Cyber security developments for Tuesday the 21st of July 2026 covering articles added to the BlueTeamSec community on infosec.pub. Today we have 9 articles to cover. All attribution is by the article authors. All article analysis is automated.
Elastic have written up a DPRK campaign called Contagious Interview that's targeting software developers with malicious coding challenges. The clever bit is that they're hiding malware payloads inside SVG image files using steganography β the JavaScript then reassembles and executes the code to deploy credential stealers, file exfiltration tools, and a remote access trojan. One for organisations that recruit engineers regularly.
Ddosier are proposing a rather elegant fix to the ClickFix detection problem β which has grown five-fold in the last year and now accounts for nearly half of initial access events. Instead of maintaining dozens of signature-based rules, they've replaced the lot with a single behavioral detection: browser focus loss, shell interpreter spawn, and network egress within sixty seconds. It's the universal pattern regardless of how the payload varies.
Optimus Labs have released GrokPatrol, a forensic scanner to detect whether the Grok Build CLI tool silently exfiltrated your git repositories. Versions 0.2.93 through 0.2.99 were uploading entire local repos β full commit history and all β to Google Cloud Storage, bypassing the AI model permission systems entirely. Worth running if anyone on your team was experimenting with Grok tooling recently.
Adrian Mastronardi has written a thoughtful piece on the XZ Utils backdoor from March 2024 β the one a Microsoft engineer caught because of a half-second latency anomaly. The attacker spent two years socially engineering an exhausted volunteer maintainer to gain access to a critical Linux compression tool. It's a good read if you want the full narrative of how the human side of supply chain security can be the weakest link.
Okta have detailed HollowByte, a denial of service vulnerability in older OpenSSL versions that lets unauthenticated attackers exhaust server memory with just eleven bytes. The flaw exploits unvalidated memory allocation in the TLS state machine, causing heap fragmentation that persists even after the connection closes. OpenSSL addressed it through incremental buffer growth, but this affects web servers, language runtimes, and databases using vulnerable versions.
Josh Parnham disclosed a flaw in macOS Sequoia's Passwords app β specifically the browser extension helper component. Applications could masquerade as legitimate browser extensions and silently query for usernames associated with specific URLs due to inadequate process identity validation. Actual password retrieval remained protected, but it's worth noting this was patched in macOS 15.3.
Bloomberg are reporting that Magnet Forensics have sued a former contractor and his current employer, Paradigm Shift Technology, for allegedly stealing and publicly disclosing trade secrets related to an iPhone zero-day exploit. The public disclosure effectively burned the vulnerability, eliminating its investigative utility for law enforcement who relied on the stealthy exploit. There's a sealed technical filing, which suggests this one's going to be interesting to watch.
And finally, Aikido Security have benchmarked thirteen AI models on their ability to detect known vulnerabilities in code. The research evaluates performance across models like GPT-4 and Claude, providing comparative metrics if you're trying to work out which AI-assisted code review tools are actually worth deploying.
That concludes today's briefing.