Weekly Threat Intel Report — 2026-W37: 7-13 September 2026

TL;DR

Three themes shaped the week. First, identity-centric attacks against Microsoft 365 escalated. Microsoft attributed a wave of passkey and single sign-on themed social engineering to ShinyHunters and related extortion clusters, with post-access abuse of Microsoft Graph to enumerate and steal SharePoint, OneDrive, and mail data. Second, edge devices remained under active exploitation. Cisco Talos confirmed in-the-wild exploitation of two vulnerabilities in Cisco Secure Firewall Management Center, Sophos reported an updated Cyclops Blink variant seen against those same appliances, and the Dutch NCSC warned that exploitation of two critical Check Point VPN flaws was imminent. Third, generative AI moved deeper into attacker workflows. Anthropic disclosed disruption of a Russia-linked espionage operation that used Claude against more than 20 government, intelligence, diplomatic, and defense organizations, and a separate AI-agent campaign exploited PaperCut NG/MF at 395 organizations. Microsoft Patch Tuesday shipped 972 CVEs including two exploited zero-days, and GitLab urged immediate patching of a maximum-severity path traversal flaw.

Notable Activity by Actor

ShinyHunters and adjacent extortion clusters

Microsoft published detailed guidance on 9 September describing passkey-themed social engineering that leads to identity and cloud compromise. The campaign lures users through messages framed around passkey enrollment or SSO configuration, captures session material or induces the victim to register an attacker-controlled device, and establishes MFA persistence in the tenant. Once inside, operators pivot to Microsoft Graph for reconnaissance and pull data from SharePoint, OneDrive, and mail. BleepingComputer reported the same day that Microsoft attributes activity to ShinyHunters, Helix, and other extortion gangs targeting corporate Microsoft accounts. DarkReading added on 10 September that voice callers are exploiting BYOD access paths to Microsoft 365, then handing access to extortion groups including ShinyHunters.

ShinyHunters also claimed the Florida Department of Highway Safety and Motor Vehicles DAVID driver database breach. Both The Record and BleepingComputer reported on 11 September that Florida traced the intrusion to credentials stolen from a police officer's personal device. This continues a pattern of the group monetizing valid credentials obtained through third-party or personal-device exposure rather than novel exploitation.

ClearFake

Cisco Talos published analysis on 8 September of a ClearFake infection chain that stages payloads over WebDAV and delivers Amatera stealer, ZigCryptoStealer, and NetSupport Manager. Talos assesses with moderate confidence that the activity is not targeted, and instead represents a broad cryptocurrency and credential theft operation. NetSupport is used as the remote access component after the stealers execute. The lure and delivery model remain consistent with prior ClearFake operations that abuse compromised websites and browser update themes.

Emerging Threats

Active exploitation of Cisco Secure Firewall Management Center

Cisco Talos reported on 9 September that two vulnerabilities in Cisco Secure Firewall Management Center are under active exploitation. Sophos followed on 11 September with analysis of an updated Cyclops Blink variant observed in attacks against these same devices, describing expanded modular capabilities. Organizations running FMC should apply Cisco fixes immediately, review appliance logs for indicators shared by Talos and Sophos, and treat any anomalous administrative activity on FMC as a high-severity event pending investigation.

Check Point VPN critical flaws

BleepingComputer reported on 12 September that the Dutch National Cyber Security Centre warned exploitation of CVE-2026-85102 and CVE-2026-85103 in Check Point VPN was imminent. Given the recent history of edge VPN devices as initial-access footholds for both ransomware and state-aligned intrusion sets, patching should be treated as urgent rather than routine.

September Patch Tuesday and GitLab

Microsoft released fixes for 972 CVEs, with 113 rated critical and two under active exploitation, per CrowdStrike and Cisco Talos analyses on 8 September. GitLab urged users on 11 September to patch CVE-2026-85706, a maximum-severity path traversal vulnerability. BleepingComputer also reported chained exploitation of JFrog Artifactory flaws to bypass authentication, gain administrative privileges, and deploy a Rust backdoor on self-hosted servers. Huntress continued to track active exploitation of a critical N-able N-central vulnerability that provides unauthenticated administrative access to the RMM console, a class of exposure that historically enables downstream attacks against managed customers.

AI in offensive operations

Anthropic disclosed and The Record reported on 11 September that a Russia-linked espionage group used Claude in a hacking campaign against more than 20 government, intelligence, diplomatic, and defense organizations. Anthropic also reported that multiple threat groups, including financially motivated actors and state-sponsored espionage clusters tied to Russia and China, attempted to abuse Claude to extract secrets from approximately 1.8 million Android applications. Separately, BleepingComputer reported on 10 September that a likely Russian-speaking actor used hundreds of AI agents to develop and run a global exploitation campaign targeting vulnerable PaperCut NG/MF servers, compromising approximately 395 organizations. DarkReading described the same campaign as a demonstration of agentic AI compressing reconnaissance, staging, exploitation, lateral movement, and exfiltration into a single automated workflow.

On the fraud side, DarkReading reported that a single threat actor generated approximately 1 million personalized fraud emails in three days, and Microsoft researchers described new AI-assisted refinements to invoice-scam messages that improve apparent legitimacy. The direction is consistent: AI is lowering the marginal cost of both targeted intrusion tooling and high-volume social engineering at the same time.

Third-party and identity exposures

Trezor reported on 11 September that phishing traced to the earlier Brevo email platform breach targeted 347,000 users, with 2,500 clicking a malicious link. Surfshark disclosed on 10 September that a configuration error exposed an internal test server, which was accessed by unauthorized parties. Revolut confirmed on 12 September, per TechCrunch, that customer data was accessed through fraudulent government data requests, a technique that continues to affect platforms with law-enforcement request workflows.

Mobile malware

DarkReading reported on 11 September that the GoldFactory group is running an Android banking-app-cloning campaign in Indonesia that abuses the Android Work Profile feature to deliver the Gigabud Trojan. BleepingComputer described a new Android strain, Mantax Otax, that combines file encryption, data theft, and victim harassment.

Defender Takeaways

• Treat passkey and SSO-themed messages the same way you treat MFA fatigue prompts. Review conditional access, restrict device registration to compliant devices, and alert on new passkey or authentication method additions in Entra ID.
• Audit Microsoft Graph activity for unusual enumeration patterns after any suspected identity compromise. The Microsoft blog of 9 September includes hunt queries.
• Patch Cisco Secure Firewall Management Center and Check Point VPN as an urgent action. Both are under active or imminent exploitation, and both sit at the network perimeter.
• Apply September Microsoft Patch Tuesday updates, prioritizing the two exploited zero-days highlighted by CrowdStrike and Cisco Talos, and patch GitLab CVE-2026-85706 and N-able N-central without delay.
• For self-hosted developer infrastructure, review Artifactory and similar registries for the authentication bypass chain reported by BleepingComputer on 11 September.
• Assume AI will be present on both sides of high-volume campaigns. Detection engineering should focus on behavior (identity anomalies, unusual Graph calls, mass exploitation from cloud IP ranges) rather than message artifacts alone.
• Reduce third-party blast radius. Inventory marketing and transactional email providers, review incident response clauses, and ensure customer-facing phishing warnings are ready to deploy quickly when a provider is breached.

Sources

• Microsoft Threat Intel, Passkey-themed social engineering leads to identity and cloud compromise, 2026-09-09, https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/
• BleepingComputer, Passkey-themed phishing attacks lead to Microsoft 365 data theft, 2026-09-11, https://www.bleepingcomputer.com/news/security/passkey-themed-phishing-attacks-lead-to-microsoft-365-data-theft/
• DarkReading, Voice Callers Exploit BYOD to Reach Microsoft 365, Corporate Data, 2026-09-10, https://www.darkreading.com/threat-intelligence/voice-callers-exploit-byod-microsoft-365-corporate-data
• The Record, Florida says motor vehicle data breach tied to credentials stolen from officer's personal device, 2026-09-11, https://therecord.media/florida-shiny-hunters-motor-vehicle
• BleepingComputer, Florida confirms DMV database breached via stolen police account, 2026-09-11, https://www.bleepingcomputer.com/news/security/florida-confirms-dmv-database-breached-via-stolen-police-account/
• Cisco Talos, ClearFake WebDAV infection chain delivers Amatera stealer, ZigCryptoStealer, and NetSupport Manager, 2026-09-08, https://blog.talosintelligence.com/clearfake-webdav-infection-chain/
• Cisco Talos, Active exploitation of Cisco Secure Firewall Management Center vulnerabilities, 2026-09-09, https://blog.talosintelligence.com/fmc-ongoing-exploitation/
• Sophos, Cyclops Blink returns with extended capabilities, 2026-09-11, https://www.sophos.com/en-us/blog/-eye-spy-cyclops-blink-returns-with-extended-capabilities
• BleepingComputer, Dutch NCSC: Critical Check Point VPN flaws exploitation is imminent, 2026-09-12, https://www.bleepingcomputer.com/news/security/dutch-ncsc-critical-check-point-vpn-flaws-exploitation-is-imminent/
• Cisco Talos, Microsoft Patch Tuesday for September 2026, 2026-09-08, https://blog.talosintelligence.com/microsoft-patch-tuesday-for-september-2026/
• CrowdStrike, September 2026 Patch Tuesday: Two Exploited Zero-Days and 113 Critical Vulnerabilities Among 972 CVEs, 2026-09-08, https://www.crowdstrike.com/en-us/blog/patch-tuesday-analysis-september-2026/
• BleepingComputer, GitLab urges users to patch max severity path traversal flaw, 2026-09-11, https://www.bleepingcomputer.com/news/security/gitlab-urges-users-to-patch-max-severity-path-traversal-flaw/
• BleepingComputer, Artifactory flaws chained in attacks deploying backdoor malware, 2026-09-11, https://www.bleepingcomputer.com/news/security/artifactory-flaws-chained-in-attacks-deploying-backdoor-malware/
• Huntress, Critical N-able N-central Vulnerability and Active Exploitation, 2026-09-06, https://www.huntress.com/blog/n-able-vulnerability-exploitation
• The Record, Anthropic caught Russia-linked spies using Claude in hacking operations, 2026-09-11, https://therecord.media/anthropic-russia-hackers-claude
• BleepingComputer, Hackers abused Claude to extract secrets from 1.8M Android apps, 2026-09-11, https://www.bleepingcomputer.com/news/security/hackers-abused-claude-to-extract-secrets-from-18m-android-apps/
• BleepingComputer, AI-powered attack exploited PaperCut flaws to hack 395 organizations, 2026-09-10, https://www.bleepingcomputer.com/news/security/ai-powered-attack-exploited-papercut-flaws-to-hack-395-organizations/
• DarkReading, Threat Actor Generates 1M Personalized Fraud Emails in 3 Days, 2026-09-11, https://www.darkreading.com/cyberattacks-data-breaches/1m-personalized-fraud-emails-3-days
• BleepingComputer, Trezor: 347,000 users targeted in phishing attacks after Brevo breach, 2026-09-11, https://www.bleepingcomputer.com/news/security/trezor-347-000-users-targeted-in-phishing-attacks-after-brevo-breach/
• BleepingComputer, Surfshark VPN says hackers breached internal testing, proxy servers, 2026-09-10, https://www.bleepingcomputer.com/news/security/surfshark-vpn-says-hackers-breached-internal-testing-proxy-servers/
• TechCrunch via Hacker News, Revolut confirms customer data breach through fake government requests, 2026-09-12, https://techcrunch.com/2026/09/12/revolut-confirms-customer-data-breach-through-fake-government-requests/
• DarkReading, Indonesia Hit by Android Banking App-Cloning Campaign, 2026-09-11, https://www.darkreading.com/mobile-security/indonesia-android-banking-app-cloning-campaign
• BleepingComputer, New Android malware encrypts files, steals data, and harasses victims, 2026-09-10, https://www.bleepingcomputer.com/news/security/new-android-malware-encrypts-files-steals-data-and-harasses-victims/