Threat Newsletter September 14,2026
Another week, another pile of reasons to not sleep well. This edition is heavy — edge devices getting popped before patches drop, browsers being turned into persistent backdoors, a zero-click WeChat worm doing its thing via incoming phone calls, and AI throwing thousands of vuln findings at humans who can barely triage them fast enough to matter. We've also got multiple healthcare breaches crossing the million-person mark, a fresh PhaaS kit blowing past MFA at scale, and the first major public signal that someone senior at Anthropic thought things were getting out of hand. Buckle up.
MikroTik Routers Hijacked via Internet-Exposed SSH — No Auth Required
ttackers are actively exploiting MikroTik RouterOS devices with SSH exposed to the internet, gaining full administrative control without needing credentials. CERT Polska, which calls the two-flaw combo "MikroTrick," confirmed attacks dating back to at least September 2. The affected range spans RouterOS 6.0.0–6.49.21 and 7.0.0–7.24.x. Fixed releases are available; CERT also flags signs of compromise like unexpected ops accounts and SSH log entries containing ssh:-2@.
Key Takeaways:
- Patch immediately: 6.49.21, 7.23.5 (long-term), or 7.24.2
- Until patched, disable internet-facing SSH, WWW/WWW-SSL, and bandwidth-test services
- Post-patch: check
/system/device-mode/printfor "Flagged" status and audit for unknown users, scripts, or configs - If compromised, isolate, preserve logs/config, factory reset — don't restore from a potentially dirty backup
The Hacker News
Critical NetScaler Auth Bypass (CVE-2026-19490) Actively Exploited — CISA KEV
CISA added CVE-2026-19490 (CVSS 9.3) to its Known Exploited Vulnerabilities catalog after confirming active exploitation. The flaw affects NetScaler ADC and Gateway appliances configured as SSL VPN, ICA Proxy, CVPN, or RDP Proxy. Citrix patched it on August 19 and Rapid7 called it immediately. A public PoC dropped September 2 and exploitation started the next day. Federal agencies have a 3-day patch window under BOD 26-04.
Key Takeaways:
- Treat this as emergency-priority patching for any NetScaler ADC/Gateway deployment
- Exploitation began within 24 hours of PoC publication — the window is gone
- No details on observed post-exploitation activity yet, but NetScaler boxes are prime lateral movement pivots
- Check Previdian's tracker for ongoing exploitation telemetry
Ionut Arghire
SonicWall SMA 1000 — Another Pair of Zero-Days, Already Exploited (CVE-2026-83548 / CVE-2026-83549)
SonicWall disclosed and patched two new actively exploited zero-days in SMA 1000 appliances: a max-severity pre-auth SSRF and a high-severity OS command injection that Rapid7 confirmed can be chained for unauthenticated RCE. CISA added both to KEV. This is the fifth set of SMA 1000 zero-days added to KEV since mid-December 2025. INC ransomware has already been linked to active exploitation.
Key Takeaways:
- This is a pattern, not a one-off — SonicWall SMA 1000 is a consistent high-value target
- If you can't patch immediately, reimage or redeploy; change all user/admin passwords and reset tokens
- SonicWall did not release IOCs publicly — you have to contact their support to get them
- Check whether your org has SMA 1000 exposed; if yes, assume it until proven otherwise
Matt Kapko
Fortinet Patches Critical Bugs in FortiMonitorOnSight and PAM Chrome Extension
Fortinet released fixes for two critical unauthenticated vulnerabilities: CVE-2026-84390 (CVSS 9.6) lets attackers bypass authentication in FortiMonitorOnSight via forged/reused JWTs, and CVE-2026-84388 (CVSS 9.1) lets attackers proxy browser traffic through the Fortinet Privileged Access Agent Chrome extension if a user visits a malicious site. Neither is reported as exploited in the wild yet, but both are remotely exploitable without credentials.
Key Takeaways:
- Patch FortiPAM to 1.9.1 or 1.8.4, and update the Chrome extension to 8.0.1.123 or above
- The Chrome extension bug is particularly interesting given the browser-as-backdoor theme this week (see PEEP below)
- Monitor your Fortiguard PSIRT feed — Fortinet products continue to be exploitation targets
Ionut Arghire
Dell ObjectScale Critical RCE (CVE-2026-70416, CVSS 10.0) — Unauthenticated
Dell issued DSA-2026-393 covering multiple vulnerabilities in ObjectScale and ECS, topped by a CVSS 10.0 deserialization flaw in ObjectScale before 4.4.0.0 that allows unauthenticated remote code execution. A second critical improper auth bug (CVE-2025-43936, CVSS 8.1) can allow unauthorized access with high attack complexity. ObjectScale hosts enterprise backups, application data, and cloud-native workloads — a full compromise here is bad.
Key Takeaways:
- Upgrade ObjectScale and ECS to 4.4.0.0 or 4.2.0.1 immediately
- Restrict admin and storage-management interfaces to trusted networks in the meantime
- Monitor for abnormal auth activity and unexpected config/permission changes
- The researcher credit goes to WinD39 (Huynh Dinh Vu) for reporting the critical flaw
Abinaya
BlueMoon Exploit Kit: China-Linked APTs Chaining Chrome + Windows Zero-Days at Scale
Proofpoint dropped a significant report: at least four espionage groups — most with suspected China nexus, including TA412 (APT31/Violet Typhoon) — are actively using a new exploit kit named BlueMoon that chains two Chromium V8 zero-days with a Windows ALPC privilege escalation (CVE-2026-85880) to achieve full system compromise. The kit was spotted in the wild August 28, rapidly spread to multiple threat actors within days, and targets NGOs, mining firms, aerospace contractors, and Southeast Asian government entities. AI is suspected to have accelerated exploit development by reverse-engineering open-source Chromium patch commits — the classic "patch gap" playbook.
Key Takeaways:
- Patch Chrome (CVE-2026-85046 fixed Sept 3) and Microsoft Windows (CVE-2026-85880, Patch Tuesday) immediately
- The speed of multi-actor adoption suggests shared tooling infrastructure — this isn't going away
- The "patch gap" between upstream Chromium commits and downstream Chrome releases is now being actively weaponized with AI assistance
- TA412's GemStone browser extension payload conducts surveillance via C2, cookie theft, screenshots, and keyword monitoring
Jessica Lyons
Chrome and Edge Turned Into a Post-Compromise Remote Access Backdoor
SOCRadar published research on PEEP, a post-exploitation browser toolkit masquerading as a "Smart Bookmarks" extension that bypasses Chrome Web Store checks by forging Secure Preferences integrity values. Once deployed (requiring prior admin/code-exec access), it polls a C2 every 30 seconds for commands, exfiltrates cookies/browsing history/session data, and uses a native messaging host (nm_host.exe) to pivot from browser-level access to full OS-level command execution. It appears to be derived from the RedExt red-team framework, with Chinese-language artifacts in the source code.
Key Takeaways:
- PEEP requires prior code execution — look for it as a persistence mechanism after initial compromise, not as initial access
- 34 agents, 10 active sessions, 507 data records were visible on the C2 panel at time of research
- Detect: watch for
ejkndncpkdcjcikfhiamcdehdoegilbjextension ID,nm_host.exe, and PowerShell scripts touching Secure Preferences - Browser extension monitoring is no longer optional — extensions running inside the signed browser process evade most traditional endpoint detections
The Hacker News
Rogue ScreenConnect Clients Spread Four-Stage VBScript Worm to New Hosts
Huntress documented three separate incidents where attackers (via tech support scam, phishing MSI, and fake Geek Squad refund form) planted rogue ScreenConnect clients on victims' machines. Those clients then executed a four-stage VBScript chain (1.vbs through 4.vbs) that profiles the host, checks for EDR products, pulls a payload from Dropbox, decrypts and executes it — and critically, propagates the infection chain to every new host that connects to the backdoored ScreenConnect session. Payloads vary based on host profile: ScreenConnect backdoor, UAC bypass + persistence, or XMRig miner. ConnectWise has advised disabling file transfers as a workaround pending a fix.
Key Takeaways:
- The worm-like spread mechanism is the headline: one infected host can infect every new session that connects
- Immediate mitigation: disable file transfer permissions in ScreenConnect roles for all session groups
- Hunt for
WindowsServiceHost.vbsin AppData, unusualwscript.exe/cscript.exespawns from ScreenConnect processes - Hosts confirmed compromised should be re-imaged from known-good media
The Hacker News
WeChat Zero-Click Worm: Account Takeover via Incoming Calls, No Interaction Required
Researchers at Calif built a proof-of-concept worm that takes over WeChat accounts by exploiting a flaw triggered on incoming calls — no answering required, just receive a call from a compromised contact. The demo showed one Android phone silently take over an iPhone's WeChat, which then called a second Android and took that over too. Tencent patched the server-side trigger in August (versions 8.0.77/8.0.76), but published no CVE or advisory. Notably, Calif used AI to identify the attack surface and write the initial exploit in roughly two days.
Key Takeaways:
- Tencent says the server-side block is live for all users regardless of app version — but update to latest anyway
- No evidence of in-the-wild exploitation, but Tencent's advisory silence is frustrating for defenders
- Full technical details are being held for conference presentation — watch for it
- This is another data point on AI-accelerated exploit development becoming normalized
The Hacker News
THost9 Android RAT: Packed Loader + ADB Worm for Self-Propagation
Dark Atlas published research on THost9 (cluster: Hagaseca), a packed Android RAT that hides its payload using XOR + gzip inside an APK asset, decrypts at runtime, and deploys a second-stage (tc9.dex) with shell execution, file transfers, tunneling, reverse-shell, and modular download capabilities. The standout feature is an ADB worm that scans for internet-exposed Android Debug Bridge services, authenticates using preloaded key material, and self-installs onto reachable devices — potentially reaching 65,025 hosts per target range with 50 parallel workers.
Key Takeaways:
- Any Android device or Redroid container with ADB exposed to the internet is a propagation target
- Immediately audit for public ADB or Redroid exposure — bind to localhost only
- Hunt for the Hagaseca signing certificate and the package name across mobile device management fleets
- Review accessibility service grants — THost9 attempts to abuse these for device control
Alessandro Mascellino
BigBear 2.0 PhaaS: MFA Bypassed at 258 Organizations, 5,000+ M365 Credentials Stolen
CloudSEK gained admin access to the BigBear 2.0 phishing-as-a-service panel and found it had compromised 258 organizations via Evilginx2-based adversary-in-the-middle proxying, netting 5,137 credential records including 474 fully MFA-bypassed authentications, 1,032 plaintext passwords, and 4,148 session cookies. The kit disables FIDO2/WebAuthn at the browser level using custom JavaScript, forcing victims toward weaker auth methods, and uses geo-matched residential proxies across 69 countries to avoid flagging Microsoft's auth systems. At least five affiliate operators are active via Telegram exfil bots.
Key Takeaways:
- Standard MFA (TOTP, SMS) is no longer sufficient against AiTM proxy kits — enforce phishing-resistant FIDO2/passkeys
- Conditional Access policies requiring managed devices significantly raise the bar for these kits
- Reset exposed passwords, revoke active sessions, and force re-auth on high-privileged accounts if you're in the 258
- This is a commercial PhaaS with five active affiliates — expect continued campaigns
Bill Toulas
ClickFix Payloads Hosted on the Blockchain — 5,400+ Hacked Sites Serving It
Netskope documented a campaign leveraging 5,400+ compromised WordPress and PrestaShop sites to deliver ClickFix payloads stored in BNB Smart Chain Testnet smart contracts (EtherHiding technique). Because the payload lives on the blockchain, it's nearly impossible to take down. Victims see a fake CAPTCHA that instructs them to open a Windows Run dialog and paste a PowerShell command. Later campaign variants replaced the ClickFix payload with a WebRTC data-channel stager that establishes an encrypted covert channel without a real handshake.
Key Takeaways:
- Block BSC Testnet RPC endpoints at the network layer — Netskope published the full IOC list on GitHub
- Educate users: no legitimate CAPTCHA asks you to open PowerShell or the Windows Run dialog
- Monitor for non-web UDP traffic associated with WebRTC on endpoints that aren't doing legitimate video calling
- The blockchain-as-C2 model is increasingly being used for resilience — traditional takedown methods won't work here
Bill Toulas
PuzzleMask: Malicious AI Commands Hidden in Plain English to Bypass Security Filters
Check Point Research published findings on PuzzleMask, an AI attack technique that embeds harmful instructions inside normal-looking English prose — no Base64, no emoji encoding, no invisible characters. Lightweight gatekeeper models tasked with fast policy checks miss the hidden payload 100% of the time (23/23 crafted prompts rated safe). Downstream reasoning models with tool access recover and execute the concealed instruction in 94.4% of cases (17/18). The technique exploits the capability gap between fast screening models and capable agentic models.
Key Takeaways:
- Input filtering alone is not a defense against this class of attack — you must monitor model outputs and tool calls
- Paraphrasing untrusted content before passing it to agentic models can destroy the hidden payload structure
- Require human approval for high-impact agentic actions (file writes, outbound data, command execution)
- This is a direct prompt injection risk for any pipeline that processes untrusted documents, emails, or web content
Tushar Subhra Dutta
Mathspace Data Breach: 1.07 Million Students, Staff, and Parents Affected
Australian math learning platform Mathspace disclosed that attackers exploited a vulnerability in its self-hosted Metabase internal reporting instance, gaining admin access without authentication. The breach affected 1,079,819 individuals in Australia and New Zealand, with data including names, contact info, and email addresses. No passwords, academic records, or SSO credentials were taken. ShinyHunters is linked to a wider campaign targeting Metabase installations across multiple companies, including Framework, Tally, ShipMonk/Trezor, and others.
Key Takeaways:
- ShinyHunters is running a systematic Metabase exploitation campaign — if you run a self-hosted Metabase instance, audit it now
- The Metabase SQL injection zero-day is the entry point — patch and rotate admin credentials immediately
- The breach sat undetected from August 10 to September 3 — expect attackers to dwell before acting on stolen education data
- Warn affected users to watch for spear-phishing using their school email domains as targeting context
Sergiu Gatlan
AdaptHealth Data Breach: 4.1 Million Patients' Health and Insurance Data Stolen
Home medical equipment provider AdaptHealth confirmed a June 2026 breach affecting 4,115,802 individuals across its 680+ US facilities. A threat actor used social engineering to compromise a third-party contractor session and accessed cloud-based patient management and document storage systems, exfiltrating names, contact info, health and insurance data, and a password file associated with insurance billing. Social Security numbers and financial data were reportedly not affected. HHS was notified August 14.
Key Takeaways:
- Social engineering of third-party contractors remains one of the most effective initial access vectors in healthcare
- Session hijacking via contractor credentials bypasses most perimeter controls — enforce MFA and session binding for vendors
- This is reportable under HIPAA — affected patients should be watching for medical fraud and identity theft
- Healthcare orgs: audit contractor access scopes and review cloud app session logging immediately
Ionut Arghire
ShinyHunters Claims Breach of Florida DMV Database
ShinyHunters claimed responsibility for breaching Florida's DMV (DAVID) database. Florida confirmed the incident was tied to credentials stolen from a law enforcement officer's personal device. The scale and specific data types exposed are still being assessed, but DMV databases typically contain driver's license data, vehicle registration records, and PII for millions of residents.
Key Takeaways:
- Law enforcement personal device hygiene is now a public infrastructure security issue
- Stolen credentials from personal devices bypassing work authentication controls is a systemic risk that MDM and BYOD policies need to address
- Watch for the stolen data appearing in criminal forums and being used for targeted fraud campaigns
- Florida residents: monitor for suspicious DMV-themed phishing or vehicle fraud
Lawrence Abrams
UK Account-Hack Losses Up 417%: New Reporting System Reveals Hidden Scale
City of London Police's first annual Report Fraud assessment showed victims reported £6.3 million in losses to account hacks in 2025-26, up from £1.2 million — a 417% increase. The dramatic jump is largely attributed to the January launch of Report Fraud replacing the discredited Action Fraud system, which had long been suppressing victim counts. 92% of the financial loss reports came in the second half of the year, directly overlapping the transition. Meanwhile, ransomware reporting actually fell 25%, which police explicitly warned may reflect underreporting, not fewer attacks.
Key Takeaways:
- The numbers aren't as alarming as they look — this is mostly a data collection improvement, not a true 5x increase in attacks
- The UK ransomware underreporting problem is real and acknowledged — mandatory ransomware reporting legislation is stalled
- SMBs accounted for 62% of organizational cybercrime cases — they continue to be disproportionately targeted
- Fraud now accounts for roughly 40% of all crime in England and Wales, and two-thirds is cyber-enabled
Alexander Martin
Anthropic Researcher Quits Over Out-of-Control AI Fears
On September 9, Jacob Coxon — a pretraining researcher who worked at both OpenAI and Anthropic — publicly quit and posted a warning on X, saying both companies are "racing straight to self-improving superintelligence and gambling with our lives." He joined Anthropic specifically for its safety reputation, and left saying neither lab was living up to it.
What made the post land harder than usual: Evan Hubinger, Anthropic's own head of alignment stress testing, publicly agreed — saying he puts the odds of AI killing all humans within the decade at greater than 10%. Anthropic hasn't commented. The resignation has since drawn Congressional attention, with the Ban Artificial Superintelligence Act introduced shortly after.
Key Takeaways:
- Coxon worked inside both major labs — his claim that private conversations are scarier than public ones carries real weight
- A sitting senior Anthropic researcher publicly putting extinction risk above 10% is unprecedented candor from inside a frontier lab
- The core fear isn't current models — it's the trajectory toward self-improving systems that operate beyond human control, for which alignment has no solved approach yet
- Anthropic was founded as the "safety-first" alternative to OpenAI; Coxon quit with the exact same criticism — the distinction is blurring under commercial pressure
- For practitioners: AI-accelerated offensive capability (exploit kits, zero-click exploits, PhaaS) isn't waiting for alignment to be figured out
