• Microsoft has taken apart a destructive Windows backdoor it calls GigaWiper. What stands out is how it is built: not one tool but three older destructive programs bolted into one, offered as commands the operator can choose from. Each is a different way to break a machine: wipe the whole disk, overwrite the Windows drive, or run fake “ransomware” that scrambles files with a key it never saves

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Darktrace says a LiteLLM AI gateway linked to Amazon Bedrock was compromised for cryptomining after signs of exposed SSH activity.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • GitHub has officially announced the release of npm version 12 with install scripts disabled by default, along with deprecating granular access tokens (GATs) designed to bypass two-factor authentication (2FA). The Microsoft-owned subsidiary noted that the following npm install behaviors that used to run automatically before have been made opt-in – allowScripts defaults to off, meaning

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A pair of federal employee unions last week sued Defense Secretary Pete Hegseth over his April directive that the department terminate most of its collective bargaining agreements, alleging he violated the Administrative Procedure Act and exceeded his statutory authority when he sought to implement President Trump’s anti-union executive order.

    In March 2025, Trump signed an executive order citing a seldom-used provision of the 1978 Civil Service Reform Act to strip roughly two-thirds of the federal workforce of their collective bargaining rights on national-security grounds. Unions and the Justice Department have engaged in pitched legal battle ever since, across more than half a dozen court cases.

    Agencies have since moved to implement the order, along with an August 2025 sequel banning unions at more agencies, in fits and starts, in part due to the litigation. While many agencies took informal steps to comply, such as cancelling the automatic collection of union dues, they largely refrained from terminating their contracts with labor groups until last August.

    At that point, the Office of Personnel Management changed its guidance regarding the executive orders and suggested agencies could “choose” to terminate their CBAs. OPM again changed course in February, recommending that agencies “should” take that that step.

    A new lawsuit filed by the American Federation for Government Employees and the National Federation of Federal Employees in the U.S. District Court for Maryland accuses Hegseth of violating the Administrative Procedure Act for ordering the department to cancel its union contracts with just 24 hours’ notice and no plan to carry it out in an orderly fashion. The result, the unions say, was “chaos.”

    “DOD did not have any uniform process for implementing the termination of CBAs, and in many cases there were virtually no notification or communication at all about what actions were being taken, if any,” the lawsuit states. “Some local union leaders were informed by phone that their unions’ CBAs were being terminated; others were informed by email, or by letter; others received no communications at all—their agency counterparts just went ‘radio silent,’ or started refusing to answer routine questions. Beyond these ‘official’ notifications (or lack thereof), Secretary Hegseth’s memorandum begat a firestorm of confusion and misinformation at facilities nationwide—about who still did or did not have collective bargaining agreements, and why, and since when.”

    The unions argued that the slapdash rollout also resulted in employees losing their union rights despite being ostensibly exempt from Trump’s executive order. While the order states that the “local employing offices” of police officers, security guards and firefighters will continue to be covered by federal sector labor law, in practice the Pentagon has continued to recognize the union rights only of first responders, not the dispatchers, IT workers and other staff they work alongside.

    “Yet DOD failed to prepare any list of subdivisions that are not covered by the EO because they employ police officers, firefighters or security guards before issuance of the Hegseth memorandum, nor did the Hegseth memorandum provide for such a list to be created before implementation of the memorandum,” the unions wrote. “[Thus], across DOD, subdivisions have declared that employees who work alongside police officers, firefighters and security guards—workers in the same ‘local employing office’ within the meaning of the EO—no longer have the protections of their CBAs or any rights under the [federal labor statute], in direct contradiction of the EO.”

    AFGE and NFFE’s lawsuit mirrors a similar legal challenge filed last year by the International Federation of Professional and Technical Employees, which successfully resulted in a court order blocking the Defense Department from terminating their contracts. It sets aside the broader question of whether Trump’s executive orders are lawful and focuses on how the Defense Department sought to implement them.

    The unions argued that since Hegseth neither moved to terminate CBAs either last August when OPM first said agencies could elect to do so, nor in February when OPM said they “should” take that step, he was required by the Administrative Procedure Act to explain the change in policy.

    “For nearly a year after the issuance of EO 14251, DOD continued its longstanding policy of honoring the CBAs into which it has entered,” they wrote. “The DOD’s April 9, 2026 decision to terminate those CBAs within 24 hours irrationally and improperly failed to explain why the DOD would no longer honor existing CBAs, or why termination was necessary within 24 hours notwithstanding the agency’s prior honoring of CBAs and the predictable chaos that would result from DOD’s abrupt reversal.”

    They also asserted that by stripping employees who work alongside departmental policy officers, firefighters and security guards of their collective bargaining rights, Hegseth exceeded the authority granted him by the executive order, since the edict exempted those employees’ entire offices from its coverage.

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Most security mess starts as admin work. A link gets clicked. A tool gets trusted. A bucket name gets reused. A setting stays loose because nobody wants to touch it. This week is full of that kind of damage. Not loud. Not clever. Just small gaps doing big jobs. The worst part is how normal it all looks until the bill arrives. The full ThreatsDay list is below. Global

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A targeted GodDamn ransomware incident shows the payload is not entirely new but the latest rebrand of a long-running family. Analysis reveals strong code overlap with Beast (the 2024 rebrand of Monster), and the operational playbook mirrors earlier Hyadina campaigns. Stealthy foothold, credential harvesting using NirSoft utilities, kernel-level defense subversion, remote-access tooling, and PsExec-driven lateral […]

    The post GodDamn Ransomware Attack Uses PsExec Lateral Movement and NirSoft Toolkit for Credential Theft appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • This week in cybersecurity from the editors at Cybercrime Magazine

    Sausalito, Calif. – Jul. 9, 2026

    – Listen to the podcast

    Strangers were watching your children sleep. For months, anyone with basic technical knowledge could access 1.1 million baby monitors and security cameras worldwide—no hacking required, just clicking a link.

    Yahoo Tech! reports French cybersecurity researcher Sammy Azdoufal discovered the vulnerability affecting devices you likely trusted to protect your family, cameras sold under familiar Amazon brands like Arenti, Boifun, and ieGeek.

    A single extracted key unlocked feeds across 118 countries, revealing the dark side of cheap cloud-connected devices.

    “I can retrieve the picture without any passwords, no cracking, no hacking. I just click on the URL, and this image is showing,” Azdoufal explained to The Verge. The researcher accessed intimate scenes—children’s bedrooms with Hello Kitty decorations, toddlers looking directly into cameras, family moments that should never have been public.

    This all happened because Meari Technology, the Chinese manufacturer behind these white-label cameras, built their system like a house with every door unlocked. Azdoufal recently joined host Heather Engel on the Cybercrime Magazine Podcast for a deep dive into his research, regulations in the consumer IoT industry, and more.

    Listen to the Podcast episode



    Cybercrime Magazine is Page ONE for Cybersecurity. Go to any of our sections to read the latest:

    • SCAM. The latest schemes, frauds, and social engineering attacks being launched on consumers globally.
    • NEWS. Breaking coverage on cyberattacks and data breaches, and the most recent privacy and security stories.
    • HACK. Another organization gets hacked every day. We tell you who, what, where, when, and why.
    • VC. Cybersecurity venture capital deal flow with the latest investment activity from various sources around the world.
    • M&A. Cybersecurity mergers and acquisitions including big tech, pure cyber, product vendors and professional services.
    • BLOG. What’s happening at Cybercrime Magazine. Plus the stories that don’t make headlines (but maybe they should).
    • PRESS. Cybersecurity industry news and press releases in real time from the editors at Business Wire.
    • PODCAST. New episodes daily on the Cybercrime Magazine Podcast feature victims, law enforcement, vendors, and cybersecurity experts.
    • RADIO. Tune into WCYB Digital Radio at Cybercrime.Radio, the first and only round-the-clock internet radio station devoted to cybersecurity.

    Contact us to send story tips, feedback and suggestions, and for sponsorship opportunities and custom media productions.

    The post When “Secure” Cameras Become Peep Shows: 1M+ Baby Monitors Left Families Exposed appeared first on Cybercrime Magazine.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • AI has changed how fast attacks move. Work that once took an attacker days now takes minutes. Using models like Mythos, attackers write tailored bait, pick targets, test what lands, and jump to the next host before your team clears the first alert. That is the gap, and it is not your fault. The tools and runbooks most teams run on were built for attackers who work at human speed. AI-driven

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A large-scale exploitation campaign is actively weaponising known vulnerabilities across multiple content management systems, with WordPress plugins forming the primary attack surface. Cyber actors are scanning the internet for vulnerable sites and chaining unauthenticated file upload, remote code execution (RCE), server-side request forgery (SSRF) and deserialization vulnerabilities to deploy webshells that grant persistent remote access. […]

    The post Attackers Exploit WordPress Plugin Vulnerabilities for Remote Code Execution and Webshell Access appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A critical vulnerability has been discovered in HP Linux Imaging and Printing Software (HPLIP), which exposes Linux systems to potential privilege escalation and remote code execution attacks. This vulnerability, tracked as CVE-2026-14544, has a CVSS v3 score of 9.8, indicating maximum severity due to its potential for network exploitation, low attack complexity, and lack of […]

    The post HP Linux Imaging and Printing Software Flaw Enables Privilege Escalation Attacks appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶