InfoSec Briefing - July 05, 2026

🎧 Audio Briefing

Playback Speed:

Cyber security developments for Sunday the 5th of July 2026 covering articles added to the BlueTeamSec community on infosec.pub. Today we have 4 articles to cover. All attribution is by the article authors. All article analysis is automated.

The Citizen Lab has confirmed that a former European Parliament member serving on the committee investigating spyware abuses was himself infected with NSO Group's Pegasus spyware twice in late 2022 and early 2023. The infections hit during the PEGA Committee's investigation into spyware use across Greece, Poland, and Hungary, potentially exposing confidential deliberations to whoever was operating the implant.

SpecterOps have demonstrated how large language models can automate the reverse engineering of endpoint detection products, drastically cutting the time needed to map and bypass security controls. Their agentic loop, called Day Shift, uses tools like Binary Ninja to iteratively decrypt and analyse components without needing backend access, which has rather obvious implications for the entire EDR market.

Following on from the ARToken story we covered earlier this week, Cisco Talos have published a deeper look at the platform's capabilities. It's a phishing-as-a-service setup that abuses OAuth device authorisation flows to bypass MFA on Microsoft 365 accounts, establishes refresh token persistence that survives password resets, and packages the whole lot into an all-in-one business email compromise toolkit. Worth a look if you're defending finance or HR inboxes in particular.

And finally, security researchers have released GadgetSniper, a tool that automates discovery of call-stack spoofing gadgets in 64-bit Windows libraries. It hunts for specific instruction sequences that let attackers fabricate stack frames, making malicious code appear to originate from signed, legitimate modules and evading products that rely on call-stack validation for detection.

That concludes today's briefing.

📰 Articles Covered

Espionage Against the European Parliament: Member of Committee Investigating Spyware Hacked with Pegasus - The Citizen Lab - The Citizen Lab

The Citizen Lab investigation reveals a significant breach of democratic processes involving the targeting of a European Parliament member by mercenary spyware. Below is a detailed precis of the report.

### **What Happened**
Former Member of the European Parliament (MEP) **Stelios Kouloglou** was repeatedly targeted and infected with NSO Group’s Pegasus spyware while serving on the Committee of Inquiry to investigate the use of Pegasus and equivalent surveillance spyware (the **PEGA Committee**). Forensic analysis confirmed infections on or around **October 21, 2022**, and again on **March 6–7, 2023** 【1】.

These dates aligned with highly sensitive periods of the committee’s work, including the drafting of their report on spyware abuses in countries like Greece, Poland, and Hungary, and mission-related travel to Greece by committee members 【1】.

### **Who is Affected**
* **Primary Target:** Stelios Kouloglou, a former MEP and member of the PEGA Committee 【1】.
* **Broader Context:** Several other MEPs have been targeted or infected with mercenary spyware, including those from Catalonia (Diana Riba, Jordi Solé, Clara Ponsati, Carles Puigdemont), France (Nathalie Loiseau), and Germany (Daniel Freund) 【1】.
* **The Unknown:** The security status of other PEGA Committee members and their staff remains unverified, raising the risk that others were similarly compromised 【1】.

### **Security Implications**
The infection represents a "troubling finding" that threatens the integrity of democratic processes. Because the spyware was active during the committee's deliberations, it likely facilitated the interception of:
* Strictly confidential exchanges between committee members and staff 【1】.
* Sensitive, non-public information regarding committee investigations, possibly reaching the very parties under inquiry 【1】.
* Private, highly sensitive medical data, as the initial infection occurred while the subject was hospitalized 【1】.

### **Technical Details**
* **Exploit:** The device was compromised using the **"PWNYOURHOME"** zero-click exploit. The attack chain involved a malicious `NSKeyedArchive` payload sent to HomeKit, followed by malicious content delivered via `MessagesBlastDoorService` 【1】.
* **Attribution:** While the specific NSO customer cannot be confirmed, the infection infrastructure (a specific HomeKit email address) overlaps with campaigns targeting journalists and activists in Europe, suggesting a sophisticated operator capable of deploying spyware across multiple EU jurisdictions 【1】.

### **What Defenders Should Know**
* **Immediate Action Required:** MEPs and staff involved in sensitive committees should seek forensic screening for spyware and preserve devices suspected of being targeted 【1】.
* **Hardening:** High-risk individuals should enable **Lockdown Mode** on iPhones or **Advanced Protect** on Android devices, as these features significantly mitigate mercenary spyware threats 【1】.
* **Institutional Reform:** The report calls for the European Parliament to conduct formal investigations into these surveillance incidents, increase the uptake of available forensic screening, and establish a framework to act promptly on "state-sponsored attack" notifications sent by major technology platforms 【1】.
Accelerating EDR Evasion with LLM-Driven Analysis - SpecterOps

The article from SpecterOps outlines a significant shift in the landscape of offensive security, highlighting how Large Language Models (LLMs) can be leveraged to automate the reverse engineering of Endpoint Detection and Response (EDR) agents. By shifting from manual analysis to AI-driven automation, the time and effort required to map and bypass security controls have been drastically reduced.

Below is a detailed precis of the findings:

### What Happened
Security researchers have successfully developed LLM-powered "harnesses" that automate the teardown of complex EDR products. Using an agentic loop (referred to as "Day Shift"), these LLMs interact with reverse engineering tools like Binary Ninja to iteratively analyze, decrypt, and reverse-engineer local EDR components without needing access to the vendor’s backend infrastructure.

### Who is Affected
This vulnerability affects the entire EDR market. Any security product that relies on on-host components—such as static signatures, local behavioral rules, or agent-side machine learning—is susceptible to this type of automated analysis.

### Security Implications
- **Actionable Intelligence at Scale:** LLMs can rapidly produce high-fidelity intelligence regarding an EDR's detection logic, allowing an attacker to map out the entire defense-in-depth strategy of a target system.
- **Rapid Evasion:** The speed at which LLMs can identify security gaps and bypasses significantly lowers the barrier to entry for developing reliable, stealthy evasion techniques.
- **Obsolescence of Static Rules:** Traditional, signature-based, or localized behavioral rules are rendered increasingly fragile as attackers can easily discover the conditions that trigger (or ignore) these detections.

### Technical Details
- **Automated Harnessing:** Researchers utilize "Day Shift," a loop-based automation system where LLMs maintain a persistent state (via markdown files) to track their progress, analyze binary files, and refine their approach based on previous findings.
- **Analysis Capabilities:** The research demonstrated the ability to:
- **Extract Hooks:** Identify user-mode DLL hooks (e.g., in Cortex XDR).
- **Decrypt Rules:** Reverse-engineer encrypted YARA rules and proprietary formats (e.g., AES-128-ECB).
- **Map Behavioral Logic:** Analyze complex, thousands-deep LUA-based behavioral rules and CLIPS-based rule languages to find specific evasion vectors, such as command-line argument allowlists.
- **Model Emulation:** Create harnesses that emulate the behavior of local machine learning models (specifically tree-ensemble scorers) to test evasion tactics against them.
- **Simulation:** Future development involves using LLMs to emulate entire Command & Control (C2) frameworks and victim environments to validate evasion techniques offline before real-world deployment.

### What Defenders Should Know
- **The "Local" Fallacy:** On-host telemetry and local detection logic should be treated as potentially transparent. Defenders must operate under the assumption that an attacker can reverse-engineer the local ruleset.
- **Shift to Off-Host Visibility:** Because local detection rules are increasingly exposed, the true value of an EDR resides in its remote telemetry and cloud-side analysis capabilities. Defenders should prioritize visibility that is centralized and detached from the endpoint.
- **Defense-in-Depth is Essential:** Reliance on a single EDR product for detection is no longer sufficient. Defenders must adopt a holistic strategy that incorporates diverse preventative controls, identity-based security, and network-level monitoring to minimize reliance on any single potentially compromised security agent.
ARToken: Inside an EvilTokens affiliate panel targeting Microsoft 365 - Cisco Talos

The information provided in your summary is an excellent and accurate precis of the Cisco Talos report regarding the **ARToken** phishing-as-a-service (PhaaS) platform.

Based on the technical analysis provided, here is the synthesized breakdown of the threat:

### Executive Summary: ARToken Phishing Infrastructure
ARToken is a sophisticated PhaaS operator panel that closely mirrors the functionality and infrastructure of the **EvilTokens** platform. It specializes in high-stakes Business Email Compromise (BEC) by targeting Microsoft 365 environments through highly convincing, vendor-impersonation invoice fraud.

### Key Dimensions of the Threat

| Feature | Description |
| :--- | :--- |
| **Attack Methodology** | Leverages **OAuth 2.0 Device Authorization Grant (RFC 8628)** to bypass MFA entirely. Campaigns utilize legitimate SharePoint tenants to host phishing lures, effectively evading traditional security filters. |
| **Target Profile** | Specifically tailored for employees in **Finance, Human Resources, and Logistics**, leveraging existing vendor relationships to maximize the success rate of invoice-related social engineering. |
| **Technical Evasion** | Employs a **seven-layer anti-analysis system** (fingerprinting, telemetry, interaction monitoring) and **XOR-encrypted JavaScript** to thwart static analysis, URL scanners, and automated bots. |
| **Persistence** | Establishes a **Primary Refresh Token (PRT)** persistence chain that remains active even if the victim subsequently performs a password reset, ensuring long-term access. |
| **Operational Scope** | Functions as an all-in-one BEC ecosystem. Once a token is harvested, the panel supports automated inbox rule creation (to suppress evidence), mass email exfiltration, and lateral movement within the victim's tenant. |

### Guidance for Defenders
The sophisticated nature of these attacks requires a layered defense strategy that moves beyond simple email filtering:

* **OAuth Monitoring:** Prioritize detection of anomalous OAuth device code grant requests. Establish baselines for typical authentication flows and flag unusual or high-volume device code authorizations.
* **Infrastructure Heuristics:** Monitor for the use of Cloudflare Workers in hosting suspicious content. Specifically, look for traffic originating from UUID-prefixed Cloudflare worker subdomains associated with Microsoft 365 login flows.
* **Post-Compromise Detection:** Audit for the creation of suspicious Outlook inbox rules, particularly those designed to delete or move incoming emails (e.g., rules meant to hide notifications about changed bank details or unauthorized access).
* **Process Education:** Strengthen security awareness training by specifically addressing the dangers of "trusted" vendor communication. Employees must be trained to verify invoice details through out-of-band communication channels (e.g., calling a known contact) rather than interacting with SharePoint-hosted documents directly from email links.
* **Intelligence Integration:** Proactively ingest and utilize the Indicators of Compromise (IOCs) provided by Cisco Talos in their [GitHub repository](https://github.com/Cisco-Talos/IOCs/blob/main/2026/07/) to identify potential historical or ongoing exposure.
GadgetSniper: Precision call-stack spoofing gadget hunter for x64 DLLs, powered by Iced disassembler - ZakiPedio

This precis outlines the purpose and implications of **GadgetSniper**, a security research tool designed for the automated discovery of call-stack spoofing gadgets within 64-bit Windows DLLs.

### Overview: What Happened
GadgetSniper was released as a specialized utility to identify specific instruction sequences that facilitate **call-stack spoofing**. By scanning legitimate, signed Windows DLLs, it locates "gadgets" (typically a `call` instruction followed by a `jmp qword ptr [non-volatile-reg]`) that allow an attacker to fabricate stack frames. This enables malicious code to execute while appearing to originate from legitimate, trusted modules, thereby bypassing security products that rely on call-stack validation for detection.

### Who is Affected
* **Target Systems:** Windows environments relying on 64-bit architectures are vulnerable to the evasion techniques GadgetSniper facilitates.
* **Security Infrastructure:** EDRs (Endpoint Detection and Response) and other security monitoring tools that utilize call-stack walking as a primary detection heuristic are potentially bypassed by the techniques this tool helps enable.

### Security Implications
The primary implication is the **degradation of stack-walking as a reliable detection mechanism**. Call-stack spoofing allows attackers to hide their execution flow within legitimate processes. By automating the discovery of the required gadgets at scale, GadgetSniper lowers the barrier for red-team operators to test and refine advanced evasion tradecraft against modern security controls.

### Technical Details
GadgetSniper distinguishes itself from traditional, less precise byte-scanning tools through the following mechanisms:
* **Real Instruction Decoding:** It integrates the **Iced disassembler** to ensure accurate identification, effectively eliminating false positives that often arise from accidental byte-matching in data fields or multi-byte prefixes.
* **Targeted Search:** It specifically searches for `jmp qword ptr [reg]` sequences involving non-volatile registers (RBX, RBP, RSI, RDI, R12-R15), which are essential for stable frame fabrication.
* **Validation Logic:** The tool verifies potential gadgets by scanning executable sections and then performing a backward walk to ensure the jump is correctly paired with a valid preceding `call` instruction.
* **High Performance:** Designed for efficiency, it utilizes parallel scanning and custom PE parsing (avoiding P/Invoke or managed loaders), allowing it to effectively process large system directories like `System32`.

### What Defenders Should Know
Defenders can leverage GadgetSniper as an **offensive-security audit tool** to gain visibility into their own environments:
* **Attack Surface Assessment:** By running this tool, security teams can inventory existing gadgets within their system DLLs, quantifying the risk level of their current environment.
* **Contextual Understanding:** The tool produces structured reports that break down gadget counts by file and type, providing defenders with actionable intelligence on which specific DLLs present the highest risk for exploitation.
* **Strategic Defense:** Recognizing that these gadgets are present in legitimate, signed Windows binaries is critical. Understanding this reality encourages defenders to move beyond simple stack-walking and toward more robust, multi-layered detection strategies.