Cleartext – May 23, 2026
Daily cybersecurity briefing for CISOs and security leaders.
Episode Summary
Today's episode covers 16 stories across 5 topic areas, including: Microsoft Takes Down Malware-Signing Service Behind Ransomware Attacks; Iran-linked hackers target key US, allied sectors with sophisticated spear-phishing messages; First VPN Dismantled in Global Takedown Over Use by 25 Ransomware Groups.
Stories Covered
🌍 Geopolitical
Microsoft Takes Down Malware-Signing Service Behind Ransomware Attacks
The Hacker News · May 20 · Relevance: ████████░░ 8/10
Why it matters to CISOs: Fox Tempest weaponized Microsoft's own Artifact Signing system to deliver trusted-looking malware across thousands of enterprise networks—a reminder that code-signing trust hierarchies are now a target, not a control, and that vendor takedowns are a necessary but insufficient defense.
Iran-linked hackers target key US, allied sectors with sophisticated spear-phishing messages
Cybersecurity Dive · May 22 · Relevance: ████████░░ 8/10
Why it matters to CISOs: Iranian APTs are escalating targeted espionage against US, Israeli, and UAE critical sectors amid ongoing conflict—enterprises in defense, energy, and financial services should immediately harden against impersonation-based spear-phishing and review vendor access from affected geographies.
First VPN Dismantled in Global Takedown Over Use by 25 Ransomware Groups
The Hacker News · May 22 · Relevance: ███████░░░ 7/10
Why it matters to CISOs: Operation Saffron's dismantling of First VPN—used in nearly every major recent cybercrime investigation—removes a key anonymization layer from 25+ ransomware groups and may temporarily disrupt attack infrastructure targeting enterprise networks.
Alleged Kimwolf Botmaster ‘Dort’ Arrested, Charged in U.S. and Canada
Krebs on Security · May 21 · Relevance: ███████░░░ 7/10
Why it matters to CISOs: The arrest of the alleged Kimwolf operator—who infected over one million IoT devices for DDoS-for-hire—demonstrates increasingly effective cross-border law enforcement coordination; enterprises with IoT exposure should audit device security given the botnet's massive scale.
📡 Macro Trends
Verizon DBIR: Enterprises Face a Dangerous Vulnerability Glut
Dark Reading · May 19 · Relevance: █████████░ 9/10
Why it matters to CISOs: The 2026 DBIR's finding that vulnerability exploitation now accounts for 31% of initial access—overtaking credential theft for the first time—demands a fundamental rebalancing of enterprise security investment from identity-centric controls toward rapid patch cadence and exposure management.
🔓 Data Breach
GitHub confirms 3,800 internal repos stolen through poisoned VS Code extension as supply chain worm hits Microsoft’s Python SDK
VentureBeat Security · May 20 · Relevance: ██████████ 10/10
Why it matters to CISOs: The GitHub breach—traced to a single compromised developer's VS Code extension—exposed 3,800 internal repos and is part of a broader wave of CI/CD and open-source supply chain attacks (TeamPCP/Mini Shai-Hulud) that are actively compromising enterprise development pipelines. Every org using GitHub Actions, npm, or third-party IDE extensions faces direct exposure.
CISA Admin Leaked AWS GovCloud Keys on Github
Krebs on Security · May 18 · Relevance: ██████████ 10/10
Why it matters to CISOs: A CISA contractor intentionally published AWS GovCloud credentials and internal system secrets to a public GitHub repo—the agency responsible for defending civilian federal infrastructure suffered one of the worst self-inflicted government data leaks on record, triggering bipartisan Congressional demands for answers and raising serious questions about contractor oversight.
FBI warns about fast-growing phishing kit targeting Microsoft 365 users
CyberScoop · May 22 · Relevance: ████████░░ 8/10
Why it matters to CISOs: Kali365's device-code OAuth abuse bypasses MFA entirely by capturing legitimate access tokens—not credentials—meaning organizations with mature MFA deployments remain exposed; CISOs should audit conditional access policies to block unrecognized device authorization flows.
NYC Health + Hospitals says hackers stole medical data and fingerprints during breach affecting at least 1.8 million people
TechCrunch Security · May 18 · Relevance: ████████░░ 8/10
Why it matters to CISOs: The theft of biometric fingerprint data alongside medical records from 1.8 million patients is irreversible—unlike passwords, fingerprints cannot be rotated—making this one of the most consequential healthcare breaches of 2026 and a stark reminder that biometric data requires categorical protection beyond standard PII controls.
⚖️ Governance & Policy
Lawmakers from both parties say CISA cuts have gone too far
CyberScoop · May 21 · Relevance: ████████░░ 8/10
Why it matters to CISOs: Bipartisan Congressional pushback on CISA budget reductions signals a potential policy inflection point; CISOs who rely on CISA advisories, KEV updates, and sector coordination should plan for continued capability degradation and diversify their threat-intel dependencies.
Trump postpones executive order focused on AI security
CyberScoop · May 21 · Relevance: ███████░░░ 7/10
Why it matters to CISOs: The postponement of a federal AI security EO—which would have required NSA, Treasury, and other agencies to test AI models for cybersecurity and national security risks within 90 days—delays the regulatory floor for AI governance, leaving enterprise CISOs without a federal compliance anchor to cite in board conversations about AI risk.
Telecom sector launches its own private ISAC
Cybersecurity Dive · May 19 · Relevance: ██████░░░░ 6/10
Why it matters to CISOs: Major telecom providers launching a private ISAC to sidestep federal government involvement reflects growing distrust of government-adjacent threat-sharing structures—CISOs in telecom and adjacent critical infrastructure should evaluate whether sector-specific private ISACs offer more candid intelligence sharing than existing government-affiliated bodies.
🚨 Critical Vulnerability
Valid certificates, stolen accounts: how attackers broke npm's last trust signal
VentureBeat Security · May 22 · Relevance: █████████░ 9/10
Why it matters to CISOs: Attackers demonstrated that Sigstore provenance verification—widely treated as the definitive trust signal for npm packages—provides zero protection when maintainer credentials are compromised, forcing CISOs to rethink dependency trust models beyond cryptographic signing.
Claude Mythos AI Finds 10,000 High-Severity Flaws in Widely Used Software
The Hacker News · May 23 · Relevance: ████████░░ 8/10
Why it matters to CISOs: Anthropic's Project Glasswing finding 10,000 high/critical vulnerabilities in systemically important software in under 60 days signals that AI-accelerated vulnerability discovery is outpacing enterprise patch capacity—CISOs must immediately assess whether their exposure management programs can handle a step-change increase in disclosed critical flaws.
Microsoft Warns of Two Actively Exploited Defender Vulnerabilities
The Hacker News · May 21 · Relevance: ████████░░ 8/10
Why it matters to CISOs: Actively exploited zero-days in Microsoft Defender—the endpoint security tool trusted to prevent exactly this class of attack—underscore that security tooling itself is now a high-value attack surface; CISOs should prioritize emergency patching of Defender and audit privileged escalation paths on Windows endpoints.
Cisco Patches CVSS 10.0 Secure Workload REST API Flaw Enabling Data Access
The Hacker News · May 22 · Relevance: ███████░░░ 7/10
Why it matters to CISOs: A CVSS 10.0 unauthenticated remote flaw in Cisco Secure Workload—a tool specifically designed for zero-trust microsegmentation—is a direct attack on the security control layer itself; organizations running Secure Workload should treat this as a P0 emergency patch given the product's privileged position in network architecture.
Further Reading
🌍 Microsoft Takes Down Malware-Signing Service Behind Ransomware Attacks — The Hacker News🌍 Iran-linked hackers target key US, allied sectors with sophisticated spear-phishing messages — Cybersecurity Dive🌍 First VPN Dismantled in Global Takedown Over Use by 25 Ransomware Groups — The Hacker News🌍 Alleged Kimwolf Botmaster ‘Dort’ Arrested, Charged in U.S. and Canada — Krebs on Security📡 Verizon DBIR: Enterprises Face a Dangerous Vulnerability Glut — Dark Reading🔓 GitHub confirms 3,800 internal repos stolen through poisoned VS Code extension as supply chain worm hits Microsoft’s Python SDK — VentureBeat Security🔓 CISA Admin Leaked AWS GovCloud Keys on Github — Krebs on Security🔓 FBI warns about fast-growing phishing kit targeting Microsoft 365 users — CyberScoop🔓 NYC Health + Hospitals says hackers stole medical data and fingerprints during breach affecting at least 1.8 million people — TechCrunch Security⚖️ Lawmakers from both parties say CISA cuts have gone too far — CyberScoop⚖️ Trump postpones executive order focused on AI security — CyberScoop⚖️ Telecom sector launches its own private ISAC — Cybersecurity Dive🚨 Valid certificates, stolen accounts: how attackers broke npm's last trust signal — VentureBeat Security🚨 Claude Mythos AI Finds 10,000 High-Severity Flaws in Widely Used Software — The Hacker News🚨 Microsoft Warns of Two Actively Exploited Defender Vulnerabilities — The Hacker News🚨 Cisco Patches CVSS 10.0 Secure Workload REST API Flaw Enabling Data Access — The Hacker NewsFull Transcript
Click to expand full episode transcript
Jordan: The week trust died. That's what this was. When a VS Code extension with two million installs gets poisoned and opens the door to 3,800 internal GitHub repos, when cryptographic signing on npm turns out to be camouflage for attackers, when CISA itself leaks its own GovCloud keys to a public repo — this was the week we learned that every trust signal we've built our security architectures around is now an attack surface. That's where we're starting.
Alex: Welcome to Cleartext. I'm Alex Chen, alongside Jordan Reeves. This is your Saturday Week in Review for the week ending May 23rd, 2026. If you couldn't keep up this week, here's what mattered and what it means. We've got four major themes to walk through. First, the collapse of supply chain trust — from code signing to npm provenance to IDE extensions, the foundational assumptions behind software integrity took a beating this week. Second, the vulnerability tsunami — the DBIR numbers, AI-driven discovery, and actively exploited zero-days in the very tools we rely on for defense. Third, a surprisingly productive week for law enforcement disruption operations, and what that means for your threat landscape. And fourth, the governance vacuum — CISA's credibility crisis, stalled AI regulation, and what happens when the institutions meant to backstop enterprise security can't backstop themselves.
Jordan: Let's start with supply chain trust because this is the story that should keep every CISO up this weekend. The GitHub breach is as bad as it sounds. A single developer installed the Nx Console VS Code extension, version 18.95.0. Two point two million installs on that extension. It was poisoned. Through that one compromised developer machine, attackers — tracked as TeamPCP or UNC6780 — exfiltrated approximately 3,800 internal GitHub repositories. They're now advertising those repos for sale starting at fifty thousand dollars. GitHub's own statement said the claim is "directionally consistent" with their investigation. That's GitHub-speak for "yeah, they got us."
Alex: And what makes this genuinely systemic rather than just another breach is what happened the very next day on npm. Six hundred and thirty-three malicious package versions passed Sigstore provenance verification. Full cryptographic attestation. Valid SLSA Build Level 3 certificates. The system worked exactly as designed — and that's the problem. Sigstore verifies that a certificate was valid and that the build happened in a CI environment. It cannot tell you whether the human behind the credential authorized the publish. So when the attacker had the compromised maintainer account, the transparency log became cover.
Jordan: I want CISOs to sit with that for a second. The industry spent years building Sigstore, SLSA, provenance attestation — all of it premised on the idea that if you can verify the build chain, you can trust the artifact. What this week proved is that cryptographic signing is a necessary but wildly insufficient control when the identity layer underneath it is compromised. The signing doesn't lie, but it doesn't know the difference between the real maintainer and someone who stole their credentials.
Alex: And then layer on the Microsoft story. Fox Tempest was running malware-signing-as-a-service — MSaaS — abusing Microsoft's own Artifact Signing system to make malicious code look trusted. Microsoft's Digital Crimes Unit took it down, and good for them, but think about what that means. Attackers aren't trying to evade your code-signing checks. They're getting valid signatures. They're operating inside the trust hierarchy. Every detection that says "this binary is signed, therefore it's safe" is now a liability.
Jordan: The through-line here is unmistakable. Whether it's IDE extensions, npm packages, or signed Windows binaries, the attackers have figured out that the fastest path to your environment is through the things you've explicitly told your stack to trust. Your allowlists are now their target list. And I don't think most organizations have an answer for that yet.
Alex: Practically, here's what I'd be doing this weekend. Audit every VS Code extension, every GitHub Action, every third-party plugin in your CI/CD pipeline. If you don't have a software bill of materials for your development toolchain — not just your production code, your toolchain — you're flying blind. And start treating developer workstations as tier-one critical assets, not afterthoughts.
Jordan: Let's pivot to the vulnerability picture because the DBIR dropped this week and the headline number is a milestone. Vulnerability exploitation is now the number one initial access vector at thirty-one percent of breaches. First time it's overtaken stolen credentials in the history of the report.
Alex: That is a structural shift, not a blip. For years we've told boards that identity is the perimeter. And identity still matters enormously — the Kali365 phishing kit the FBI warned about this week is capturing OAuth tokens, not passwords, bypassing MFA entirely through the device authorization flow. Three hundred and forty organizations compromised by a parallel platform in five weeks. So identity attacks aren't going away. But the DBIR is telling us that the industry's underinvestment in patch velocity and exposure management is now the primary thing adversaries are exploiting.
Jordan: And then Anthropic drops Project Glasswing. Ten thousand high or critical severity vulnerabilities found in systemically important software in under sixty days using Claude Mythos. Ten thousand. Separately, researchers demonstrated a twenty-dollar-per-zero-day AI pipeline for WordPress plugins. The economics of vulnerability discovery just fundamentally changed. We are about to be buried in disclosed critical flaws at a rate that exceeds any organization's capacity to patch.
Alex: Meanwhile, the tools we use to defend against exploitation are themselves under attack. Microsoft disclosed two actively exploited zero-days in Defender — including a privilege escalation to SYSTEM. And Cisco patched a CVSS ten-point-zero in Secure Workload, their zero-trust microsegmentation product. Unauthenticated remote access to Site Admin privileges. No credentials required. Your security control plane is the attack surface.
Jordan: If you're a CISO and your board asks you one question next week, it should be this: can we patch faster than adversaries can weaponize? And for most organizations, the honest answer is no. The DBIR documented a growing gap between disclosure and remediation. AI is about to blow that gap wide open.
Alex: Let's talk about the law enforcement wins because this was actually a remarkable week for disruption operations. Operation Saffron took down First VPN, a bulletproof VPN service that Europol said appeared in almost every major recent cybercrime investigation. Twenty-five-plus ransomware groups used it. Eight hundred servers seized. And critically, law enforcement intercepted VPN traffic and notified users they'd been identified. That's not just disruption, that's deterrence.
Jordan: And the Kimwolf arrest. The alleged botmaster behind a million-plus device IoT botnet, arrested in Ottawa, facing charges in both the US and Canada. This is the person who attacked Brian Krebs with DDoS, doxing, and swatting — which, pro tip, don't attack the journalist who will then investigate you for months and publicly name you before law enforcement catches up.
Alex: These actions matter but let's be clear-eyed. They're necessary and insufficient. Taking down one VPN service creates temporary friction. The operators will migrate. The Kimwolf botnet infrastructure will be replicated. What these operations do buy us is time and intelligence. The First VPN traffic intercepts likely generated enormous leads. And the public identification of users sends a signal that anonymity infrastructure has a shelf life.
Jordan: Which brings us to the governance segment, and this is where the week gets genuinely uncomfortable. The CISA story is devastating. A contractor maintained a public GitHub repo that exposed credentials to highly privileged AWS GovCloud accounts and internal CISA systems. The agency responsible for defending civilian federal infrastructure suffered one of the worst self-inflicted leaks on record. They were still struggling to invalidate credentials days after discovery.
Alex: And the political context makes it worse. Bipartisan lawmakers — Bacon and Walkinshaw — came out and said CISA has been diminished at exactly the moment threats from China and others are growing. The budget cuts are real. The capability degradation is real. And now the credibility damage from this leak compounds everything.
Jordan: For CISOs who rely on CISA — KEV catalog, advisories, sector coordination — you need to start diversifying your threat intelligence dependencies. I'm not saying CISA is going away, but its capacity to serve as the authoritative voice for civilian cybersecurity is materially degraded. The telecom sector apparently reached the same conclusion. Major providers launched a private ISAC explicitly designed to operate without federal government involvement, citing concerns that federal participation was chilling candid discussions. Post-Salt Typhoon, the telecoms decided they'd rather share intelligence among themselves than through government-adjacent channels.
Alex: And then the AI governance vacuum. The administration postponed the executive order that would have required NSA, Treasury, and other agencies to test AI models for cybersecurity risks within ninety days. That delay matters because CISOs have been waiting for a federal compliance anchor to cite in board conversations about AI risk. Without it, you're arguing from first principles every time. New York DFS moved independently with AI-related cyber guidance, but state-by-state regulation is not a strategy.
Jordan: The Iranian threat picture also deserves a mention. Palo Alto Networks published research on sophisticated spear-phishing targeting US, Israeli, and UAE critical sectors. And Iranian actors expanded into OT — fuel tank ATG systems. If you're in defense, energy, or financial services, the targeting is active and the tradecraft is improving.
Alex: So stepping back. What defined this week?
Jordan: This was the week the security industry's trust architecture was exposed as a house of cards. Code signing, provenance verification, trusted extensions, government agencies, security tools themselves — every layer we've built to establish trust became an attack vector. Adversaries aren't trying to break through our defenses anymore. They're wearing our defenses as a disguise.
Alex: And from a board perspective, the conversation has to change. It's not enough to say "we have MFA, we verify signatures, we follow CISA guidance." Every one of those statements was invalidated by a real-world attack this week. The question for CISOs going into next week is: where is your trust model brittle? Where have you substituted a technical control for actual verification? Because attackers are now specifically targeting the delta between what we think a control proves and what it actually proves.
Jordan: Patch Defender. Patch Cisco Secure Workload. Audit your VS Code extensions and your CI/CD dependencies. Review your conditional access policies for device authorization flow abuse. And have an honest conversation about whether your patch velocity can survive the AI-driven vulnerability disclosure wave that is now clearly here.
Alex: That's the week. The daily show returns Monday. Show notes and links to every story we covered can be found at cleartext.fm. I'm Alex Chen.
Jordan: I'm Jordan Reeves. Have a good weekend. Patch something.
Cleartext is an automated daily podcast for CISOs and security leaders. Generated 2026-05-23.
Sources are pulled from: CyberScoop, The Record, SecurityWeek, Krebs on Security, Dark Reading, Cybersecurity Dive, BleepingComputer, Wired, Ars Technica, TechCrunch, Help Net Security, VentureBeat, Risky Business News, The Hacker News, CISA, and BankInfoSecurity.
