Threat actors are exploiting the CitrixBleed 2 vulnerability, tracked as CVE-2025-5777, to hijack active NetScaler sessions protected by multi-factor authentication and gain a foothold in enterprise environments. The activity indicates a standardized operator playbook, potentially operated by an initial access…
Category: GBHackers Security | #1 Globally Trusted Cyber Security News Platform
Forg365 PhaaS Uses Telegram and AI Lures to Hijack Microsoft 365 Accounts
Forg365 is a commercial phishing-as-a-service (PhaaS) platform specifically targeting Microsoft 365 users. It employs methods such as device-code phishing, adversary-in-the-middle (AiTM) workflows, AI-assisted lure generation, and token persistence tools. The platform’s onboarding process through Telegram, subscription model, and post-compromise features…
GNU Guix Vulnerabilities Let Attackers Overwrite Arbitrary Files and Escalate Privileges
Security researcher Caleb Ristvedt disclosed the issues on July 222, 202620262026, warning that all GNU Guix installations are affected. Systems running guix-daemon as root face the highest risk because a malicious substitute server or a man-in-the-middle attacker could write files…
NetScaler MCP Gateway Secures LLM and Agentic AI Traffic From a Single Platform
Citrix, a Cloud Software Group company, announced major updates to its NetScaler® platform on July 9, 2026, introducing MCP Gateway functionality designed to secure and govern the explosive growth of AI agent traffic across enterprise environments. The new capability allows…
New Multi-Stage LNK Attack Targets Hospitality Firms With Node.js Backdoor
Hospitality firms are being targeted in an active phishing campaign that uses fake booking-related emails to deliver a multi-stage Node.js backdoor. The attack chain abuses Google Share links, malicious ZIP archives, Windows shortcut files, PowerShell, and the TON blockchain to…
Wireshark 4.6.7 Released to Patch 12 Vulnerabilities in SSH, TLS, Wi-Fi and pcapng
Wireshark has released version 4.6.74.6.74.6.7, addressing 121212 security flaws across protocol dissectors, capture-file parsers, and its external capture interface. The update resolves issues affecting SSH, TLS Encrypted Client Hello (ECH), IEEE 802.11802.11802.11 Wi-Fi traffic, and pcapng capture files, among other…
Process Parameter Poisoning Technique Hides Shellcode Inside Windows Startup Data
A newly documented Windows injection approach, dubbed Process Parameter Poisoning or P³, uses process startup parameters as an unconventional staging area for shellcode. Implemented in the P³-Shellcode Loader proof of concept, the technique can reduce exposure to telemetry that endpoint…
Odyssey Stealer Attacks Macs Worldwide and Replaces Crypto Wallet Apps With Drainers
Odyssey Stealer is driving a large-scale macOS infostealer campaign that now spans more than 100 countries, with operators systematically hijacking cryptocurrency ecosystems by replacing legitimate wallet apps with drainer trojans. The operation blends advanced social engineering, AppleScript-based stealth, and persistent…
Fake Robinhood Sign-In Alerts Trick Users Into Calling Hacker-Controlled Phone Numbers
A sophisticated callback phishing campaign impersonating Robinhood is coercing victims into dialing attacker-controlled phone numbers by exploiting fear of account compromise. The campaign begins with an unsolicited email or SMS posing as a Robinhood security alert, warning recipients of “unusual…
Hackers Compromise AWS AI Gateway Connected to Amazon Bedrock to Deploy XMRig Cryptominer
A compromise of an AI gateway linked to Amazon Bedrock, highlighting how generative AI infrastructure has become a new target within the enterprise attack landscape. The incident was disclosed on July 9, 2026, and reveals attackers exploiting a LiteLLM-Proxy EC2…
GigaWiper Uses OneDrive Update Scheduled Task for Persistent Destructive Access
A sophisticated Golang-based backdoor family now tracked as GigaWiper that fuses extensive C2 controls with multiple destructive payloads. What makes GigaWiper noteworthy is not merely its destructive capacity but how it packages several formerly separate wipers and extortion tools into…
Ransomware Negotiator Jailed for Leaking Victim Secrets to BlackCat Hackers
Angelo Martino, a former ransomware negotiator from Florida, has been sentenced to 70,707 months in federal prison for conspiring with ALPHV/BlackCat ransomware operators to extort victims whom he was supposed to help during incident-response engagements. The U.S. Department of Justice…
Malicious Braintree.Net Typosquat Steals PAN, CVV, and Payment Gateway Credentials
A malicious NuGet package masquerading as the official Braintree .NET client on July 3, 2026 and Socket’s automation labeled it potential malware within ten minutes. The package, published under the misleading name Braintree.Net, is a carefully crafted typosquat that mirrors…
OpenAI Launches GPT-5.6 With Multi-Agent Cybersecurity and Vulnerability-Exploitation Capabilities
OpenAI has introduced the GPT-5.6 family, comprising Sol, Terra, and Luna, positioning it as a multi-agent platform tailored for advanced cybersecurity workflows, vulnerability research, and exploit development. The company claims that these models offer better performance per dollar compared to…
Microsoft Uses AI-Powered Agentic Scanning to Find Windows Security Flaws and Accelerate Patching
Microsoft is expanding its AI-driven vulnerability discovery across Windows, introducing a multi-model “agentic” scanning system designed to identify security flaws earlier and accelerate global patch deployment. AI-Powered Vulnerability Discovery At the core of this initiative is Microsoft Security’s Multi-Model Agentic…
Multiple U-Boot Vulnerabilities Enable Pre-Authentication Code Execution and Device DoS Attacks
Six critical vulnerabilities in the widely used U-Boot bootloader, which can be exploited through malicious Flattened Image Tree (FIT) images, allowing attackers to achieve pre-authentication arbitrary code execution or crash devices during the early boot process. U-Boot is foundational to…
AI-Assisted Hackers Compromise AWS Cloud in 72 Hours Using Stolen Credentials
An AI-assisted threat actor has demonstrated how quickly a modern AWS environment can be compromised when valid credentials, weak identity controls, and exposed secrets intersect. In about 72 hours, they achieved broad cloud control using familiar techniques executed at an…
Roundcube Webmail Security Update Patches Critical Zero-Click XSS and SSRF Bypass Flaws
Roundcube has released version 1.7.2, a security-focused update that addresses multiple high-impact vulnerabilities, including a zero-click stored cross-site scripting (XSS) flaw and a server-side request forgery (SSRF) bypass. This update follows responsible disclosures from various security researchers and is strongly…
GodDamn Ransomware Attack Uses PsExec Lateral Movement and NirSoft Toolkit for Credential Theft
A targeted GodDamn ransomware incident shows the payload is not entirely new but the latest rebrand of a long-running family. Analysis reveals strong code overlap with Beast (the 2024 rebrand of Monster), and the operational playbook mirrors earlier Hyadina campaigns.…
HP Linux Imaging and Printing Software Flaw Enables Privilege Escalation Attacks
A critical vulnerability has been discovered in HP Linux Imaging and Printing Software (HPLIP), which exposes Linux systems to potential privilege escalation and remote code execution attacks. This vulnerability, tracked as CVE-2026-14544, has a CVSS v3 score of 9.8, indicating…