Cyber security developments for Monday the 1st of June 2026 covering articles added to the BlueTeamSec community on infosec.pub. Today we have 29 articles to cover. All attribution is by the article authors. All article analysis is automated.
Following on from the story we covered at the weekend, Palo Alto Networks have confirmed limited exploitation attempts targeting their GlobalProtect authentication bypass vulnerability. Unauthenticated attackers can establish VPN connections when specific authentication override and certificate configurations are in place. Rapid7 observed active exploitation starting 17 May, and CISA have added it to their Known Exploited Vulnerabilities catalogue.
Quick Heal Technologies reported Operation XENOFISCAL, where the Pakistan-linked SideCopy group targeted Afghanistan's Ministry of Finance with spear-phishing attacks deploying XenoRAT. The attackers compromised legitimate Afghan government and educational infrastructure to host their payloads, using Pashto-language lures and persistence mechanisms that masquerade as Microsoft Edge entries.
Seqrite uncovered Operation Dragon Weave, a China-linked espionage campaign targeting Czech Republic and Taiwan officials. The operation's notable for using Microsoft Azure Blob Storage as dead-drop command and control infrastructure, deploying a custom agent with persistence valid through March 2027. The attack chain uses both VBScript and Rust-based droppers to sideload malicious components.
Silent Push documented DriveSurge, an Initial Access Broker running a Pay-Per-Install operation by compromising thousands of legitimate high-reputation websites. They redirect visitors through a Traffic Distribution System using fake update prompts and clipboard hijacking tactics, then sell the resulting access to downstream threat actors. Worth noting they're targeting macOS users as well as Windows.
Researchers developed HunterAgent, a framework for reconstructing attack traces when advanced persistent threats use anti-forensics techniques that break provenance graphs. It combines large language model hypothesis generation with deterministic verification using network flows, file system data, and process chains to prevent hallucination during incident response. One for forensics teams dealing with sophisticated adversaries.
Moving to defensive tooling, Bert-Jan Pals published a practical incident response playbook for containing compromised local Windows accounts using Defender for Endpoint Live Response. It includes PowerShell scripts for password rotation, account deletion, and session termination, with safety mechanisms to protect built-in accounts. Useful if you're standardising containment procedures.
git-pkgs released proxy, a security-focused package proxy designed to mitigate supply chain attacks with a Version Cooldown feature that quarantines newly published package versions for a configurable period. It sits between development environments and public registries, preventing build pipelines from automatically consuming potentially malicious updates whilst providing caching and vulnerability scanning. Particularly relevant given the volume of supply chain activity we're covering today.
Falco Security released Prempti, an open-source tool that provides policy enforcement for AI coding agents like Claude Code and Gemini CLI. It intercepts tool calls before execution, evaluating them against Falco rules to detect unauthorised file access, credential theft, and reverse shells. Works across Linux, macOS, and Windows, which addresses some of the agent security risks we've been seeing.
Google Research developed Honeyval, an open-source framework for evaluating large language model powered honeypots against AI-driven hacking agents. Testing across 16 backend environments showed LLM-based honeypots maintained attacker engagement for 82.6 requests versus 30.6 for traditional systems whilst achieving lower detection rates. Useful if you're exploring deception technology in the AI era.
Ikari released pydepgate, a static analysis tool built specifically to detect Python supply chain attacks that exploit interpreter startup mechanisms. It was created following the March 2026 LiteLLM package compromise, addressing gaps in tools like pip-audit that fail to inspect startup vectors such as .pth files and sitecustomize. Analyses adversarial code patterns without execution.
DriverSentinel is an open-source utility that scans Windows systems to identify malicious or vulnerable kernel drivers by cross-referencing local files against the LOLDrivers database. Designed for detecting drivers that could be exploited in Bring Your Own Vulnerable Driver attacks, which is particularly timely given the next article.
The Society for Civil Rights in Germany reported that attackers attempted to install Intellexa's Predator spyware on journalist Trung Khoa LΓͺ's devices via a malicious link on X in February 2023. Forensic analysis by Amnesty International confirmed the attribution. The GFF and LΓͺ filed a criminal complaint this May to investigate perpetrators believed to be operating from abroad.
Privacy Guides disclosed that Signal's macOS desktop application fails to immediately delete messages from disk storage. Messages persist in database log files for days until a threshold is reached, and remain accessible in system backups like Time Machine. The issue was disclosed after 180 days with no acknowledgment from Signal, though database encryption does provide some mitigation.
Quarkslab discovered critical vulnerabilities in VSOL Optical Line Terminals and their Cloud EMS management platform allowing unauthenticated remote code execution. The flaws enable full control over ISP network infrastructure and customer-premises equipment at scale, affecting devices deployed in over 12 countries including the US, India, Brazil, and Pakistan. Worth flagging if you're using VSOL equipment.
Security researchers documented multiple vulnerability classes in OpenClaw, an autonomous agent framework with over 330,000 GitHub stars. Issues include malicious skill injection, prompt-based goal hijacking, and supply chain compromises, with real-world exploitation already observed through AMOS malware distribution targeting users who integrate third-party skills from marketplaces.
MDSec identified significant security deficiencies in the Visual Studio Marketplace that allow distribution of malicious extensions with backdoor capabilities. They discovered extensions executing arbitrary commands retrieved from external endpoints, enabling remote code execution in developer environments. The marketplace lacks effective publisher validation and extension vetting processes.
On to offensive techniques. Netcraft documented the EvilTokens toolkit and GhostPairing campaign demonstrating device code phishing attacks that abuse OAuth 2.0 flows to bypass multi-factor authentication without stealing credentials. Initially used by Russian nation-state actors, commercial toolkits have now made these techniques accessible to broader threat actors targeting Microsoft 365 and secure messaging platforms.
Praetorian demonstrated an automated workflow using large language models integrated with VirusTotal to systematically modify offensive tools and reduce their detection signatures. The system automates iterative binary modification and testing to bypass static and machine learning based EDR detection. Showcases where evasion capabilities are heading with LLM-guided automation.
IBM Research published penetration testing findings on proprietary AI agent systems revealing vulnerabilities enabling remote code execution, data exfiltration, and supply chain compromise. Attackers exploited prompt injection using markdown hiding techniques and tool misuse through weak command allowlists. Demonstrates that rigorous development standards alone aren't sufficient to secure these systems.
Security researcher g3tsyst3m demonstrated a two-stage attack using Bring Your Own Vulnerable Driver techniques to disable Protected Process Light protections on LSASS, followed by evasive memory dumping using process cloning. The technique bypasses Windows 11 defenses and EDR detection by exploiting a signed vulnerable driver to gain kernel memory primitives, then dumps a cloned LSASS process instead of the original.
Now a series of supply chain compromises. SafeDep documented the MicrosoftSystem64 campaign distributing cross-platform malware through trojanised npm packages targeting developers and cryptocurrency traders. The info-stealer exfiltrates credentials, crypto wallet data, and surveillance output to HuggingFace repositories via Git LFS. The campaign's demonstrated operational resilience through infrastructure pivoting and remained active as of May 2026.
Microsoft Defender researchers reported a threat actor publishing 14 malicious npm packages typosquatting OpenSearch, ElasticSearch, and DevOps libraries. The packages abuse npm lifecycle hooks to automatically execute on installation, harvesting cloud credentials, CI/CD secrets, and npm publish tokens from developer environments. Enables cloud lateral movement and supply chain pivoting through compromised credentials.
And Microsoft also documented a single actor publishing 33 malicious npm packages across nine organisational scopes on 28-29 May, exploiting dependency confusion. The packages execute obfuscated stagers that contact a command and control server to download reconnaissance payloads collecting system information, hostnames, environment variables, and developer context. Currently operating in reconnaissance mode.
Kaspersky documented a cybercrime campaign distributing modified SilentCryptoMiner via popular illegal streaming and digital library websites reaching 40 million visits monthly. The malware contains both cryptocurrency mining capabilities and a remote access trojan with advanced persistence mechanisms, Windows Defender evasion, and encrypted command and control using dynamic domain generation. Uses social engineering to trick users into installing fake video player updates.
CISA responded to two supply chain compromises: threat actors compromised Nx developer systems to inject malicious code into Nx Console VS Code extension version 18.95.0, and the Megalodon campaign injected malicious GitHub Action workflows into public repositories. Both attacks resulted in credential theft from CI/CD pipelines and unauthorised repository access after compromising a GitHub employee's device.
ProDefense released Hawk, a post-exploitation tool that captures plaintext credentials from sshd and su processes on Linux by using ptrace to read process memory during authentication. Requires root privileges and operates without modifying target processes, enabling credential theft for lateral movement. Can exfiltrate via webhooks or local logging.
Researchers documented the BoldTealLayer malware campaign featuring a Lua-wrapped loader that evades detection through DLL side-loading, ETW patching, ntdll unhooking, and AMSI bypass techniques. The multi-stage fileless loader uses a legitimate signed executable to inject .NET assemblies directly into memory, successfully evading Microsoft Defender, Malwarebytes, and ESET.
And finally, NVIDIA released SkillSpector, a security scanner for AI agent skills. Their analysis of 42,447 skills from major marketplaces found 26.1% contain vulnerabilities and 5.2% show likely malicious intent. Skills with executable scripts are more than twice as likely to be vulnerable, with risks including data exfiltration, privilege escalation, and arbitrary code execution. Particularly relevant if you're deploying AI coding agents.
That concludes today's briefing.