Security Signals (6/16/26-6/30/26)

Top ATT&CK Techniques Observed

• T1195 – Supply Chain Compromise: Software supply chain attacks remained one of the dominant themes, with compromises affecting npm packages, developer tools, IDE plugins, SDKs, and CI/CD workflows.
• T1566 – Phishing: Attackers continued to rely on shopping scams, WhatsApp campaigns, fake domain renewals, Bubble.io phishing, and AI-themed lures to steal credentials.
• T1555 / T1556 – Credential Access: Multiple campaigns targeted developer credentials, AI API keys, browser sessions, enterprise logins, and cloud identities.
• T1071 – Application Layer Protocol: Modern malware increasingly used cloud services, collaboration platforms, blockchain infrastructure, and encrypted channels for command-and-control.
• T1055 / T1059 – Defense Evasion & Execution: Attackers continued adopting reflective loading, DLL sideloading, steganography, PowerShell, and in-memory execution to reduce detection.

What Matters Most

• Developer ecosystems remain under sustained attack. AI frameworks, npm packages, JetBrains plugins, SDKs, and developer tooling were repeatedly compromised during this reporting period.
• Credential theft continues to drive intrusions. Whether targeting developers, cloud administrators, or end users, most campaigns ultimately sought credentials, tokens, or session access.
• Supply chain attacks are expanding beyond package managers. Threat actors increasingly target plugins, extensions, SDKs, repositories, and software update mechanisms.
• Nation-state operations remain highly active. Multiple reports covered activity linked to China- and DPRK-aligned actors, as well as campaigns targeting government, healthcare, and critical infrastructure.

What Defenders Should Watch

• Unexpected package updates, dependency changes, IDE plugins, or CI/CD modifications
• Credential theft targeting AI platforms, developer accounts, and enterprise cloud services
• Execution from temporary folders, archive contents, DLL sideloading, and script interpreters
• Outbound connections to newly observed infrastructure, cloud services, and fast-changing C2 endpoints

Quick Wins

• Review package trust policies and require verification for new dependencies
• Monitor AI platform credentials and API keys alongside traditional privileged accounts
• Strengthen detection for phishing-resistant authentication and suspicious session activity
• Audit developer workstations and CI/CD pipelines for unauthorized changes or plugins

Key Insight: This period marked another shift toward attacks on software development ecosystems. Rather than targeting only end users, threat actors increasingly compromised developer tools, package repositories, and AI-related workflows to gain access to organizations and their cloud environments.

May 2026 Infostealer Trend Report

Source: AhnLab ASEC
(Published: 17 June 2026)
This report summarizes the distribution channels, number of infostealers, number of detections, target companies, and execution types of new infostealers collected during the month of May 2026. Read more.

More Than 4,000 Legacy Routers Compromised by AryStinger, Turned into Global Attack Proxies for Hackers

Source: Qianxin XLab
(Published: 17 June 2026)
On May 20, 2026, the Ministry of State Security’s WeChat official account published an article “Your internet is slow, and the culprit turns out to be this!”, highlighting that outdated routers are becoming a key entry point for threat actors to conduct cyber espionage. Read more.

AdaptixC2: Fingerprinting an Open-Source C2 Framework at Scale

Source: Censys
(Published: 17 June 2026)
AdaptixC2 is an open-source post-exploitation framework with a default configuration that makes deployed servers trivially identifiable from passive scanning. Read more.

Klue Integration Abused in Salesforce Data Theft

Source: ReliaQuest
(Published: 17 June 2026)
In June 2026, ReliaQuest observed a compromised integration for Klue, a competitive-intelligence platform that syncs battlecard and win/loss data with Salesforce, being used to exfiltrate customer relationship management (CRM) data. Read more.

Mastra npm Supply Chain Attack: 140+ Packages Backdoored via easy-day-js Typosquat

Source: StepSecurity
(Published: 17 June 2026)
On June 17, 2026, an attacker compromised the @mastra npm organization and quietly added easy-day-js as a dependency across 140+ packages in the Mastra AI framework ecosystem. Read more.

Mastra Supply Chain Compromise: easy-day-js Dropper Pulls a Cross-Platform RAT Into @mastra Installs

Source: Upwind
(Published: 17 June 2026)
On June 17 2026, a coordinated supply chain attack pushed a malicious easy-day-js package into the dependency tree of the entire @mastra/* npm organization. Read more.

PureRAT Variant Observed in AI Video Player

Source: Luke Acha
(Published: 17 June 2026)
Follow-up analysis of extracted .NET loader stage, internally named Ykzrh.exe (smveo-csharp-agent.exe) in one recovered artifact, revealed a substantial virtualization and runtime reconstruction layer. Read more.

Prinz Eugen Ransomware: A Deep Dive Into a New Go-Based Encryptor

Source: ThreatDown
(Published: 17 June 2026)
On May 11, 2026, our research team investigated a customer infected with a brand-new ransomware family called Prinz Eugen. Read more.

Operation FanTrap: Inside the FIFA 2026 Fraud Ecosystem

Source: Cyble
(Published: 18 June 2026)
The FIFA World Cup 2026 has become more than a global sporting event. Read more.

Mastra Attack Targets Crypto, Password Managers, Authenticators, and Zapier

Source: OpenSourceMalware
(Published: 18 June 2026)
A threat actor compromised the Mastro NPM organization yesterday and published more than 140 malicious packages. Read more.

15 Malicious JetBrains Plugins Stole AI API Keys from 70,000 Developers

Source: StepSecurity
(Published: 18 June 2026)
On June 16, 2026, JetBrains received security reports identifying a coordinated supply chain attack involving 15 malicious third-party plugins on the JetBrains Marketplace. Read more.

Killing Me Gently: Inside Gentlemen’s EDR Killer Framework

Source: ESET Research
(Published: 18 June 2026)
ESET Research shares the results of a months-long investigation into the suite of EDR killers maintained by the RaaS gang Gentlemen. Read more.

SmartApeSG Launches Okendo Reviews Supply Chain Attack

Source: Zscaler
(Published: 18 June 2026)
On May 14, 2026, the Zscaler ThreatLabz team identified unusually high activity associated with the threat actor SmartApeSG to deploy malware. Read more.

Amazon Prime Day 2026: Bargains Begin June 23 – and So Do the Scams

Source: Check Point Research
(Published: 19 June 2026)
When Amazon Prime Day returns on June 23-26, 2026, more than 25 countries will take part in one of the largest shopping windows of the year. Read more.

OXLOADER: New Loader Evading Detection to Drop Infostealer

Source: Elastic Security Labs
(Published: 19 June 2026)
After all the checks have passed, the malware makes a copy of the Windows DirectUI Engine DLL (C:\Windows\System32\dui70.dll), storing it in a temporary location using a randomly generated name with the .ocx extension. Read more.

Threat Actors Weaponizing RAR Archives to Target Thailand’s Healthcare Sector

Source: Seqrite
(Published: 19 June 2026)
Authors: Vaibhav Krushna Billade, Dixit Panchal & Rumana Siddiqui. Read more.

MyBait: Why We Lured Attackers To Encrypt Our Cloud MySQL

Source: Varonis
(Published: 19 June 2026)
Varonis Threat Labs deployed MySQL honeypots across GCP, AWS, and Azure. Read more.

@withgoogle/stitch-sdk: Scope Squat Harvests Developer Credentials

Source: SafeDep
(Published: 19 June 2026)
A malicious npm package published under @withgoogle/stitch-sdk impersonates Google’s Stitch AI design tool by squatting the @withgoogle npm scope. Read more.

FortiBleed: Anatomy of the FortiBleed Campaign Based on the Server That the Attackers Themselves Left Exposed

Source: ZenoX
(Published: 20 June 2026)
In June 19 2026 we received access to the contents of an internet-exposed directory, left open by the operators themselves of a campaign the press named FortiBleed. Read more.

A Multi-Stage Steganographic Loader Campaign Deploying Diverse Payloads Globally

Source: K7 Labs
(Published: 20 June 2026)
The final payload achieves its persistence through the Run entry, winlogon.exe, & userinit. Read more.

From PostCSS Masquerading to Windows RAT

Source: JFrog Security Research
(Published: 20 June 2026)
The downloaded bundle was not a simple script. Read more.

A VBScript Campaign Distributed Through WhatsApp Deploying RMM Software

Source: Kaspersky Securelist
(Published: 22 June 2026)
In June 2026, we observed a malware campaign distributing malicious VBScript files through direct messages in WhatsApp. Read more.

USB Worm CryptoBandits Steals Cryptocurrency via Windows Shortcut Files

Source: ThreatAft
(Published: 22 June 2026)
A financially motivated USB worm campaign has been actively stealing cryptocurrency from Windows users worldwide since at least February 2026. Read more.

What Was a 45-GPU Cracking Farm Built For?

Source: ThreatMon
(Published: 22 June 2026)
Most credential leaks are messy. Someone dumps a pile of raw data, half of it stale, and walks away. Read more.

EvilTokens: How “Ghost” Code Threatens US and European Businesses

Source: ANY.RUN
(Published: 23 June 2026)
EvilTokens can hide serious account takeover risk from your SOC through “ghost” code that appears only after browser-side decryption. Read more.

Inside FortiBleed: Reverse Engineering the CyberStrike Harvester Behind a Global FortiGate Credential Factory

Source: Arctic Wolf
(Published: 23 June 2026)
Arctic Wolf reverse-engineered a recovered CyberStrike Harvester binary and connected it to the broader FortiBleed operator workflow, showing how exposed perimeter credentials can quickly become full internal-network exposure. Read more.

CVE-2025-54068 Laravel Livewire Credential Theft Campaign: 6,000+ Applications Compromised

Source: Imperva
(Published: 24 June 2026)
The campaign, first documented here, has been running for several months, as evidenced by the large volume of stolen data. Read more.

A Burst Bubble: How Threat Actors Are Using Bubble.io to Deliver a New Phishing Campaign

Source: S-RM
(Published: 24 June 2026)
The login follows the expected Microsoft login flow, but it is using the dynamic pages copied from Microsoft’s flow but on the threat actors content delivery network. Read more.

Edgecution: Malicious Edge Extension Backdoor

Source: Zscaler
(Published: 24 June 2026)
Edgecution is a malicious Microsoft Edge extension backdoor associated with ransomware initial access activity. Read more.

May 2026 Threat Trend Report on APT Attacks (South Korea)

Source: AhnLab ASEC
(Published: 24 June 2026)
This report provides a statistical summary and analysis of APT attacks targeting South Korea in May 2026. Read more.

Operation Navy Ghost: How Attackers Planted a Telegram-Powered Backdoor Across Fake pyrogram Packages on PyPI

Source: Checkmarx
(Published: 25 June 2026)
When the attacker sends “/asu print(os.environ)” to the victim’s bot, this function compiles and executes that Python code on the victim’s machine. Read more.

Threat Intelligence Report: Nation-State Targeting of Water Systems 2024-2026

Source: DomainTools
(Published: 25 June 2026)
DomainTools assesses nation-state targeting of water systems from 2024 through 2026, including activity linked to Iran, Russia, and China. Read more.

Coinbase Cartel: Behind the Noise of a Prolific Leak Operation

Source: Intrinsec
(Published: 25 June 2026)
Coinbase Cartel is a prolific leak operation built around high-volume extortion activity and public data exposure claims. Read more.

Fake Domain Renewal Emails Trick Website Owners Into Paying Scammers

Source: Malwarebytes
(Published: 25 June 2026)
Scammers are sending fake domain renewal notices to trick website owners into paying fraudulent invoices. Read more.

Negative SEO Attack: Inside a Black Hat SEO Operation

Source: Zynap
(Published: 25 June 2026)
Negative SEO is a form of search engine manipulation aimed not at boosting the attacker’s own site, but at damaging the ranking, reputation, or visibility of a target domain. Read more.

Operation Turb00 – Part 2: A Multi-Stage HijackLoader Campaign Delivers Vidar v2.1

Source: Medium
(Published: 26 June 2026)
This is the second post in a three-part series on the Vidar infostealer and the infrastructure behind it. Read more.

From CI/CD to Cloud Data: How Shai-Hulud Persistence Leads to Redshift Breach

Source: Fortinet
(Published: 26 June 2026)
The “Shai-Hulud: The Second Coming” campaign represents a major evolution in the landscape of npm supply-chain attacks. Read more.

Beyond Banking Trojans: Rokarolla Expands the Android Fraud Playbook

Source: PolySwarm
(Published: 26 June 2026)
Rokarolla represents a new generation of Android fraud tooling that extends beyond traditional banking trojan behavior. Read more.

Gaslight: The Rust-Powered macOS Implant Designed to Mislead AI Tools

Source: HivePro
(Published: 26 June 2026)
Gaslight (macOS.Gaslight) is a Rust-based macOS implant and information stealer attributed with high confidence to DPRK-aligned activity, first seen on May 22, 2026 and targeting macOS systems worldwide. Read more.

Investigating a Novel OpenAI Poisoned Tenant Attack

Source: Push Security
(Published: 26 June 2026)
Push Security investigated a poisoned tenant attack that abused OpenAI-related workflows to target identity and application access. Read more.

Understanding Langflow CVE-2026-55255, and Why Higher CVSS Vulnerabilities Aren’t Always the Most Exploited

Source: Sysdig
(Published: 26 June 2026)
Sysdig analyzes Langflow CVE-2026-55255 and explains why vulnerabilities with lower scores may see heavier attacker adoption than higher-severity flaws. Read more.

Anatomy of a WHQL-Signed Windows Filtering Platform Kernel-Resident Network Backdoor

Source: Nextron Systems
(Published: 26 June 2026)
Nextron Systems analyzes a WHQL-signed Windows Filtering Platform kernel-resident network backdoor. Read more.

Operation DragonReturn: China-Nexus Cyber Espionage Campaign Targeting Govt. of India/MoF Tax Infrastructure via Multi-Stage DcRAT Deployment

Source: Seqrite
(Published: 26 June 2026)
Seqrite Lab actively tracks and analyse threat actors and their campaigns, focusing on attribution, infrastructure analysis, and adversary tradecraft. Read more.

Mustang Panda Targets India’s Government and Energy Sectors with ZOHOMURK and MINIRECON

Source: Acronis
(Published: 28 June 2026)
Our investigation began after identifying a suspicious archive, Hydropower Cooperation Project Proposal.zip, believed to have been distributed via spear-phishing and subsequently uploaded to VirusTotal in May 2026. Read more.

SystemBC Malware: How the Coroxy Proxy Backdoor Targets Windows

Source: Picus Security
(Published: 29 June 2026)
SystemBC, also tracked as Coroxy, is a Windows malware family that primarily turns an infected machine into a SOCKS5 proxy while also functioning as a persistent backdoor and RAT. Read more.

TONResolver RAT Abuses TON Blockchain to Target Japan’s Hotel Industry

Source: Trend Micro
(Published: 29 June 2026)
In this blog entry, TrendAI™ Research examines a wave of phishing emails observed in May 2026 that targeted Japanese accommodation facilities using Booking.com, detailing the victims, attack techniques used, and characteristics of the malware involved. Read more.

The Gentlemen Are Knocking: Custom Backdoors and Evolving Tactics

Source: Kaspersky Securelist
(Published: 29 June 2026)
This year saw the emergence of The Gentlemen, a prominent example of a group operating under the ransomware-as-a-service model. Read more.

RustDuck: An In-Depth Analysis of a Two-Stage Botnet

Source: Qianxin XLab
(Published: 29 June 2026)
Although the family’s current activity level and influence in DDoS attacks are not yet comparable to some mainstream botnets, its speed of technological evolution deserves significant attention. Read more.

UAC-0184 Tooling Evolution: OneDrive Sideload to Remcos

Source: Synaptic Systems
(Published: 29 June 2026)
Launching shortcuts directly from an archive can behave differently depending on the archive utility and extraction context. Read more.

Inside Kimsuky’s CHM Tradecraft: Multi-Stage Execution and Selective Payload Delivery

Source: Synaptic Systems
(Published: 29 June 2026)
The visible text comments on the structure of a manuscript, including sections covering diversion of civilian resources to military spending, degradation of agricultural production, and inequality in food distribution. Read more.

From CitrixBleed 2 to Cloudflared: The Tools and Techniques Behind Anubis Ransomware Attacks

Source: Arctic Wolf
(Published: 30 June 2026)
Arctic Wolf Labs observed Anubis ransomware attacks using CitrixBleed 2 exploitation and Cloudflared tunneling as part of the intrusion chain. Read more.

Glitch SPY: An Emerging Android RAT Distributed Through a Fake Polish Rental App

Source: Cyble
(Published: 30 June 2026)
Cyble Research and Intelligence Labs identified an emerging Android malware family tracked as Glitch SPY, distributed through a fraudulent Polish apartment and house rental platform designed to lure users into downloading an Android APK. Read more.

Not Very Gentlemanly: Analyzing a Zero-Day Exploit Used by The Gentlemen Ransomware to Disable Targets’ EDRs

Source: Expel
(Published: 30 June 2026)
Ransomware groups have long relied on disabling endpoint detection and response tools before deploying their payloads, and in recent years have utilized bring-your-own-vulnerable-driver attacks to do so. Read more.

The Polymarket Trap: A Fake Arbitrage Bot, Ten npm Accounts, and Four Ways to Deliver an Infostealer

Source: SafeDep
(Published: 30 June 2026)
A set of small npm packages, GitHub repositories, and matching themes were used to lure developers into installing infostealer code disguised as Polymarket arbitrage tooling. Read more.

ToddyCat: Your Hidden Email Assistant. Part 2

Source: Kaspersky Securelist
(Published: 30 June 2026)
We continue to share details on the malicious techniques and toolsets used by the ToddyCat APT group. Read more.

No (Bad) CAP: Inside an Ongoing LSHIY Password Spray Attack

Source: Huntress
(Published: 30 June 2026)
The targeting of these attacks seems to be based entirely on password prevalence on compromised password combo lists, and is not specific to business type or industry. Read more.

Silent Swap: A Crypto Clipper Extension Campaign

Source: McAfee
(Published: 30 June 2026)
McAfee Labs analyzed a browser extension campaign designed to swap cryptocurrency wallet addresses and redirect payments to attacker-controlled wallets. Read more.