June Roundup of Trending News in Cybersecurity

Read more cybersecurity news in this edition of NetSecNews.

• 

  Jessica Owens

  MSSP Training & Development Coordinator, T2 SOC Analyst

Addressing Exchange Server May 2026 vulnerability CVE-2026-42897

Microsoft disclosed an Exchange Outlook Web Access (OWA) vulnerability (CVE‑2026‑42897) allowing malicious JavaScript execution via crafted emails and provided immediate mitigations (notably the Exchange Emergency Mitigation service) while a permanent security update was prepared. (Microsoft Community Hub) 

Kimsuky Deploys HTTPSpy, Expands Arsenal with HelloDoor and VS Code Tunnels 

North Korean hackers (Kimsuky) used fake software and Webex lures to spread the HTTPSpy remote-access trojan and expanded their toolkit with new malware and covert access techniques like VS Code tunnels to target organizations. (The Hacker News) 

GitHub Breached — Employee Device Hack Led to Exfiltration of 3,800+ Internal Repos 

GitHub is investigating a breach tied to a compromised employee device that led to the alleged exfiltration and attempted sale of ~3,800+ internal repositories by the TeamPCP threat group. (The Hacker News)  

Google Chrome adds session cookie theft protection for all users 

Google Chrome is rolling out Device Bound Session Credentials (DBSC) to all users, binding session cookies to device hardware to prevent attackers from reusing stolen cookies for account hijacking, even after login or MFA. (BleepingComputer)  

New BTMOB Android Malware Enables Full Device Takeover 

BTMOB is a phishing-delivered Android remote access trojan (RAT) sold as a customizable toolkit that enables cybercriminals to steal data and fully take over infected devices using advanced remote access capabilities. (SecurityWeek)  

CISA Admin Leaked AWS GovCloud Keys on Github

A CISA contractor accidentally exposed highly sensitive AWS GovCloud credentials and internal system secrets in a public GitHub repository, highlighting serious security hygiene failures. (Krebs on Security)