Morning Review in IT Security — June 28, 2026

The cybersecurity landscape continues to show escalating threats from nation-state actors, with Russian intelligence services intensifying campaigns against critical infrastructure and messaging platforms. Simultaneously, emerging vulnerabilities in widely deployed enterprise systems demand immediate attention, while novel attack vectors exploiting artificial intelligence systems present new challenges for defenders.

Ukraine Says Russian Intelligence Used Fake Support Texts to Steal Messaging Credentials

The Security Service of Ukraine and the U.S. Federal Bureau of Investigation have jointly uncovered a long-running campaign orchestrated by Russian intelligence services targeting messaging accounts of government officials, military personnel, politicians, and activists across Ukraine, Europe, and the United States. The systematic cyber attacks employed fake support texts as a social engineering vector to harvest sensitive credentials from victims' messaging platforms. This coordinated disclosure highlights the persistent threat that state-sponsored actors pose to high-value targets across multiple continents and sectors. Source: Ukraine Says Russian Intelligence Used Fake Support Texts to Steal Messaging Credentials

Clean GitHub repo tricks AI coding agents into running malware

Security researchers have discovered a sophisticated attack vector in which seemingly benign GitHub repositories can trick agentic coding tools into executing malicious payloads while evading detection by security scanners, artificial intelligence agents, and human code reviewers. The attack demonstrates a critical vulnerability in the emerging ecosystem of AI-assisted development workflows, where automated systems may inadvertently deploy compromised code without proper validation. This supply-chain threat vector represents a significant concern as organizations increasingly rely on AI coding agents for development and deployment tasks. Source: Clean GitHub repo tricks AI coding agents into running malware

FBI: Russian hackers now target Signal backup recovery keys

The FBI and CISA have issued a warning regarding an evolving phishing campaign attributed to Russian intelligence services that now targets Signal Backup Recovery Keys. By stealing these recovery keys, attackers gain unauthorized access to victims' historical encrypted messages, circumventing the platform's end-to-end encryption protections. This escalation demonstrates how threat actors continue to adapt their tactics to compromise secure communication channels relied upon by sensitive targets. Source: FBI: Russian hackers now target Signal backup recovery keys

CISA sets urgent deadline to fix Cisco flaw exploited in attacks

The U.S. Cybersecurity and Infrastructure Security Agency has issued an emergency directive requiring federal agencies to patch critical vulnerabilities in Cisco Unified Communications Manager Server by Sunday due to active exploitation in the wild. The affected flaws represent an immediate threat to government networks and critical infrastructure relying on these communications platforms. CISA's compressed timeline underscores the severity of the threat and the urgency with which organizations must prioritize remediation efforts. Source: CISA sets urgent deadline to fix Cisco flaw exploited in attacks

Today's threat landscape reflects a multi-faceted assault on organizational security, combining persistent nation-state credential theft campaigns with emerging risks from AI-driven development workflows and actively exploited enterprise vulnerabilities. Organizations should prioritize patching critical systems, implementing robust credential protection measures, and establishing heightened scrutiny around third-party code repositories and development tools.