Cyber security developments for Monday the 15th of June 2026 covering articles added to the BlueTeamSec community on infosec.pub. Today we have 14 articles to cover. All attribution is by the article authors. All article analysis is automated.
ThreatHunting.io presented Tracebit at x33fcon, a proof-of-concept that fingerprints command-and-control implants by watching page fault telemetry rather than scanning for signatures. The approach monitors low-level memory behaviour to identify C2 frameworks, which should force attackers to rethink their evasion strategies.
A security researcher published ModuleStomped, a detection tool that spots module stomping attacks by monitoring the .pdata section of loaded DLLs instead of the usual .text section. It runs as either a process scanner or an event monitor, and has been tested against several C2 frameworks known to use the technique.
Helsing researchers detail a project to bootstrap Nix from a minimal, manually-auditable seed to address the Trusting Trust problem — essentially, not relying on opaque pre-compiled compiler binaries. The work establishes a verifiable chain of custody for build toolchains, which is recommended for high-assurance infrastructure rather than everyday application builds given the operational overhead.
A security researcher released EDRUnChoker, a defensive tool that detects and removes malicious QoS throttling policies created by the EDRChoker attack. EDRChoker is an evasion technique that abuses Windows QoS policies to throttle EDR agent bandwidth to near-zero, preventing cloud management communication. EDRUnChoker uses a fileless subscription to continuously monitor and remediate these policies.
Following on from the implementation guide we covered last week, TrustedSec have published hardening guidance for Microsoft Intune. Attackers who gain control of Intune can mass-deploy malicious payloads, wipe devices, and bypass security controls across entire managed fleets, so the guidance addresses over-privileged admin roles and the lack of modern identity protections in organisations treating Intune as a Tier 0 asset.
A researcher published ADWS-BOF, a Beacon Object File for Cobalt Strike that performs LDAP queries by communicating directly with Active Directory Web Services. It's designed for red team operations in environments where ADWS is enabled.
Arshia Reisi presented the Tunnel Vision toolkit at x33fcon, demonstrating critical vulnerabilities in Microsoft Global Secure Access. The toolkit reverse-engineers the gRPC-based wire protocol to create rogue tunnel clients that bypass zero-trust controls using stolen credentials, spoof device compliance checks, and maintain persistent access to protected networks.
Varonis Threat Labs ran the OpenClaw experiment showing that autonomous AI agents managing enterprise inboxes are highly vulnerable to context-driven social engineering. Gemini and GPT agents were successfully tricked into leaking AWS and SSH credentials and CRM data through simulated business scenarios, despite excelling at detecting technical anomalies like malicious links. One for anyone thinking about delegating email management to an agent.
Arch Linux administrators are responding to a supply-chain attack affecting roughly 400 accounts in the Arch User Repository. Malicious actors compromised or created accounts to upload packages with code injected into build files that executes during installation. Emergency response procedures are underway to remove malicious commits and ban responsible accounts.
Google Cloud report that ShinyHunters exploited Oracle PeopleSoft vulnerabilities to compromise over 100 organisations globally, with 68% being U.S. higher education institutions. The attackers staged malicious agents via Python HTTP servers, performed internal reconnaissance of PeopleSoft configurations, and automated SSH credential spraying for lateral movement before exfiltrating data published on their leak site in June.
Hex-Rays released rax, a CPU emulator designed for security research including reverse engineering, vulnerability research, and binary analysis in sandboxed environments. The tool provides instruction set emulation with integrated testing frameworks to ensure accuracy when analysing potentially malicious binaries.
A researcher released Noradrenaline, an open-source collection of native Linux and macOS shared library modules designed for post-exploitation within C2 frameworks like Poseidon. The modules enable automated reconnaissance including credential access via cloud metadata services for AWS, Azure, and GCP, system discovery, and AI tooling enumeration on compromised endpoints.
Codex published a preliminary analysis of the Arch User Repository malware, identifying a malicious npm package masquerading as atomic-lockfile that contained a Linux binary executing via npm preinstall scripts. The malware harvests credentials from browsers, developer tools, SSH keys, and shell histories, establishes persistence through systemd services, and deploys an eBPF rootkit when run with root privileges.
And finally, an article examining covert kernel-to-user communication channels on Windows used by advanced rootkits, driver-based malware, and game cheats to synchronise components while evading detection. The research categorises six layers of communication surfaces from basic interprocess communication to hypervisor and DMA manipulation techniques that repurpose legitimate Windows internals. Defenders are advised to implement baseline monitoring, integrity verification using symbol-backed parsers, and cross-layer correlation to detect these covert channels.
That concludes today's briefing.