Cyber security developments for Tuesday the 28th of July 2026 covering articles added to the BlueTeamSec community on infosec.pub. Today we have 12 articles to cover. All attribution is by the article authors. All article analysis is automated.
Darkatlas Squad reports that APT42 has embedded generative AI into its espionage operations, using it to enhance rapport-building phishing campaigns and develop an updated version of the TAMECAT malware framework. The group targets executives, researchers, and journalists with multi-channel relationship building, abusing legitimate infrastructure and focusing on session cookie and credential theft. Worth flagging if you're tracking Iranian-nexus threat activity or defending high-value individuals.
ReliaQuest identifies a campaign running since at least June 2026 where threat actors compromise Wi-Fi gateway appliances in hotels and conference centres to perform DNS poisoning attacks. They're redirecting guest traffic to harvest credentials and compromise Microsoft 365 accounts, affecting corporate employees across financial services, legal, healthcare, energy, and retail sectors in the US, India, and Saudi Arabia. One for security teams with mobile workforces using hospitality Wi-Fi.
Palo Alto Networks has written up an ongoing espionage campaign from threat actor CL-STA-1114 exploiting a Zimbra Collaboration Suite vulnerability via zero-click phishing emails. The campaign, which started in July 2025, targets government, defence, transportation, and financial organisations in NATO countries, Ukraine, Commonwealth of Independent States members, and Africa to exfiltrate credentials, two-factor codes, and email archives. Particularly relevant if you're running Zimbra in any of those sectors.
Seth Enoka provides forensic guidance for analysing Windows persistence mechanisms including services, scheduled tasks, and registry autoruns. The key point here is that configuration artifacts alone don't prove execution or compromise, and investigators need to correlate with execution evidence like Prefetch data, process logs, and specific Event IDs to distinguish legitimate system activity from malicious persistence. Useful background for anyone doing Windows incident response.
A researcher has published a KQL hunting script to detect exploitation of Certighost, the critical Active Directory Certificate Services vulnerability we mentioned yesterday. Microsoft patched it on the 14th of July, but a public proof-of-concept was released on the 24th, which significantly increases exploitation risk for organisations running AD CS on Windows Server. Flag this if you haven't patched yet.
A security researcher demonstrates KernelCallbackTable injection, a stealthy process injection technique that exploits Windows GUI message handling to execute arbitrary code within legitimate processes. It hijacks the KernelCallbackTable in the Process Environment Block to redirect function pointers and force shellcode execution, bypassing traditional security solutions that monitor for thread creation or DLL loading. One for detection engineering teams looking to close this gap.
The SliverArmory project has released Beignet, an offensive security tool that converts macOS dynamic libraries into position-independent shellcode for both ARM64 and AMD64 architectures. Think of it as the macOS equivalent to the Donut project, enabling attackers to package complex library code into executable payloads with optional compression to evade static analysis. Worth understanding if you're defending macOS endpoints.
A researcher has written up reverse-engineering analysis of Windows HyperGuard, the VTL1 Secure Kernel protection mechanism that monitors and prevents kernel-mode tampering in the Windows kernel. The research demonstrates how HyperGuard enforces integrity checks on syscall handlers and hypercall stubs, which significantly raises the barrier for rootkit developers attempting kernel-level hooks. This one's useful background if you're tracking advanced kernel-mode threats.
Doby Baxter introduces Nimbus Vestige, an open-source tool for reconstructing cloud identity intrusions from Office 365 and CloudTrail logs. The tool uses an abductive engine to generate and rank plausible attack paths based on normalised identity telemetry, addressing the challenge of investigating credential-based attacks where adversaries abuse legitimate credentials to perform normal-looking actions. Particularly relevant if you're investigating Entra, M365, or SaaS compromise.
A researcher has released NaX, an open-source Command and Control framework designed for the Adaptix Framework. It employs advanced evasion techniques including position-independent code shellcode, module stomping, and sleepmask obfuscation to bypass EDR solutions and maintain stealthy persistence within compromised networks. Built for red teaming and authorised post-exploitation testing, which is either reassuring or concerning depending on your perspective.
An educational deep dive into Linux KVM hypervisor architecture has been published, covering the VM lifecycle from creation to guest execution, hardware-assisted virtualisation with Intel VT-x, and critical security boundaries including VM exit handling, Extended Page Tables, and hardware vulnerability mitigations. Useful background if you're working with virtualisation security or cloud infrastructure defence.
And finally, an open-source evasion toolkit for the Sliver C2 framework has been released, providing advanced defence evasion capabilities including direct syscalls, memory masking, API obfuscation, and parent process ID spoofing. The suite enables bypassing EDR systems using techniques such as avoiding read-write-execute memory permissions, Process Environment Block walking for API resolution, and encrypted payload delivery. This significantly lowers the barrier for conducting sophisticated, evasive operations with free tooling, so worth understanding what detection gaps it exploits.
That concludes today's briefing.