scaling their successful strategies, and exploring new technologies to cultivate a more efficient approach to cyberattacks. 2024 was the year of the enterprising adversary. The CrowdStrike Global Threat Report delivers critical insights into the evolving threat landscape and adversary behavior and tradecraft. When CrowdStrike’s Counter Adversary Operations team reflected on 2024, they saw threat actors becoming more focused and professional — much like the businesses they target. They’re quick to learn and adapt to changing defenses, all while staying focused on…

Salvador Tech, a provider of cyber-attack resilience and recovery solutions, announced Wednesday a partnership with Armis, the cyber exposure management and security company, to leverage the Armis Centrix platform for device and asset inventory and provide a rapid recovery solution to give customers a consolidated view of their entire device network, streamline operations, and provide comprehensive cyber resilience effectively.  The technology partnership empowers customers’ decision making by integrating device management into existing workflows, increasing awareness and response capabilities, and strengthening resilience across the entire organization. “We are excited to partner with Armis to provide our customers with enhanced visibility and…

GitVenom campaign targets gamers and crypto investors by posing as fake GitHub projects Pierluigi Paganini February 26, 2025 GitVenom malware campaign targets gamers and crypto investors by posing as open-source projects on GitHub. Kaspersky researchers warn of a malware campaign, dubbed GitVenom, targeting GitHub users. The threat actors behind this campaign created hundreds of fake GitHub repositories with malicious code, disguising them as automation tools, crypto bots, and hacking utilities.The attackers used AI-generated README files to make fake GitHub repositories look legitimate, including project details and compilation instructions. The threat actors also used tags and fake commits, updating a timestamp…

Almost every teenager in the United States (approximately 96%) reports using the internet daily. As students prepare to return to school after the summer break, ensuring their cybersecurity practices are up to date is essential to protect personal information from increasingly sophisticated cyber threats. By teaching proactive cybersecurity measures, parents can empower their children to maintain a secure online presence, fostering a safer digital environment for the entire family. Protecting Devices According to research conducted at Baylor University, students are estimated to spend a substantial average of eight to ten hours daily engaged with smartphones or other forms of technology.…

Swedish law enforcement and security agencies are advocating for legislation that would compel encrypted messaging services, such as Signal and WhatsApp, to implement backdoors. This measure aims to grant authorities access to users’ communications for criminal investigations. However, this proposal has met with strong resistance from both the service providers and Sweden’s own military. Meredith Whittaker, President of the Signal Foundation, has unequivocally stated that Signal would withdraw from the Swedish market rather than compromise its encryption standards. In an interview with SVT Nyheter, Whittaker emphasized that introducing a backdoor would undermine the app’s entire security architecture, stating, “If you…