Weekly Cyber Update: 22 May 2026

The Cyber Threat Intelligence Briefing is a weekly round-up of the latest cybersecurity news, trends and indicators, curated by our CISO, Nick Harris. Here’s our pick of the top stories, and why you should care.

---

GitHub hit by major breach impacting 3800 repositories

GitHub has become the latest victim of another Shai-Hulud software supply chain campaign, with 3800 repositories impacted. Threat group TeamPCP originally compromised dozens of TanStack npm packages with credential-stealing malware targeting CI/CD environments. One of these packages compromised the machine of an Nx developer exfiltrating tokens which enabled TeamPCP to publish a malicious version of the popular Nx Console extension. A single GitHub employee installed that extension, and the infostealer hoovered up credentials from their environment – providing access to thousands of internal private source code repositories.

Why it matters

Open-source package abuse is a sustained, parallel attack surface. If GitHub can get hit any organisation can – especially when sophisticated upstream supply chain attacks hijack developer environments to poison packages or push malicious extensions which look legitimate to security tools.

CI/CD pipelines are particularly exposed as they often consume packages automatically without security checks. The problems are amplified as developers often have elevated privileges, giving threat actors access to a broad range of environments. As per this campaign, it could lead directly to sensitive data theft (including source code) and extortion attempts.

Assured’s recommended action

Regarding this specific campaign, check dependency trees, verify lockfiles, and review CI/CD pipeline permissions. If pipelines have write access to production registries via OIDC, be aware that token trust model is the attack surface here.

More generally, consider segmenting developer environments from corporate networks and run EDR to monitor for suspicious activity including exfiltration. Follow zero trust principles to reduce the potential damage caused by developer environment breaches. Run continuous secret scanning to limit, prevent and contain breaches.

---

Microsoft disrupts Fox Tempest Malware Signing as a Service operation

Microsoft has revealed new efforts to disrupt a malware-signing-as-a-service (MSaaS) operation which plays a key role in the ransomware and cybercrime ecosystem. Fox Tempest uses the Microsoft Artifact Signing platform to generate fraudulent short-lived certificates that allow malware to be signed as legitimate. Microsoft said the group created over 1000 certificates and hundreds of Azure tenants and subscriptions as part of its operation. Fox Tempest has been linked to Oyster, Lumma Stealer, Vidar, Rhysida, Akira, INC, Qilin, and BlackByte. Microsoft said it has seized the group’s domain and revoked over 1000 certs.

Why it matters

Fox Tempest’s work lowers the barrier to entry for more cybercriminals, enabling their malware to pass enterprise security checks. Although disrupted, the threat actor and others like it are still operational.

Assured’s recommended action

Do not rely on traditional anti-malware to stop malware campaigns. Use app control and allow-listing to reduce the risk of infection. Limit the blast radius of attacks through zero trust policies like least privilege. Use XDR to continuously monitor for suspicious activity.

---

UK financial authorities sound the alarm over frontier AI risks

The Bank of England, FCA and Treasury have urged the UK’s financial services sector to proactive take steps to manage the cybersecurity risks stemming from frontier AI models. A joint statement from the trio warned that such models can greatly enhance speed and scale while lowering cost for threat actors, amplifying threats to “firms’ safety and soundness, customers, market integrity and financial stability”.

Why it matters

The missive warned that financial firms that have underinvested in “core cybersecurity fundamentals” will become progressively more exposed as models improve and become more freely available. In the wrong hands, they will help to upskill threat actors, particularly in vulnerability research and exploit development, reconnaissance, malware development and social engineering.

Assured’s recommended action

Follow the advice of the UK’s financial authorities. Ensure boards have “sufficient understanding” of frontier AI risks to make the right investment decisions. Use automation to rapidly triage, prioritise and remediate vulnerabilities, including those in open source software supply chains. Consider how AI-enabled defences can better detect and contain threats. Follow best practices in access management, network security and data protection. Practice incident response and recover in line with previous guidance on cyber resilience.

---

Microsoft warns of exploited zero-day flaw in Exchange

Microsoft has published details of a high-severity Exchange Server vulnerability for which patches aren’t yet available. CVE-2026-42897 is a spoofing flaw affecting Exchange Server 2016, Exchange Server 2019, and Exchange Server Subscription Edition (SE). Adversaries could exploit the vulnerability by sending a specially crafted email to targets. “If the user opens the email in Outlook Web Access and certain interaction conditions are met, arbitrary JavaScript can be executed in the browser context,” Microsoft explained.

Why it matters

Exploitation could lead to session hijacking, credential theft, and lateral movement. Exchange 2016 and 2019 have reached end of life, so when a patch becomes available, organisations not on the Extended Security Update (ESU) programme will not receive updates to fix the issue.

Assured’s recommended action

Organisations that have signed up to the Exchange Emergency Mitigation (EM) Service will have mitigations applied automatically. Those unable to use the service should download the latest version of the Exchange on-premises Mitigation Tool (EOMT) should apply the mitigation on a per server base or on all servers at once. Be aware that mitigations may cause issues with OWA.