Security Signals (6/2/26 – 6/16/26)

These insights summarize the most common attacker behaviors, techniques, and defensive themes observed across the threat research featured below.

Top ATT&CK Techniques Observed

• T1195 – Supply Chain Compromise (9/9): npm, PyPI, Rust crates, GitHub repositories, and AI coding agent workflows were repeatedly targeted.
• T1566 – Phishing / Social Engineering (9/9): Device-code phishing, AiTM kits, fake AI tools, job lures, smishing, and copyright notices were common.
• T1555 – Credential Access (8/9): Infostealers, token theft, session hijacking, and Microsoft 365 credential capture appeared across multiple campaigns.
• T1190 – Exploit Public-Facing Applications (8/9): Oracle PeopleSoft, Check Point VPN, WinRAR, PAN-OS, and SOHO/IoT exploitation remained active.
• T1071 – Application Layer C2 (7/9): Google Sheets, Microsoft Graph, Discord, cloud services, and fast-flux DNS were used for C2 or concealment.

What Matters Most

• Developer ecosystems remain a major access path. Attackers are abusing package managers, repositories, AI coding tools, and CI/CD-adjacent workflows.
• Identity attacks are highly active. Microsoft 365 phishing, device-code abuse, OAuth theft, and session capture remain central to many campaigns.
• AI is now part of both lure design and attacker operations. Fake AI brands, jailbreak techniques, and agent-driven activity appeared repeatedly.
• Nation-state activity is broadening. China-linked, Russia-linked, DPRK-linked, OceanLotus, Gamaredon, and Mustang Panda activity all appeared this period.

What Defenders Should Watch

• Unexpected package updates, GitHub activity, CI/CD changes, or developer tool execution
• OAuth/device-code abuse, suspicious MFA flows, and unusual Microsoft 365 session activity
• Execution from fake AI tools, browser extensions, installers, and user-controlled directories
• Outbound traffic to cloud-hosted, fast-flux, collaboration, or newly observed infrastructure

Quick Wins

• Review package manager, repository, and CI/CD permissions
• Restrict OAuth app consent and monitor device-code authentication
• Alert on execution from downloads, temp folders, and unexpected script interpreters
• Block newly registered domains tied to fake software, phishing kits, and impersonation lures

Key Insight: Attackers are combining developer ecosystem abuse, identity phishing, and public-facing exploitation to scale access, with credential theft and persistent control as the main objectives.