Cyber security developments for Sunday the 24th of May 2026 covering articles added to the BlueTeamSec community on infosec.pub. Today we have 15 articles to cover. All attribution is by the article authors. All article analysis is automated.
DomainTools published analysis of ZionSiphon, a Windows malware implant designed to target Israeli water infrastructure operated by Mekorot and IDE Technologies. The interesting bit is that it's currently non-operational due to what appears to be a critical bug in its geographic validation logic β the malware self-destructs before executing sabotage routines. Attribution leans Iranian-linked, though the report notes this could equally be attribution theatre by someone else.
OX Security identified a North Korean-linked actor distributing malicious npm packages containing keylogger, infostealer, and remote access capabilities. The malware spreads through three dependent packages that trigger on installation, targeting developers specifically β standard fare for DPRK campaigns in the npm ecosystem.
Socket reported a supply chain attack on the art-template npm package, following on from the stories we covered earlier this week about compromised extensions and packages. An attacker gained repository control and published malicious versions that delivered the Coruna exploit kit, specifically targeting Safari on iOS versions 11 through 17.2. One for anyone relying on that package in production.
Microsoft disclosed CVE-2026-45585, a BitLocker security feature bypass in Windows Recovery Environment. The issue involves a high-privilege executable running during early boot via the BootExecute registry value, allowing BitLocker protections to be circumvented. Microsoft have provided a PowerShell remediation script that removes the vulnerable registry entry.
Researchers Talal Haj Bakry and Tommy Mysk disclosed CVE-2026-28910, a macOS vulnerability in versions prior to 26.4 that exploited Archive Utility's unrestricted filesystem access. The flaw allowed attackers to bypass protections, access private app data containers for Safari, iMessage, Signal, and WhatsApp, and hijack application executables through social engineering β all without requiring elevated privileges or triggering permission prompts.
Aikido Security discovered that deleted Google Cloud Platform API keys remain functional for up to 23 minutes after deletion due to eventual consistency in Google's infrastructure. This creates a revocation window where attackers holding leaked keys retain access to services including Gemini, BigQuery, and Maps, despite users believing access has been terminated. Worth flagging if you've had to rotate GCP keys recently.
Jonathan Johnson published a detailed analysis of OpenAI's Codex Windows sandbox implementation, finding that incomplete cleanup after uninstallation leaves sandbox artifacts β local users, firewall rules, access control lists β that could be exploited. The multi-layered sandbox uses dedicated local users and restricted tokens for isolation, but lacks robust logging and telemetry for security monitoring.
Researchers released VeilGate, an open-source deception proxy that defends web applications against automated probing and AI-assisted scanners. It scores incoming traffic using TLS and HTTP/2 fingerprints, browser headers, and machine learning, then diverts suspected malicious agents into fake application environments. The aim is to increase attacker operational costs by forcing them to waste computational resources on deceptive endpoints.
r-tec Cyber Security identified that Microsoft Graph API throttles requests based on specific Client IDs rather than just volume, with the commonly-used Microsoft Office Client ID experiencing persistent rate limiting. Offensive security tools like GraphRunner that rely on this default identifier for broad tenant access are affected β the workaround involves switching to alternative Client IDs such as Azure CLI.
Varonis unveiled GhostTree, a technique that exploits NTFS junctions to create recursive directory structures with approximately 8.5 times 10 to the 37th distinct paths. This causes security tools and Windows utilities to hang during scans, effectively hiding malicious files by overwhelming recursive scanners with an impossibly large search space.
Sprocket Security reported that Microsoft has closed the last unauthenticated Azure tenant enumeration endpoints, eliminating single-request domain discovery methods. Reconnaissance actors are now pivoting to multi-step techniques including DKIM lookups, MX record brute-forcing, and Graph API queries to reconstruct tenant information. The change increases operational complexity but doesn't eliminate the underlying capability.
Cisco Talos Incident Response published findings from their evaluation of large language models for generating technical incident reports from raw notes. They tested ChatGPT, Claude, and Gemini and found that whilst the models produce polished text, they suffer from significant factual inaccuracies, illogical conclusions, and inconsistencies that make them unreliable for professional security reporting without strict controls.
A developer published CrabLoader, an open-source proof-of-concept user-defined reflective loader for Cobalt Strike written in Rust. The tool demonstrates in-memory beacon execution whilst avoiding read-write-execute memory pages to evade detection, though it currently lacks advanced features like sleep obfuscation. One for red teamers exploring alternatives to traditional loaders.
Security researcher mrexodia released Striga, an educational Python-based tool that lifts x86 assembly to LLVM intermediate representation for binary analysis. It's designed to help researchers perform deobfuscation, devirtualisation, and static analysis by translating binary code into LLVM's intermediate representation without complex build dependencies.
That concludes today's briefing.