Cyber security developments for Tuesday the 23rd of June 2026 covering articles added to the BlueTeamSec community on infosec.pub. Today we have 22 articles to cover. All attribution is by the article authors. All article analysis is automated.
BushidoToken has tracked a sustained campaign by DragonForce against UK organizations since late 2023, targeting edge devices and remote access points from vendors like Ivanti, Fortinet, and SonicWall. The particularly concerning bit is their compromise of MSP Helix International, which gives them a route into medium and Fortune 500 clients across sensitive sectors.
Sekoia has detailed ErrTraffic, a malware-as-a-service framework that compromises WordPress sites and uses blockchain smart contracts to hide its command infrastructure. It's being sold on Russian forums and delivers a range of payloads including infostealers and remote access tools, largely via ClickFix social engineering aimed at developers and AI platform users.
Bridewell has written up a phishing campaign running since January that targets Booking.com hotel partners. Attackers compromise hotel staff credentials, steal genuine booking details, then use that authentic information to conduct financial fraud against guests over WhatsApp. The use of real reservation data makes it particularly effective.
Permiso Security has identified a rather troubling gap in Google Cloud Platform audit logs. The serviceData field appears in Logs Explorer but gets stripped from exported logs, which means security teams relying on SIEM analysis may have blind spots around IAM policy changes and other critical events. Worth checking if you're exporting GCP logs for monitoring.
Elastic reports that Microsoft has enabled Azure AD Graph Activity Logs, which finally gives visibility into reconnaissance via the legacy graph API. Tools like ROADrecon and AADInternals have been running undetected for years — if you're using Entra ID, this telemetry is now available for ingestion.
The PHP package ecosystem is seeing increased supply chain attacks this year, with notable compromises of intercom and laravel-lang packages. Composer 2.10 has introduced dependency policies and transparency logs to address this, including immutability controls to prevent silent re-tagging of malicious versions.
NVISO has a cost-optimization piece on Microsoft Sentinel that uses Summary Rules to aggregate high-volume logs in cheaper storage tiers while maintaining detection coverage. The approach can reduce storage costs by up to 94 percent, which is worth exploring if your Sentinel bill has become uncomfortable.
Nextron Systems has built a multi-stage pipeline to scan over 100,000 daily open-source artifacts from npm, PyPI, and the VS Code Marketplace. They use deterministic filtering to reduce the dataset by 96 percent, then apply language models for triage, which is a sensible way to address the token budget problem when scanning at scale.
Following on from the story we covered yesterday, Klue has published their own incident disclosure. An attacker used a compromised legacy credential to access their integration infrastructure and obtain OAuth tokens for connected customer environments including Salesforce. The incident affected a subset of customers who used those integrations.
Snyk has a cautionary tale about the Mastra npm package scope. On June 17th, an attacker gained access to a former contributor's account whose credentials hadn't been revoked, then compromised all 142 packages in the scope. The malicious dependency functioned as a trojan dropper targeting cryptocurrency wallets and establishing persistent access.
CloudSEK has analysed the FortiBleed campaign, which targeted Fortinet firewalls using credential brute-forcing and compromised around 148 organizations with Active Directory access. The attackers left their infrastructure exposed, revealing a 45-GPU hash-cracking cluster and an organized database for selling network access — credential-based rather than exploit-driven.
City of London Police has secured a 48-month sentence for someone involved in an SMS blaster fraud operation. The setup used rogue mobile phone mast technology to force nearby devices onto simulated 2G networks, letting them broadcast fraudulent SMS messages that bypassed standard anti-spam protections.
A researcher has released NØW, an open-source tool that encodes shellcode into natural-looking English prose. It's aimed at red-team operations and represents a novel obfuscation technique for evading detection by disguising malicious code as benign text.
Praetorian has introduced WasmForge, which converts C-sharp offensive tools like GhostPack into WebAssembly format. The idea is to evade traditional security controls by leveraging WebAssembly's legitimate enterprise use, obscuring malicious activity that would normally be flagged when running as .NET assemblies.
White Knight Labs has published part three of their series on Cobalt Strike 4.13's Malleable C2 profiles. It examines advanced evasion techniques available through customizable profiles that allow red teams to bypass endpoint detection and response solutions.
Security researchers have disclosed RoguePlanet and GreatXML, two techniques that exploit legitimate Windows mechanisms for local privilege escalation and BitLocker bypass. RoguePlanet leverages Microsoft Defender's remediation workflow combined with file system primitives to let standard users escalate to SYSTEM on fully patched Windows 10 and 11. Worth reviewing if you're responsible for Windows hardening.
Palo Alto Networks is tracking a large-scale credential theft and password spraying campaign by an initial access broker targeting Fortinet devices, MSSQL services, and Sophos devices. The threat actors are using curated password lists from previous breaches and advertising stolen credentials on Russian-language forums.
Netskope has identified an upgraded ClickFix campaign targeting macOS users that deploys a full remote access trojan alongside AppleScript stealers. The social engineering uses fake websites that trick users into executing malicious terminal commands, which is a significant evolution from earlier stealer-only variants.
OA Labs has released ASF Triage, a forensic tool for investigating AI agent session logs from Claude Code and Codex CLI. The browser-based tool lets SOC analysts parse and search AI coding assistant activity while keeping data client-side, with non-destructive redaction for sensitive information like API keys.
Gen Digital has analysed how Vidar infostealer version 2.1 bypasses Application-Bound Encryption in Chromium browsers. The malware targets browser memory rather than encrypted disk artifacts, using process forking and pattern scanning to locate decryption keys. This represents a significant advancement in credential theft capabilities.
Cisco Talos has demonstrated a novel approach to reverse engineering by exposing legacy analysis tools through Windows COM and the Running Object Table. This transforms static disassemblers into data servers that can be scripted by local AI agents, which is particularly useful for analysing legacy formats like VB6 binaries without requiring cloud services.
And finally, Elastic Security Labs has identified OXLOADER, a sophisticated new Windows loader delivering the CASTLESTEALER infostealer through malicious Google Ads campaigns. The loader employs control-flow flattening, anti-VM checks, and geographic filtering that excludes CIS countries, suggesting Russian-speaking, financially motivated operators.
That concludes today's briefing.