InfoSecBulletin Cybersecurity for mankind

GhostCode is a new phishing kit that changes a regular Microsoft 365 sign-in into an account theft. It doesn’t need to hack a password. Instead, it tricks people into letting criminals into their work accounts. The campaign started with normal messages sent through business contact forms. Attackers pretended to be …

CISA has added a serious Cisco Secure Email Gateway flaw to its list of known exploits. They warn that attackers are using this flaw in real attacks. The flaw, known as CVE-2026-76461, impacts Cisco AsyncOS software on Cisco Secure Email Gateway devices. CVE-2026-76461 is a type of SQL injection flaw, listed …

Japan’s Digital Agency found a data leak that may have exposed about 246,000 records with personal information of government workers. The agency explains that the attacker got in by taking advantage of a weak spot in a VPN device used by the Government Solution Service (GSS). An investigation began on …