Cyber security developments for Monday the 29th of June 2026 covering articles added to the BlueTeamSec community on infosec.pub. Today we have 8 articles to cover. All attribution is by the article authors. All article analysis is automated.
The Internet Crime Complaint Center has issued an alert about Russian intelligence services running targeted phishing campaigns against high-value individuals — government officials, military personnel, journalists — by impersonating support accounts within messaging apps. The real concern here is they're after Backup Recovery Keys, which let them maintain persistent access even after you've deleted and re-registered your account.
Internet Initiative Japan has tracked a May 2026 campaign by the North Korean group Kimsuky distributing KimJongRAT malware through shortened URLs leading to GitHub-hosted payloads. They're using Living Off Trusted Sites techniques — Google Drive for dynamic command and control retrieval, MeshAgent for backup access — and they're quick to spin up new infrastructure when repositories get taken down. One for anyone monitoring North Korean tradecraft.
Cloudflare has released an open-source framework called security-audit-skill that lets autonomous AI agents audit code for security vulnerabilities. It uses a multi-stage pipeline with adversarial validation, where independent agents try to disprove findings to cut down false positives. Worth a look if you're curious about where automated vulnerability discovery is heading.
The curl project has successfully disputed a CVE request for a certificate validation bug. MITRE agreed the wildcard certificate matching flaw doesn't constitute a vulnerability because the exploit chain is vanishingly unlikely and would require local attacker privileges anyway. Adds useful context to how CVE disputes actually work when you're the numbering authority.
Hawktrace have disclosed CVE-2026-45504, a critical arbitrary file read vulnerability in Microsoft Exchange Server 2019 that lets authenticated low-privileged users read sensitive files via the web services API. The exploit leverages improper input validation in WOPI endpoints and uses a fragment marker trick to bypass URI parsing. One to flag if you're running Exchange.
A security researcher has demonstrated six techniques to bypass Windows Anti-Malware Scan Interface by exploiting a fundamental design flaw: AMSI runs in the same process memory space as the code it's scanning, with no privilege boundary. It's a fail-open design that lets attackers disable detection in PowerShell environments. Worth understanding if you're relying on AMSI for telemetry.
Security researchers have released GlueGate, a proof of concept that proxies memory operations through Mozilla's signed library to evade detection. The technique exploits kernel callback inspection by making malicious memory allocations appear to originate from trusted Mozilla code rather than unsigned processes. Particularly relevant if your detection logic relies on call-stack inspection for memory telemetry.
And finally, researchers have released heavener, an open-source EDR emulation engine that lets you test attack payloads against extracted detection logic from commercial platforms — SentinelOne, Cortex, CrowdStrike, Sophos — without deploying actual vendor agents. It uses a six-layer architecture including kernel drivers to simulate real EDR behaviour in offline environments, which is either very useful for red teams or mildly terrifying for vendors, depending on your perspective.
That concludes today's briefing.