Oracle, US-based technology giant, has initiated a sweeping round of layoffs affecting thousands of employees globally, with India among the worst-hit regions, according to multiple reports.

The job cuts, which began on March 31, are part of a broader restructuring exercise that could impact between 20,000 and 30,000 employees worldwide, making it one of the largest workforce reductions in the company’s history.

While the exact number remains unconfirmed, multiple reports  suggest that around 12,000 employees in India have been affected,

Employees across several geographies, including India, the United States, Canada, and Mexico, reported receiving termination emails early in the morning, informing them that their roles had been eliminated with immediate effect.

“Today is your last working day,” the email stated, citing “organisational change” as the reason for the decision. Access to company systems, including email and internal platforms, was revoked shortly thereafter.

The communication, according to Business Insider, described the move as part of a broader “reduction in force and other terminations,” and said affected employees would be eligible for severance benefits subject to company policy.

The email also instructed employees to share personal contact details to receive separation documents.

In India, impacted employees have reportedly been offered severance packages that include 15 days’ salary for each completed year of service, notice period pay, leave encashment, gratuity where applicable, and an additional two-month salary top-up in cases of voluntary separation.

The layoffs are linked to Oracle’s strategic shift towards artificial intelligence (AI) and cloud infrastructure.

The company has announced plans to invest approximately USD 50 billion in AI infrastructure and has reportedly raised an equivalent amount in debt to fund its expansion.

In a recent regulatory filing, Oracle said it expects restructuring costs for fiscal 2026 to reach up to USD 2.1 billion, largely driven by severance payouts and related expenses.

The move comes as Oracle looks to strengthen its position against global cloud competitors such as Amazon and Alphabet.

Uncertainty continues to loom over employees, with reports indicating that another round of layoffs could follow in the coming weeks. Employees who were affected described the layoffs as abrupt, with little prior indication.

Some former staff members have taken to social media to share their experiences.

Tricia S Marsh, a former Senior Principal at Oracle, said the layoffs marked the end of an important chapter in her career while urging affected colleagues to remain hopeful.

As of May 2025, Oracle had around 162,000 full-time employees globally.

Kaspersky Global Research & Analysis Team (GReAT) has uncovered an active malicious campaign distributing a previously undocumented RAT with a very broad feature set. Beyond the standard remote access trojan functionality, it combines stealer, keylogger, clipper, and spyware capabilities.

Cybercriminals are selling it to third parties as MaaS (malware-as-a-service) promoting it on YouTube and Telegram, increasing the likelihood of its use across a wider range of actors, including less-skilled operators.

Due to its stealer functionality, the malware can collect a wide range of data about its victim: it gathers system information, extracts credentials for Steam, Discord and Telegram, and also harvests data from web browsers. It also poses a threat to cryptocurrency users, as it includes a browser-based clipper that replaces crypto wallet addresses.

Beyond data theft, CrystalX RAT is capable of full-scale surveillance, with the ability to take screenshots, record audio from the microphone, and capture video from both the webcam and the victim’s screen.

Particularly notable is the CrystalX RAT “playful” Prankware feature set, which is actively promoted by the developers. These capabilities allow operators to visibly interfere with the victim’s system by shaking the mouse cursor, setting wallpapers on the victim’s screen, changing screen orientation, hiding desktop icons, forcing system shut downs, and even delivering real-time pop-up notifications and messages to the victim.

While seemingly trivial, these features introduce a disruptive and psychological dimension to the attack, making the attack both visible and distressing for the victim.

Kaspersky reports attacks targeting users in Russia, but the trojan has the potential to spread to other countries due to its sales and distribution model.

“Such a diverse feature set effectively enables a 360-degree compromise of the victim and a complete loss of privacy. Beyond gaining access to account credentials, the stolen data could potentially be used for blackmail.

“At the moment, the initial infection vector is not precisely known, but it is already affecting dozens of victims. Our telemetry is already detecting new versions of the implants, indicating that this malware is still actively developed and maintained.

“We expect the number of victims to grow significantly and its geographic spread to expand in the near future,” says Leonid Bezvershenko, senior security researcher at Kaspersky GReAT.

Kaspersky has discovered a new phishing tactic used to evade traditional security controls that exploits Bubble, a platform that allows users to build web and mobile applications through a visual interface without writing code.

Attackers are increasingly adopting innovative tools designed for legitimate software development and repurposing them to boost phishing campaigns.

Traditional phishing attacks often rely on malicious links or obvious redirection techniques, which are typically flagged and blocked by modern security systems.

However, attackers are now leveraging Bubble’s no-code environment to generate intermediary web applications which are hosted on Bubble’s legitimate infrastructure and trusted domains such as *.bubble.io, which improves their credibility and helps them bypass security filters.

These applications function as disguised redirectors, silently forwarding victims to malicious credential-harvesting websites.

In the observed campaign, victims were ultimately redirected to a convincing imitation of a Microsoft login page, protected by a Cloudflare verification layer designed to further obscure malicious intent.

This technique is likely being integrated into broader phishing-as-a-service (PhaaS) platforms and phishing kits. These kits enable a wide range of malicious capabilities with ready-made tools, including real-time interception of session cookies, driving phishing campaigns through legitimate services such as Google Tasks and Google Forms, and carry out adversary-in-the-middle (AiTM) attacks that can bypass multi-factor authentication.

They also support the generation of phishing emails using AI, implement geo-filtering and anti-detection mechanisms to evade security crawlers and are often hosted on reputable cloud services like AWS to avoid blacklisting.

“The use of legitimate platforms like Bubble introduces a new level of trust abuse, making it harder for both users and automated systems to distinguish between safe and malicious content. This significantly increases the likelihood of credential theft, unauthorised access and potential data breaches,” comments Roman Dedenok, Anti-Spam Expert at Kaspersky.