• A sophisticated, long-running cyberespionage campaign attributed to UNC6508, a People’s Republic of China (PRC)-nexus threat actor, that systematically targets North American academic, medical, and military research institutions. The campaign, active since at least September 2023, remained undetected for over a year while the threat actor silently harvested credentials, exfiltrated sensitive communications, and maintained persistent access across victim […]

    The post PRC-Nexus Hackers Abuse REDCap Servers to Monitor US Medical Research Organizations appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A single developer-known online as RockyBelling has assembled a highly modular PhaaS/MaaS ecosystem that affiliates worldwide use to launch highly targeted IRS and SSA-themed phishing campaigns that predominantly hit U.S. victims. SOCRadar research spanning April 2025–April 2026 ties almost 200 affiliates to a commercial toolkit that combines sophisticated cloaking, flexible payload options, real-time victim telemetry […]

    The post Hackers Use The Quarry PhaaS Ecosystem to Target U.S. Victims With IRS Phishing appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Microsoft has triggered widespread browser security warnings after allowing the TLS certificate for a critical Microsoft 365 connectivity testing domain to expire, raising concerns over certificate lifecycle management practices. The affected domain, connectivity.office.com, widely used by system administrators and enterprise IT teams to validate network access to Microsoft 365 services, began returning NET::ERR_CERT_DATE_INVALID errors in […]

    The post Microsoft Website Displays Security Warning After Certificate Expiry appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Microsoft 365 Copilot has been found vulnerable to a critical one-click data exfiltration attack chain dubbed “SearchLeak,” exposing sensitive enterprise data through a combination of AI-specific and traditional web vulnerabilities. Discovered by Varonis Threat Labs, the flaw, tracked as CVE-2026-42824 and rated critical, demonstrates how modern AI integrations can unintentionally expand attack surfaces by linking […]

    The post Microsoft 365 Copilot Vulnerability Exposes Sensitive Data Through One-Click Attack appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The Trump administration’s use of military lawyers for civilian roles would be probed by Congress’ watchdog agency under language added to the 2027 defense policy bill.

    The provision was added to the Senate Armed Service Committee’s version of the 2027 National Defense Authorization Act by Sen. Elizabeth Warren, D-Mass. It orders the Government Accountability Office to review the Pentagon’s use of judge advocate generals to support the Justice Department’s operations, “including their use as immigration judges and special prosecutors, and its impact on morale and readiness,” Warren’s office said. 

    “Pete Hegseth is treating our independent military lawyers like pawns in Trump’s cruel immigration agenda and it’s hurting our military readiness and morale,” Warren said in an emailed statement to Defense One. “This independent investigation is an important step to support our service members and hold this administration accountable.” 

    Warren’s office said the amendment ordering up the probe had "bipartisan support” and would not be cut during debate in the Senate or in conference with the House. Her statement did not say how the SASC voted on her provision, and committee spokespeople did not return a request for comment. 

    Earlier this month, Republicans axed a House effort to amend U.S. law to limit JAGs to military-related matters. 

    The Congressional interest in the morale of judge advocate generals follows Defense Secretary Pete Hegseth’s high-level firings, harsh criticisms, and wide-ranging reforms targeted at the military’s lawyers. During his 18 months in office, Hegseth has fired the military’s top uniformed lawyers, reduced the civilian legal staff, and overseen the assignment of JAGs to civilian work, including as immigration judges and as special U.S. attorneys in Democratic-run cities during National Guard deployments. 

    Warren’s provision drew praise from Steve Lepper, a former Air Force JAG and a member of a group of former JAGs who have criticized the administration’s use of military lawyers. 

    “I agree with Senator Warren. I agree with the rationale, and, quite frankly, anything that gets into the NDAA that requires the Pentagon to justify his use of judge advocates in those roles, I think, is a good thing,” Lepper said. 

    Last year, about 600 JAGs were assigned to work for the Justice Department as immigration judges. Earlier this year, Defense One reported that dozens of uniformed lawyers were sent to cities to work as special U.S. attorneys as part of National Guard surges in Minneapolis, Minnesota; Memphis, Tennessee; and Washington, D.C.

    Military legal experts have told Defense One that those JAGs often lack the necessary experience to work those cases. In December, one Army lawyer working as a special U.S. attorney in Minnesota was reportedly held in contempt of court when an Immigrations and Custom Enforcement detainee was released from custody without his identification paperwork.

    Lepper said he believes the move to push JAGs into those civilian roles has harmed the morale of the military’s lawyers. 

    “The rank-and-file judge advocates don't think this is a good idea,” he said. “Americans are on the receiving end of the cases that are being prosecuted by judge advocates and immigrants are being subjected to, I believe, the lack of due process by having military officers serving as immigration judges sitting in judgment on their immigration cases.”

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A China-linked espionage group hid inside North American medical, academic, and military research networks for more than a year, quietly stealing sensitive research and defense email. The way in was a backdoor on their REDCap research servers that stole login credentials. The exfiltration was the unusual part: the attackers rewired the victims’ own Google Workspace rules to copy any message

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Cybersecurity researchers have flagged two malicious cyber campaigns that exhibit similarities with a persistent North Korean threat cluster known as Contagious Interview (aka Famous Chollima, HexagonalRodent, and Void Dokkaebi). According to a report published by Proofpoint, the threat actor has been found orchestrating phishing campaigns using developer role recruitment or code review themes

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A default low-privilege account on a LiteLLM proxy can climb to full admin and run code on the server by chaining three vulnerabilities, researchers at Obsidian Security disclosed LiteLLM is a widely deployed open-source AI gateway that brokers calls to more than 100 model providers behind one OpenAI-compatible interface. A server takeover exposes every provider key it holds, the secrets that

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A single click on a trusted Microsoft link could have let an attacker pull emails, calendar details, and indexed files out of Microsoft 365 Copilot Enterprise Search. Researchers at Varonis Threat Labs chained three bugs into a one-click exfiltration path they call SearchLeak. Because the link pointed to a real microsoft.com domain, traditional anti-phishing and URL filtering tools were

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Stuff broke again. Not in a movie way. An old tool was left exposed. An abandoned package was abused. A deprecated feature was still running in prod. This week is the same lesson in a new form: phishing kits are easier to rent, AI names are useful bait, old login paths still fail, and forgotten software keeps becoming someone else’s entry point. Scroll through the full Monday Cybersecurity

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶