CTI Daily Brief — 2026-06-01

• PostHog rotated all AWS credentials after a researcher-confirmed exploit in its cloud environment — the developer-analytics platform took an unplanned ~6 h outage across both its EU Cloud and US Cloud on 30 May; it says no customer data was compromised and the flaw was patched, but did not disclose the vector (PostHog status, 2026-05-30). Teams integrating PostHog should review the IAM scope they grant its hosted infrastructure.
• Two concurrent npm dependency-confusion campaigns target internal corporate package namespaces — Microsoft (45 packages across nine organisational scopes) and Sonatype (176 packages) document recon/staging payloads that win npm's version race against private registries when .npmrc is not scope-locked (Microsoft, 2026-05-30 · Sonatype, 2026-05-28). Distinct from the Mini Shai-Hulud / TrapDoor activity covered last week.
• SmartApeSG ClickFix lures now stage a custom RAT that then drops NetSupport Manager — a same-day SANS ISC forensic diary maps a processor.vbs → token.bat → setup.cab chain that self-deletes its droppers and persists a weaponised NetSupport build (SANS ISC, 2026-06-01).
• Deep dive: Italy's low-cost commercial spyware economy — Morpheus (IPS Intelligence) abuses the Android Accessibility API, overlay permissions and ADB to self-grant rights and kill mobile AV, no zero-day required; sibling tool Spyrtacus (SIO) leans on DexGuard obfuscation. EU law-enforcement is the named customer base (EDRi, 2026-05-28).

No new vulnerability cleared the § 2 inclusion gates in this window — section intentionally left empty. The CVE-bearing advisories surfaced this run (Oracle May 2026 CPU E-Business Suite cluster; BSI Zimbra advisory WID-SEC-2026-1735) are out-of-window and carry no confirmed in-the-wild exploitation; they are logged in § 7. The actively-exploited PAN-OS GlobalProtect bypass (CVE-2026-0257) was the deep dive on 2026-05-30 and saw no material new development today (§ 7).

No qualifying updates in window — section intentionally left empty. The one candidate update — NCSC-NL advisory NCSC-2026-0172 (2026-05-30) on the PAN-OS GlobalProtect bypass CVE-2026-0257 — restates the already-covered exploitation picture and forecasts increased exploitation, but carries no material new development (no new actor, victim, CVE-in-chain, fresh patch, or law-enforcement action) over the 2026-05-30 deep dive; it is noted in § 7 rather than reported here.

Background. The commercial-spyware conversation in Europe has been dominated by high-tier zero-click vendors — NSO Group's Pegasus and, in Italy specifically, Paragon Solutions' Graphite, whose contract with Italian intelligence agencies was terminated after public disclosure earlier in the Paragon scandal. European Digital Rights (EDRi) and the Italian NGO Osservatorio Nessuno have now documented the layer beneath that headline market: a domestic, low-cost Android-trojan industry that achieves persistent surveillance without any exploit at all (EDRi, 2026-05-28). The technical analyses of the two named tools — Morpheus and Spyrtacus — were published by Osservatorio Nessuno in April 2026 and resurfaced in late-May 2026 regional reporting; this deep dive is built on those primary investigations.

The two tools and who builds them. Morpheus (version 2025.3.0 analysed) is linked to IPS Intelligence (IPS Public Security S.p.A.) (Osservatorio Nessuno — Morpheus, 2026-04-23); Spyrtacus is actively developed by SIO S.p.A. and, per Osservatorio Nessuno's separate analysis, relies on DexGuard obfuscation and an InMemoryDexClassLoader loading stage rather than Morpheus's Accessibility-driven approach (Osservatorio Nessuno — Spyrtacus, 2026-04-09). Both are Android implants delivered by social engineering — fake carrier-update SMS or impersonated apps requiring only a user-initiated install — rather than by a zero-day, which is precisely why they are cheap and why they evade the assumption that "no exploit, no compromise."

Mechanics — privilege without a vulnerability. The infection chain is an abuse chain, not an exploit chain. Morpheus uses a two-stage model that leans on three legitimate Android subsystems: the Accessibility Services API, overlay permissions (SYSTEM_ALERT_WINDOW), and Android Debug Bridge (ADB). Once a user grants Accessibility — the single consent the whole chain hinges on — the implant programmatically self-grants further dangerous permissions and drives the UI, an elevation-by-design pattern mapped to T1626 Abuse Elevation Control Mechanism and T1516 Input Injection. Concretely, Morpheus spoofs a biometric-prompt overlay on top of WhatsApp's account-linking screen to pair an attacker device (capturing the linked session), records audio and video, and — notably for hunt teams — disables the camera and microphone privacy indicators by issuing device_config settings via ADB, and actively terminates installed mobile-AV products (Bitdefender, Sophos, Avast, AVG, Malwarebytes) to protect itself (Osservatorio Nessuno — Morpheus, 2026-04-23). The AV-killing and indicator-suppression are the behaviours most amenable to detection, because they are loud relative to the otherwise-quiet permission abuse.

Scale and the oversight gap — why this is a public-sector story. EDRi reports that Italian prosecutors authorised roughly 5,200 trojan-based interceptions in 2024 alone — a volume far exceeding any other EU member state — at a per-day cost of a few euros, with no centralised oversight: authorisation is local to individual judges, and targets cannot determine which vendor's tool was used or whether authorisation was proper, while EU internal-market rules let these vendors operate across member states with little friction (EDRi, 2026-05-28). EDRi calls for an EU-wide ban on the commercial-spyware trade backed by binding transparency obligations (EDRi, 2026-05-28). For a Swiss/EU public-sector SOC the relevance is twofold: officials, journalists and civil-society contacts are within the documented target class, and the delivery method works against any managed Android fleet because side-loaded APKs (delivered via carrier cooperation or direct messaging) bypass the Play-Store-sourcing assumption that Play Protect enforces.

Detection and hardening for managed Android fleets (no IOCs). The defensible controls are MDM- and MTD-centric, anchored on the consent the implant cannot avoid asking for:

• Alert on any Accessibility Service grant to an APK not on the approved-app list and quarantine the device — this is the chokepoint of the whole chain.
• Treat termination of a registered Mobile Threat Defence / mobile-AV agent within ~30 s of a new APK install as a high-confidence indicator (Morpheus's AV-killing).
• Alert on SYSTEM_ALERT_WINDOW overlay activity from a non-Play-sourced APK, especially overlays on messaging apps (the WhatsApp biometric-prompt spoof).
• Disable ADB over network (adb tcpip) via MDM policy, and enforce Android Enterprise Fully Managed Device mode so users cannot side-load APKs at all; keep Play Protect enabled and non-killable (Google's March 2026 Play Protect update restricts Accessibility abuse for side-loaded apps).
• On the regulatory side, Swiss agencies procuring interception tooling should note the Swiss FADP/Datenschutzgesetz and Informationssicherheitsgesetz exposure the Italian oversight failure illustrates.

The strategic point for defenders: the cheap end of the commercial-spyware market has industrialised permission abuse as a substitute for exploit development, which moves the detection burden off "patch the zero-day" and onto "govern Accessibility/overlay/ADB consent on the fleet" — a control surface most Android MDM deployments do not yet alert on.

• Scope-lock .npmrc and disable install scripts in CI/CD to close the dependency-confusion vector in § 1: route every internal @scope to the private registry explicitly, run npm install --ignore-scripts in pipelines, and grep lockfiles for implausible inflated versions (100.100.100, 99.99.99) on internal package names. Rotate any secrets exposed in the environment of a developer host or build agent that may have installed from the flagged aliases.
• Review the IAM scope granted to PostHog's hosted infrastructure if you use its EU/US Cloud (§ 1): audit cross-account trust relationships to PostHog's AWS account and watch CloudTrail for unexpected key usage; self-hosters should confirm the ingestion endpoint is not unauthenticated-internet-reachable. The vector is undisclosed, so treat the integration boundary as your control point.
• Add Accessibility/overlay/ADB governance to Android MDM (§ 5): alert on Accessibility-Service grants and SYSTEM_ALERT_WINDOW overlays from non-approved APKs, treat MTD-agent termination shortly after an APK install as high-confidence, disable ADB-over-network, and enforce Android Enterprise Fully Managed mode where the fleet handles sensitive material.
• Hunt the browser→script ClickFix pattern (§ 3): alert on browser processes spawning wscript.exe/mshta.exe/cmd.exe, short-lived .vbs/.bat creates in C:\ProgramData\, and NetSupport persistence pointing at non-standard install paths.
• Otherwise, monitor. No item in this run met the emergency-action bar; the actions above are change-window hardening, not page-the-on-call work.