Welcome to Security Signals
Every two weeks, we bring you expert insights and handpicked articles covering the latest threats, threat actor activity, vulnerabilities, incident trends, and defensive strategies. Whether you’re on the front lines or shaping your organization’s security posture, Security Signals delivers the information you need to stay informed and ready.
For more articles, check out our #onpatrol4malware blog.
May 2026 Edition
Key stats from real-world telemetry and live attack observations over the past month – a concise look at what we’re seeing across malware, phishing, ransomware, C2s, and domain abuse.
Insights (TL;DR)
These insights summarize the most common attacker behaviors, techniques, and defensive themes observed across the threat research featured below, helping highlight what mattered most during this reporting period.
Top ATT&CK Techniques Observed
- T1195 – Supply Chain Compromise (9/9): Laravel Lang, Red Hat Cloud Services, CI/CD, GitHub, and developer package compromise dominated this period.
- T1566 – Phishing / Social Engineering (8/9): AiTM kits, fake copyright notices, fake Teams/Claude/Gemini tools, and malvertising were common delivery paths.
- T1555 – Credential Access (8/9): Infostealers, OAuth abuse, cloud token theft, and session-hijacking campaigns repeatedly targeted identity data.
- T1071 – Application Layer C2 (7/9): Microsoft Teams, Google Drive, Azure, Discord, smart contracts, and cloud services were abused for C2 and concealment.
- T1190 – Exploit Public-Facing Apps (7/9): PAN-OS, Ghost CMS, FortiClient EMS, Kubernetes, Ollama, and ViewState exploitation appeared across multiple reports.
What Matters Most
- Supply chain compromise is the top signal. Attackers continue targeting developer ecosystems and trusted package flows for scalable access.
- Identity remains the primary target. Many campaigns are built around stealing credentials, tokens, sessions, and cloud access.
- Trusted platforms are being used as cover. Collaboration tools, cloud services, and developer platforms are central to multiple attack chains.
- AI-themed lures are now routine. Fake Claude, Gemini, and LLM-related tools are being used to improve click-through and malware delivery.
What Defenders Should Watch
- Unexpected package updates, CI/CD changes, GitHub repo activity, or developer tool execution
- OAuth/AiTM behavior, suspicious MFA flows, and unusual cloud or identity token access
- Outbound traffic to cloud-hosted, collaboration, blockchain, or newly observed infrastructure
- Infostealer behavior targeting browsers, wallets, session cookies, and cloud credentials
Quick Wins
- Monitor package managers, CI/CD pipelines, and developer repositories for unauthorized changes
- Review OAuth app approvals, MFA prompts, and identity provider logs for anomalous activity
- Restrict execution from temp, download, and user-controlled directories
- Block newly registered domains tied to fake software, phishing, and supply chain lures
Key Insight: Attackers are scaling through trusted software, identity systems, and cloud platforms, with credential theft and persistent access as the consistent objectives.
Articles
Late May 2026 Cyber Threat Reports highlights a threat landscape shaped by software supply chain compromise, cloud abuse, credential theft, and nation-state activity. This edition covers Red Hat npm attacks, Laravel Lang compromise, Lazarus, Kimsuky, PAN-OS exploitation, AiTM phishing, and attacker abuse of Microsoft Teams, Google Drive, Azure, Discord, and developer ecosystems.
ASEC Threat Report
Source: AhnLab ASEC
(Published: 20 May 2026)
ASEC analyzed recent malware and phishing activity affecting users and organizations. Read more.
From Token Bingo to MAX Takeover: Kali365 Expands Into AWS, Microsoft, Okta, Xerox, MAX Messenger
Source: Arctic Wolf
(Published: 21 May 2026)
Kali365 operators expanded their account takeover operation across cloud, identity, messaging, and business platforms. Read more.
SEO Poisoning Campaign Leverages Gemini and Claude Code Impersonation to Deliver Infostealer
Source: EclecticIQ
(Published: 21 May 2026)
Financially motivated eCrime actors are impersonating AI developer tools to compromise workstations and steal sensitive data. Read more.
Fake Apps Deliver DonutLoader and Remcos RAT
Source: G DATA
(Published: 21 May 2026)
Researchers analyzed a malware campaign using fake applications to deliver DonutLoader and Remcos RAT. Read more.
Lazarus Expands Financial Espionage Operations With Memory-Resident RemotePE RAT
Source: PolySwarm
(Published: 22 May 2026)
Lazarus-linked operators are expanding financial espionage with memory-resident malware and follow-on tooling. Read more.
SolyxImmortal: Analysis of a Python-Based Information Stealer
Source: Pulsedive
(Published: 22 May 2026)
Researchers analyzed SolyxImmortal, a Python-based infostealer targeting credentials and sensitive data. Read more.
Gamaredon’s Matryoshka Campaign Keeps Unpacking Gammaphish and Gammaworm
Source: Sekoia
(Published: 22 May 2026)
Sekoia analyzed a Gamaredon campaign using layered delivery techniques to deploy Gammaphish and Gammaworm payloads. Read more.
UAC-0247 Malware Targeting FPV Operators
Source: Synaptic Systems
(Published: 23 May 2026)
Researchers identified malware activity targeting FPV operators in a campaign tied to UAC-0247. Read more.
The Art of Being Ungovernable
Source: Cisco Talos
(Published: 23 May 2026)
Cisco Talos examined threat activity involving evasion, persistence, and abuse of infrastructure. Read more.
Ghost CMS Mass Compromised via CVE-2026-26980 Now Fueling ClickFix Attacks
Source: Qianxin XLab
(Published: 23 May 2026)
Attackers are exploiting Ghost CMS at scale to fuel ClickFix-style attacks and malicious infrastructure. Read more.
Mustang Panda PlugX Analysis: A Multi-Layer Execution Chain
Source: BlueCyber
(Published: 24 May 2026)
Researchers analyzed a Mustang Panda PlugX sample using a multi-layer execution chain. Read more.
CERT-UA Article 6315762
Source: CERT-UA
(Published: 24 May 2026)
CERT-UA published an advisory describing recent cyber activity and defensive guidance. Read more.
FortiClient EMS Exploited via CVE-2026-35616 to Deliver EKZ Infostealer Disguised as a Fortinet Patch
Source: Arctic Wolf
(Published: 27 May 2026)
Arctic Wolf observed a threat cluster exploiting CVE-2026-35616 to deploy an infostealer disguised as a Fortinet patch to FortiClient EMS-managed endpoints. Read more.
KnowledgeDeliver: ViewState Deserialization Vulnerability Exploitation
Source: Google Cloud
(Published: 27 May 2026)
Google Threat Intelligence analyzed exploitation activity involving a ViewState deserialization vulnerability. Read more.
AzureVeil Spearphishing Delivers C2
Source: CyberPress
(Published: 27 May 2026)
AzureVeil uses spearphishing to deliver command-and-control tooling against targeted victims. Read more.
China APT Webworm Hides European Government Espionage Traffic Inside Discord and Microsoft Cloud
Source: CyberSecSentinel
(Published: 27 May 2026)
A China-linked APT is hiding espionage traffic inside trusted cloud and collaboration platforms. Read more.
OverlayPhantom Android Banking Trojan
Source: Cyble
(Published: 28 May 2026)
Cyble analyzed OverlayPhantom, an Android banking trojan abusing overlay techniques to steal financial data. Read more.
Modern Supply Chain Intrusions: From CI/CD Abuse to Ecosystem-Wide Compromise
Source: DarkAtlas
(Published: 28 May 2026)
Researchers examined supply chain intrusions abusing CI/CD workflows and trusted developer ecosystems. Read more.
The Gentlemen Russia RaaS Operation Rocket Leak Analysis
Source: FalconFeeds
(Published: 28 May 2026)
FalconFeeds analyzed leaked materials related to The Gentlemen ransomware-as-a-service operation. Read more.
Inside CrowdStrike’s Takedown of a Developer-Targeting Botnet
Source: CrowdStrike
(Published: 28 May 2026)
CrowdStrike detailed a takedown operation against a botnet targeting developers and software ecosystems. Read more.
Codestorm: A Microsoft 365 AiTM Phishing Kit With Storm-1167 Overlap
Source: HexaStrike
(Published: 29 May 2026)
Codestorm is a Microsoft 365 adversary-in-the-middle phishing kit with overlap to Storm-1167 activity. Read more.
Tracking North Korea Nation-State APT Infrastructure: Kimsuky
Source: Idan Malihi
(Published: 29 May 2026)
Researchers mapped infrastructure associated with Kimsuky-linked North Korean operations. Read more.
Fake Microsoft Teams Campaign Delivers ValleyRAT
Source: K7 Computing
(Published: 29 May 2026)
Threat actors are using fake Microsoft Teams lures to deliver ValleyRAT through NSIS installers and DLL sideloading. Read more.
FlutterBridge: New FlutterShell Backdoor
Source: Unit 42 (Palo Alto Networks)
(Published: 29 May 2026)
Unit 42 analyzed FlutterBridge, a new FlutterShell backdoor used in targeted activity. Read more.
Tracking Tampered Chef Clusters
Source: Unit 42 (Palo Alto Networks)
(Published: 29 May 2026)
Researchers tracked compromised Chef clusters and related attacker tradecraft. Read more.
Stealthy P2P Cryptominer Targets Ollama Endpoints
Source: Akamai
(Published: 29 May 2026)
Akamai observed a stealthy peer-to-peer cryptominer targeting exposed Ollama endpoints. Read more.
GreyVibe
Source: WithSecure Labs
(Published: 30 May 2026)
WithSecure analyzed GreyVibe malware activity and related tradecraft. Read more.
LLMShare Malvertising Campaign
Source: Push Security
(Published: 30 May 2026)
Push Security analyzed a malvertising campaign abusing LLM-themed lures to target users. Read more.
Laravel Lang Supply Chain Advisory
Source: Snyk
(Published: 30 May 2026)
Snyk disclosed a Laravel Lang supply chain compromise affecting package users and downstream environments. Read more.
Laravel Lang Compromise
Source: Socket
(Published: 30 May 2026)
Socket analyzed a compromise affecting Laravel Lang packages in the open-source ecosystem. Read more.
AI Agent at the Wheel: From CVE to Internal Database in Four Pivots
Source: Sysdig
(Published: 30 May 2026)
Sysdig analyzed how an attacker used LLMs to move from vulnerability exploitation to an internal database in four pivots. Read more.
Supply Chain Attack Targets Laravel-Lang Packages With Credential Stealer
Source: Aikido
(Published: 30 May 2026)
Aikido analyzed a Laravel-Lang supply chain attack that introduced credential-stealing code into package workflows. Read more.
Fake Claude Code Installer Infostealer
Source: Cyderes
(Published: 30 May 2026)
Cyderes analyzed a fake Claude Code installer used to deliver infostealer malware. Read more.
Kimsuky’s Advanced Attack Techniques: JSONPing, WebEx Spoofing, and HTTPSpy Variant
Source: ENKI
(Published: 30 May 2026)
Researchers analyzed advanced Kimsuky techniques involving JSONPing, WebEx spoofing, and a new HTTPSPY variant. Read more.
Trapdoor: Cross-Ecosystem Supply-Chain Credential Theft Operation
Source: SlowMist
(Published: 31 May 2026)
Researchers analyzed Trapdoor, a cross-ecosystem supply chain operation designed to steal credentials. Read more.
Nimbus RAT Abuses Microsoft Teams and Google Drive to Deploy Java RAT
Source: eSentire
(Published: 31 May 2026)
Threat actors are abusing Microsoft Teams and Google Drive to deploy Nimbus RAT. Read more.
Misconfigured, Enrolled, and Dormant: Anatomy of a P2PInfect Kubernetes Compromise
Source: Fortinet
(Published: 31 May 2026)
Fortinet analyzed a Kubernetes compromise involving P2PInfect activity and misconfigured cluster exposure. Read more.
Ghost Stadium Football Fraud
Source: Group-IB
(Published: 31 May 2026)
Group-IB analyzed football-themed fraud infrastructure targeting users with deceptive campaigns. Read more.
The Gentlemen Ransomware Defense Evasion TTPs
Source: Huntress
(Published: 31 May 2026)
Huntress analyzed defense evasion techniques used by The Gentlemen ransomware operators. Read more.
Pivoting on a Malspam Infrastructure Delivering JS Malware
Source: Intrinsec
(Published: 31 May 2026)
Intrinsec tracked malspam infrastructure used to deliver JavaScript malware through bulletproof networks. Read more.
From Fake Purchase Orders to Remote Access: Analyzing the JS.MonoGlyphRAT Threat to US Enterprises
Source: ANY.RUN
(Published: 02 June 2026)
Learn how JS.MonoGlyphRAT targets organizations, enables remote access, and creates costly security risks. Read more.
These Convincing Copyright Notices Are Designed to Steal Google Logins
Source: Security Boulevard
(Published: 02 June 2026)
Scammers use fake takedown requests, countdown timers, and spoofed sign-in screens to steal Google logins from Chrome developers. Read more.
New npm Supply Chain Attack: Red Hat Cloud Services Compromised
Source: OX Security
(Published: 02 June 2026)
A new npm supply chain attack compromised packages associated with Red Hat Cloud Services. Read more.
Rapid7 Observed Exploitation of PAN-OS GlobalProtect Authentication Bypass CVE-2026-0257
Source: Rapid7
(Published: 02 June 2026)
Rapid7 observed exploitation of a PAN-OS GlobalProtect authentication bypass vulnerability tracked as CVE-2026-0257. Read more.
ATMZOW Skimmer
Source: Reflectiz
(Published: 02 June 2026)
Reflectiz analyzed ATMZOW, a skimmer campaign targeting payment data through compromised web infrastructure. Read more.
Hunting Megalodon Fossils
Source: ReversingLabs
(Published: 02 June 2026)
ReversingLabs described hunting techniques for identifying Megalodon-related malware artifacts and infrastructure. Read more.
Red Hat Cloud Service npm Packages Backdoored in 72 Seconds
Source: ReversingLabs
(Published: 02 June 2026)
Researchers analyzed how Red Hat Cloud Service npm packages were backdoored shortly after compromise. Read more.
Operation Dragon Weave Targets Czech Republic and Taiwan Using Azure Cloud C2
Source: Seqrite
(Published: 02 June 2026)
Seqrite uncovered a China-linked campaign targeting Czech Republic and Taiwan using Azure cloud command-and-control. Read more.
DriveSurge
Source: Silent Push
(Published: 02 June 2026)
Silent Push analyzed DriveSurge infrastructure and related threat activity. Read more.
GitHub Internal Repositories Breached
Source: Sophos
(Published: 02 June 2026)
Sophos analyzed activity involving breached internal GitHub repositories and related security implications. Read more.
Multiple Red Hat Cloud Services npm Packages Compromised
Source: StepSecurity
(Published: 02 June 2026)
StepSecurity analyzed multiple compromised Red Hat Cloud Services npm packages and associated supply-chain risks. Read more.
Kali365 PhaaS Inside Attack Infrastructure
Source: Todyl
(Published: 02 June 2026)
Todyl analyzed Kali365 phishing-as-a-service infrastructure and its role in account compromise operations. Read more.
Void Dokkaebi Uses InvisibleFerret Malware
Source: Trend Micro
(Published: 02 June 2026)
Trend Micro analyzed Void Dokkaebi activity using InvisibleFerret malware in targeted campaigns. Read more.
Smart Contracts for Command and Control
Source: Trend Micro
(Published: 02 June 2026)
Trend Micro analyzed attacker use of smart contracts as command-and-control infrastructure. Read more.
Validin Python SDK for Threat Monitoring
Source: Validin
(Published: 02 June 2026)
Validin introduced a Python SDK for threat monitoring and infrastructure analysis workflows. Read more.
Webworm: New Burrowing Techniques
Source: ESET Research
(Published: 02 June 2026)
ESET Research analyzed Webworm’s new techniques for persistence, stealth, and intrusion activity. Read more.
Threat Actors Target Crypto Organizations
Source: Wiz
(Published: 02 June 2026)
Wiz analyzed attacker targeting of cryptocurrency organizations and related cloud security risks. Read more.
Wiz Sensor Forensics GA
Source: Wiz
(Published: 02 June 2026)
Wiz announced forensic capabilities for incident response and cloud investigation workflows. Read more.
Premium Deception: Global Android Carrier Billing Fraud Campaign
Source: Zimperium
(Published: 02 June 2026)
Zimperium uncovered a global Android carrier billing fraud campaign using deceptive premium service flows. Read more.
Want more articles? Check out the previous edition of Security Signals here.
Free Evaluation
Gain a comprehensive view of the external cyber landscape with Malware Patrol’s Cyber Threat Intelligence (CTI) services. We cover a broad spectrum of malicious activities, including malware, ransomware, phishing, cryptominers, newly registered domains, and command-and-control servers to equip your organization with the insights needed to proactively detect and mitigate potential attacks.
Take advantage of a free trial to test our data for yourself.