Cyber security developments for Thursday the 4th of June 2026 covering articles added to the BlueTeamSec community on infosec.pub. Today we have 9 articles to cover. All attribution is by the article authors. All article analysis is automated.
Exatrack has published a detailed timeline tracking the evolution of PixyNetLoader, a modular multi-stage malware framework deployed by APT28. The analysis covers developments from 2024 through to 2026, focusing on how the toolset has been refined for long-term persistence and stealthy exfiltration. One for anyone tracking Russian-attributed infrastructure and tradecraft.
Cipher Security Labs researcher Idan Malihi has mapped out command-and-control and phishing infrastructure used by Kimsuky, the North Korean group also tracked as APT43. Starting from a single public indicator, the research uncovered active campaigns targeting government agencies, think tanks, and defence contractors focused on Korean Peninsula affairs. Useful background if you're tracking North Korean espionage operations.
Arctic Wolf reports that the Kali365 phishing-as-a-service platform has expanded well beyond its original focus on Microsoft Entra ID token theft. The operator is now running campaigns targeting Outlook, Okta, Xerox DocuShare, and several other enterprise services, effectively scaling into a multi-brand credential harvesting operation. Worth flagging if you're seeing phishing attempts against any of those platforms.
Interisle Consulting Group has analysed 2025 domain registrations and estimates that cybercriminals purchased around 16.8 million domains, accounting for a fifth of all new registrations. Of those, 8.5 million were already blocklisted by mid-2026, with five registrars responsible for half of all blocklisted domains. Some providers are seeing 50 to 80 percent of their registrations flagged for malicious activity, which gives you a sense of the scale.
People Can Fly has written up the concept of dependency cooldowns as a defensive measure following the March 2026 compromises of publishing tokens for packages including LiteLLM, Telnyx Python SDK, and axios. The malicious versions were live for only hours but affected systems that automatically pulled the latest versions. The proposal is to ignore new package versions until they've existed in the registry for a minimum period, which is straightforward enough to implement in most CI pipelines.
Security researcher Codex has disclosed the HTTP/2 Bomb, a remote denial-of-service exploit that can render vulnerable web servers inaccessible within seconds using a standard internet connection. The attack chains compression bomb techniques with flow control manipulation to force massive memory allocation on major web servers including nginx, Apache, IIS, Envoy, and Cloudflare Pingora. It bypasses traditional header size limits by exploiting per-entry bookkeeping overhead rather than decoded data size, which is either impressive tradecraft or a sign that someone's been at this for quite a while.
SafeBreach disclosed Click Or Trick, which was patched by Microsoft back in October 2025. The vulnerability allowed low-integrity processes to escape the sandbox by chaining COM objects, notification spoofing, URI parameter injection in Snipping Tool, and browser debugging protocols. It's a good case study in how interactions between disparate system components can create security gaps despite individual component security.
Huntress researchers have disclosed an unpatched NTLM coercion vulnerability in the Windows search URI handler that Microsoft has declined to assign a CVE or patch for. The vulnerability shares the same underlying code path as the previously patched search-ms handler and can be exploited by convincing a user to click a malicious link, triggering authentication attempts to attacker-controlled servers. Outbound SMB blocking is the primary mitigation since no vendor patch is available.
And finally, AhnLab has analysed EndPoint ransomware, formerly known as Midnight, which is a variant based on leaked Babuk source code. It employs double extortion tactics targeting Windows, VMware ESXi, and NAS environments, and has been attributed to North Korean-affiliated threat actors based on email addresses used in ransom notes. The malware terminates database, office, and email processes before encryption, which is fairly standard for this class of ransomware.
That concludes today's briefing.