Cyber security developments for Wednesday the 24th of June 2026 covering articles added to the BlueTeamSec community on infosec.pub. Today we have 13 articles to cover. All attribution is by the article authors. All article analysis is automated.
CISA has issued an urgent advisory on the FortiBleed credential exposure incident affecting roughly 74,000 Fortinet firewalls and VPN gateways. Attackers are actively exploiting leaked credentials to gain unauthorised access, so immediate password resets, phishing-resistant MFA, and removing public internet access to management interfaces are all recommended.
Fortinet have written up the technical side of FortiBleed — essentially credential stuffing and brute-force attacks targeting devices with weak passwords and no MFA on internet-facing management interfaces. Once inside, attackers can create malicious VPN users and move laterally into internal networks, which is about as unpleasant as it sounds.
Synaptic Systems have documented GhostShell, a multi-stage espionage campaign running since February targeting Ukraine's drone ecosystem by impersonating the Besomar manufacturer. The operation exploits a pair of vulnerabilities for initial access, then deploys an mTLS-authenticated implant, a Telegram-based stager with evasion capabilities, and the Vidar info-stealer via tunnelling. The goal is intelligence on drone logistics and military supply chains.
Microsoft have attributed the Mastra npm supply chain compromise to Sapphire Sleet, a North Korean group. Following on from the story we covered earlier this week, this article provides the full technical detail: 140-plus malicious packages published after compromising a maintainer account, with a typosquatting dependency called easy-day-js that dropped obfuscated payloads, established command-and-control, and installed PowerShell backdoors with system-level persistence on developer machines and CI pipelines.
And staying with supply chain incidents, we have three separate disclosures related to the Klue breach from earlier this month. Tanium, Jamf, and the BBC have all confirmed that attackers used compromised legacy credentials to access Klue's integration infrastructure, harvest OAuth tokens, and exfiltrate data from multiple customers' Salesforce instances. The threat actor Icarus subsequently leaked the stolen data, and the BBC report notes that two members of Scattered Spider have pleaded guilty to a separate £39 million attack on Transport for London. Ongoing phishing and social engineering risks apply to anyone affected.
JFrog have documented a typosquatting campaign where a threat actor published three malicious npm packages masquerading as postcss dependencies. The packages delivered a multi-stage infection chain ending in a Python-based Windows remote access tool with persistence and data exfiltration capabilities. One for teams running npm security scans on developer workstations.
Spur Intelligence Labs analysed over 6,000 smart TV applications and found that more than a third contain residential proxy SDKs that turn consumer devices into proxy network nodes, routing third-party traffic through users' home networks without their knowledge. LG and Samsung are the most affected due to lack of platform oversight, and the embedded SDKs from providers like Bright Data and Massive create potential security risks including unauthorised network access and lateral movement opportunities.
Security researcher Dirk-jan Mollema has disclosed a technique to bypass Microsoft Entra ID Conditional Access policies that use resource exclusions. The attack exploits a design choice where low-privileged tokens — those with only basic scopes like openid or profile — bypass CA policies, yet can still access high-value resources like Microsoft Graph. Microsoft recommend enabling Baseline Scope Enforcement and avoiding all-cloud-apps policies with exclusions as mitigation.
AWS have published guidance on egress traffic controls to prevent data exfiltration from cloud workloads. The piece covers risks to traditional applications vulnerable to exploits like React2Shell, as well as modern AI agentic systems susceptible to goal hijacking and unexpected code execution. The central point is that organisations not monitoring outbound traffic can't detect unauthorised data movement to attacker-controlled endpoints, which is a fairly sizeable blind spot.
The White House issued an Executive Order on the 22nd of June mandating Federal agencies transition to Post-Quantum Cryptography by 2030 to 2031 to defend against future quantum computing threats and harvest-now-decrypt-later attacks. Agencies have 90 days to complete cryptographic asset inventories, and compliance requirements will be added to Federal procurement standards. Essentially a state-level forcing function for PQC adoption.
And finally, Rogue Authority have noted that the Cert Graveyard, a public database tracking code-signing certificates abused by malicious actors, has seen over 1.3 million requests in 14 days. It's a useful resource for documenting certificates used in malicious campaigns, and the traffic numbers suggest increasing adoption across the security community.
That concludes today's briefing.