Threat Brief — 2026-07-27 — Hotel honeypots and Telegram C2

Executive summary. A new East Asia–linked APT campaign dubbed TELESHIM is abusing Telegram for command-and-control against Middle East government targets — a reminder that legitimate messaging platforms remain prime C2 channels. On the defensive side, Apple's Gatekeeper model is under fire after researchers demonstrated silent Mac app replacement with no re-verification, and Apple reportedly accepted the behaviour as by design. Meanwhile, business travellers are surrendering corporate email credentials simply by checking into hotel rooms, and GitHub has shipped a concrete 3-day Dependabot cooldown to slow poisoned-package adoption.

Top items

• TELESHIM malware abuses Telegram for C2 against Middle East governments. An East Asia–affiliated threat actor is deploying previously unreported malware that uses Telegram as its command-and-control channel, targeting government entities in the Middle East. Organisations with regional government or diplomatic ties should treat Telegram-based C2 traffic as suspicious and review endpoint telemetry for anomalous messaging-API calls. (src: The Hacker News)

• Researchers: any Mac app can be quietly replaced; Apple says it's by design. Gatekeeper validates an application only at first launch and never re-checks, meaning a signed-and-notarised app can be silently swapped for a malicious binary thereafter. Apple reportedly declined to treat this as a vulnerability. Mac-heavy fleets should consider adding file-integrity monitoring for application bundles and not rely solely on Gatekeeper for ongoing trust. (src: SecurityLab)

• Business travellers surrender corporate email by checking into hotel rooms. Lawyers, doctors, and finance staff handed over account credentials after simply checking into hotel rooms during company-funded trips — the hotel stay itself functioned as the attack vector. This reinforces the need for travel-specific MFA requirements and hardened device profiles for executives handling sensitive data abroad. (src: SecurityLab)

• Executive fired after uploading confidential documents to DeepSeek. A sales director earning 800K uploaded internal documents to the Chinese AI platform DeepSeek and was terminated, losing a $5 million golden parachute. This is a concrete data-exfiltration-by-AI incident — reinforce DLP policies that block or monitor uploads to consumer AI services. (src: SecurityLab)

• GitHub adds 3-day Dependabot cooldown to limit poisoned-package adoption. Developing story. GitHub now lets dependabot.yml enforce a minimum three-day wait after a package release before opening an update PR, giving maintainers and defenders time to detect malicious publishes. This builds on the time-based supply-chain defenses first reported 2026-07-26. Teams using Dependabot should enable the cooldown option immediately. (src: The Hacker News) — first reported 2026-07-26 as GitHub and PyPI add time-based Dependabot defenses

• Multiple network-stack and daemon CVEs published. CVE-2024-14040 (Linux net nexthop weight u16 increase), CVE-2026-64530 (net/sched cls_api TC_ACT_CONSUMED handling), CVE-2026-8450 (HTTP::Daemon < 6.17 Perl OS command injection via send_file()), and CVE-2026-16461 (rpcbind stack buffer overflow in rpcinfo short-mode formatting) were all disclosed. The HTTP::Daemon command-injection and rpcbind overflow are the most actionable; organisations running legacy Perl CGI or rpcbind should patch promptly. (src: MSRC — CVE-2024-14040, MSRC — CVE-2026-64530, MSRC — CVE-2026-8450, MSRC — CVE-2026-16461)

Themes

• Trusted-platform abuse for C2 and exfiltration. TELESHIM's Telegram C2 and the DeepSeek document-upload incident both illustrate adversaries and insiders leveraging mainstream consumer platforms rather than bespoke infrastructure. Defenders should monitor for anomalous use of messaging and AI APIs from corporate endpoints.
• Single-point trust failures. Apple's Gatekeeper (one-time check) and GitHub's pre-cooldown auto-merge both illustrate security models that trust at a single moment and never re-validate. Both are being challenged this week — one by researchers, one by the platform itself.