• A sophisticated phishing campaign has recently emerged, leveraging Google Cloud’s trusted infrastructure to host malicious redirects. The campaign’s technical structure leverages Google Cloud Storage legitimate domain, googleapis.com, which is widely trusted by mail gateways and end users alike. This provides the attackers an opportunity to bypass common security layers such as SPF and DKIM validation. […]

    The post Phishing Campaign Uses Google Cloud to Host Malicious Redirects via GCS Bucket appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A threat actor known as FulcrumSec has claimed responsibility for a data breach at LexisNexis Legal & Professional, the legal information division of RELX Group. The actor alleges they have stolen 2.04 GB of structured data from the company’s Amazon Web Services (AWS) cloud infrastructure. The incident highlights significant security flaws, particularly concerning access controls […]

    The post LexisNexis Faces Data Breach After 2.04 GB of Data Allegedly Stolen appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Microsoft recently uncovered sophisticated phishing campaigns that exploit the by-design redirection mechanisms of the OAuth 2.0 protocol. Threat actors are targeting government and public-sector organizations by manipulating legitimate authentication flows in Microsoft Entra ID and Google Workspace. Rather than exploiting traditional software vulnerabilities or stealing credentials directly, this campaign abuses trusted protocol behavior to bypass […]

    The post Microsoft Alerts Customers to New Phishing Attack Exploiting OAuth in Entra ID to Bypass Detection appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Silver Dragon is a Chinese‑aligned APT group that has been targeting public sector and high‑profile organizations in Europe and Southeast Asia since at least mid‑2024, with strong operational overlap to APT41 tradecraft. The group combines classic post‑exploitation tooling like Cobalt Strike with new custom malware that abuses Google Drive as a covert command‑and‑control (C2) channel.research. […]

    The post Silver Dragon APT Group Exploits Google Drive for Covert Attacks on Europe, Asia appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A persistent bug in Windows 11 in-place upgrades is reportedly wiping critical 802.1X wired authentication configurations, leaving enterprise workstations completely offline until manual intervention occurs. System administrators across Reddit’s r/sysadmin community are raising alarms, warning that this issue has reappeared across annual Windows 11 version updates, including the 23H2-to-24H2 and recent 23H2-to-25H2 upgrade paths. How […]

    The post Windows 11 23H2 to 25H2 Upgrade Reportedly Disrupts Internet Connectivity for Users appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Malicious Packagist packages masquerading as Laravel helper utilities are delivering an obfuscated PHP remote access trojan (RAT) that grants full remote control over compromised hosts. Two of these, nhattuanbl/lara-helper and nhattuanbl/simple-queue, embed a byte‑for‑byte identical RAT payload in src/helper.php. A third package, nhattuanbl/lara-swagger, appears benign but hard‑depends on lara-helper, ensuring the malware is installed transitively whenever developers require the swagger utility. […]

    The post Malicious Laravel Packages Deploy PHP RAT, Grant Remote Access to Attackers appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Security researchers from the Google Threat Intelligence Group (GTIG) have uncovered “Coruna,” a highly sophisticated iOS exploit kit responsible for compromising thousands of iPhones. Targeting iOS versions 13.0 through 17.2.1, the framework contains five complete exploit chains leveraging a staggering 23 vulnerabilities. What began as a tool for a commercial surveillance vendor in early 2025 […]

    The post Thousands of iPhones Compromised in Massive Hack via Coruna Exploit Kit with 23 Vulnerabilities appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added a recently disclosed security flaw impacting Broadcom VMware Aria Operations to its Known Exploited Vulnerabilities (KEV) catalog, citing active exploitation in the wild. The high-severity vulnerability, CVE-2026-22719 (CVSS score: 8.1), has been described as a case of command injection that could allow an

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • President Donald Trump’s nominee to lead the Cybersecurity and Infrastructure Security Agency is leaving the Department of Homeland Security, where he has most recently been serving as an advisor in the U.S. Coast Guard, multiple people familiar with the matter told Nextgov/FCW and Defense One

    Sean Plankey is still expected to remain the nominee to lead CISA, said three of the people, who spoke on the condition of anonymity to discuss details of his departure. He is expected to leave the Coast Guard this week, one of the people said. Two other people familiar with the matter also said he’s expected to get an award ceremony in the coming days.

    Plankey held Energy Department cybersecurity roles in the first Trump administration and was nominated last year to lead the cyberdefense agency, but various congressional holds and other obstacles in the last year have slowed the confirmation process. He has been serving in his Coast Guard position for about the past year. 

    A Coast Guard spokesperson declined to comment and referred inquiries to DHS. 

    “We have no personnel matters to announce at this time,” a DHS spokesperson said. Plankey and CISA did not return a request for comment. 

    It’s not clear when or whether Plankey will be confirmed for the CISA position. On Tuesday, Senator Thom Tillis, R-N.C., threatened to slow all Senate proceedings if Homeland Security Secretary Kristi Noem doesn’t soon address inquiries from his office regarding immigration enforcement operations and disaster response funding in his state.

    “If I don’t get an answer that you’ve had a month to respond to, and the remaining ones … as of today, I’ll be informing leadership that I’m putting a hold on any en bloc nominations until I get a response, and in two weeks, if I don’t get a response, I’m going to deny quorum and markup in as many committees as I can until I get a response,” the senator said in an oversight hearing of DHS activities.

    Last week, CISA’s then-acting director Madhu Gottumukkala was moved to another role in DHS, while Nick Andersen—the previous executive assistant director for the cyber division—took his place helming the agency in an acting capacity.

    DHS’s funding has been lapsed for around two weeks without a clear indication that lawmakers are ready to reconcile on a funding deal. The war in Iran, which broke out Saturday, is expected to test U.S. cyber defenses, which have been impacted in the last year by significant workforce cuts at CISA and other key cyber units across the government.

    Mark Montgomery, a senior fellow at the Foundation for Defense of Democracies, said Tuesday evening he was aware of Plankey’s departure from DHS and added that he was an ideal choice to lead CISA.

    “[CISA] needs Senate-confirmed leadership immediately,” Montgomery said. “Whether he’s the perfect guy for every administration, I don’t know. He’s the perfect guy for this administration.”

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The Army is looking to stretch its limited research and development dollars by teaming up with private industry to develop projects that can be used by the service as well as commercial customers.

    A request for information that went live Friday kicked off what the service is calling its Strategic Capital Initiative, seeking out private sector ideas for new operating models, public-private partnerships and contracting methods that can combine Army funding with private capital investment to tackle what the service estimates is a $150 billion backlog of needed infrastructure updates. 

    “The ask to industry is: Help us solve our problems. But in a way where they can get return on their investment that is not reliant solely on the Army as a customer, because then you ultimately come back to the appropriated funds issue,” Dave Fitzgerald, the Army’s chief operating officer, told reporters Tuesday.

    Rather than figure out what it wants and then put out specific requests, the Army has a list of areas it wants to work on to help direct some of the pitches. They are:

    • Energy resilience and dominance
    • The organic industrial base
    • Strengthening logistics and supply chains
    • Real assets and facilities utilization
    • Advanced and flexible manufacturing and technology adoption
    • Critical minerals and research development

    “What we're trying to do is let them see what we think we need across our entire footprint, and they may be able to come up with a model that kind of bundles some of that, or networks some of those things together in a way that we just haven't arrived at yet,” Fitzgerald said.

    The Army has been trying to save money by using commercial parts in some of its programs, including the infantry squad vehicle, which is built off of the Chevy Colorado pick-up truck’s chassis and makes use of that existing commercial production line.

    Now the service is looking for more of those types of partnerships, Fitzgerald said, where a contractor can put up much of the initial investment and then be able to sell the final product commercially as well as to the Army. 

    “So we're looking for models that present a diversified customer base, because I think that de-risks it for the taxpayer as well as it de-risks the investment for industry,” he said. “Certainly, we are looking to de-risk the initial investment, either by becoming a long-term partner through a co-investment model, or signing up as an anchor customer for things that we know that we need, that align to one of these six areas.”

    This includes investing in securing supply chains for resources like rare-earth metals, which the Army needs in order to build things like brushless motors for unmanned aerial systems, but that have wide commercial use as well. The Army and a private investor could team up to source them. 

    “Heavy rare earths that go into small drones, but they also go into the motors that make your car window go up,” he said. “So that's, I think, how we kind of unlock the dual-use potential.”

    The idea is that the Army can save some of its investment funds with these public-private partnerships, then use its appropriations for must-do projects that don’t have a commercial purpose, like building bigger hangars for its forthcoming MV-75 tiltrotor aircraft.

    “I know for a fact that we're never going to be able to dig out of our current infrastructure backlog without a different approach,” Fitzgerald said. “I think how much remains to be seen. But I am optimistic.”

    The RFI is open until April 2. From there, the goal is to review proposals and get to work on the best ones right away. 

    “I think we want shovels in the ground by summer,” Fitzgerald said. “I don't know what that looks like, if it's a [letter of intent] signed, if it's an actual shovel going in the ground—it's going to be different.”

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶