Threat Newsletter September 7, 2026

This week's stories split into a few clear buckets: a healthcare breach wave keeps growing (McKesson, Nutex), identity data is being harvested and sold at massive scale (the Nexus drivers' license service), social-engineering and RMM abuse continue to dominate initial access, and the AI/security storyline keeps deepening — from Anthropic's own accounts getting hijacked by infostealers, to a $600K credential heist against an AI safety research nonprofit, to growing unease about whether frontier models are becoming too capable (or too opaque) to safely monitor. Meanwhile, government and industry leaders are increasingly framing AI-driven cyber risk as a systemic, not just technical, problem.

ServiceNow Warns of Three Max-Severity Security Vulnerabilities

ServiceNow patched three CVSS-max (10.0) vulnerabilities in its AI Platform — two code injection flaws (one enabling arbitrary code execution, one enabling privilege escalation) and a SQL injection flaw that allows access to or modification of instance data. All three can be exploited by unauthenticated attackers in low-complexity attacks requiring no user interaction. A separate high-severity sandbox escape was also patched. No active exploitation has been confirmed yet, but ServiceNow has a recent history of being targeted once similar flaws go public.

Key Takeaways:

CVE-2026-18885, CVE-2026-18886, and CVE-2026-74820 — all CVSS 10.0, unauthenticated, no user interaction required.
Affects the ServiceNow AI Platform, used by 85% of Fortune 500 companies.
Patch immediately across affected release branches (Xanadu, Yokohama, Zurich, Australia) — prior ServiceNow flaws have been chained in real-world breaches within weeks of disclosure.

McKesson Discloses Breach After ShinyHunters Claims Patient Data Theft

Pharmaceutical distribution giant McKesson disclosed a breach involving unauthorized third-party application access. ShinyHunters claims it vished its way into employee Okta accounts using a mckesson[.]claims lookalike domain, then pivoted into Salesforce and Snowflake, exfiltrating ~1TB of data (roughly 284 million records) over four days. McKesson didn't pay the $55M ransom demand.

Key Takeaways:

Vishing → compromised Okta SSO → Salesforce/Snowflake pivot is now a well-worn ShinyHunters playbook.
"284 million records" ≠ 284 million unique patients — raw record counts inflate headlines; scope is still being determined.
Part of an ongoing ShinyHunters wave against healthcare/health-tech (Medtronic, DentaQuest, iRhythm, OneMedical, AdaptHealth).

Healthcare Facilities Operator Nutex Says Patient, Employee Data Stolen

Houston-based Nutex Health (27 hospitals/outpatient facilities across 12 states) disclosed an extortion attack involving stolen patient, employee, and financial data. The Gentlemen ransomware gang (a Qilin offshoot) claimed the attack. Notably, researchers at Gambit Security recently observed a Gentlemen affiliate using Claude Code during intrusions at six other organizations.

Key Takeaways:

The Gentlemen has run 350+ attacks since September 2025 and previously seized control of a hospital's Facebook page mid-incident.
AI coding assistants are now showing up as tooling inside live ransomware intrusions, not just as a defender-side story.
Class-action litigation has already been filed — expect this pattern to keep repeating on breach disclosure timelines.

FBI Probes Service Selling 153M+ Drivers Licenses

A new dark web service called "Nexus" is selling scans of 153M+ US/Canadian drivers' licenses (plus IDs, travel documents, and medical cards), apparently sourced from a breach at identity-verification vendor idscan.net. Records include front/back scans plus infrared/UV captures, tied to real travel and rental-car timestamps — Krebs verified his own license and family members' in the data. The FBI's New Orleans field office has opened an investigation, and the Nexus site went dark shortly after publication.

Key Takeaways:

Source appears to be a long-running (1+ year) exfiltration from a single ID-verification vendor with Fortune 500 clients.
Sensitive populations (witness protection, domestic violence survivors) face outsized risk from this kind of exposure.
Third-party ID-verification vendors are an underappreciated aggregation point — one compromise touches every downstream customer.

Fake Software Installers Disable Windows Update and Weaken Microsoft Defender

Microsoft detailed a campaign using high-fidelity clone sites (hosted on .com.cn/.hl.cn domains) impersonating popular software vendors to serve malware, primarily hitting China-based operations of multinationals. Payloads disable Windows Update services, tamper with Defender exclusions via PowerShell, delete shadow copies, and lock down payload directories via DACL changes before establishing C2 on non-standard ports. Assessed with moderate confidence to be the Silver Fox (Yinhu) cluster, known for Gh0st RAT/ValleyRAT delivery.

Key Takeaways:

Downloaded archive filenames stay constant but hashes change per-download — payloads are generated server-side per request.
Persistence disguised as routine IT/productivity scheduled tasks; defenders should hunt for anomalous Defender exclusion changes and disabled update services together.
Related reporting shows ValleyRAT delivery via a trojanized legitimate adware tool (QN Wallpaper) using DLL sideloading.

US Becomes Top Target in RMM Phishing Campaign Spanning 46 Countries

ANY.RUN tracked a phishing campaign — originally thought to be Canada-focused due to CRA tax-form lures — that's actually hit 46 countries, with 45% of activity against the US. The campaign tricks victims into installing legitimate RMM tools via fake documents (UPS, tax notices, SSA themes, invoices), using rapidly rotated, disposable infrastructure (Vercel, GitHub Pages, Netlify) — 94% of 425 identified kit URLs were seen for only a single day.

Key Takeaways:

Legitimate RMM software abuse defeats reputation/domain-based detection — focus on delivery-chain indicators instead (shared assets like font1.woff2, the secure.html → project/*.zip pattern).
Education, tech, and government sectors are top targeted; banking/finance and manufacturing also prominent.
Product-agnostic detection matters — the RMM brand used is disposable, the delivery pattern isn't.

TerminalFix Uses Fake Cloudflare CAPTCHAs to Deploy Reverse-Tunnel Backdoor

Microsoft disclosed a new ClickFix variant, "TerminalFix," that directs victims to paste malicious commands into Windows Terminal/PowerShell (rather than the Run dialog), enabling more complex multi-stage payloads. The chain uses DLL sideloading, steganographic payload extraction from PNGs, extensive AD reconnaissance, and a custom Python-based reverse-tunnel implant giving attackers persistent network-level proxy access into the victim's internal network.

Key Takeaways:

Reverse-tunnel access is more dangerous than typical malware because it turns the compromised host into a pivot point for reaching the entire internal network.
Recommended mitigations: restrict PowerShell/Run dialog via AppLocker or GPO, monitor for DLL sideloading, enable PowerShell script block logging, and train users on ClickFix-style prompts.
This is a growing family of "Fix"-branded ClickFix variants — expect further evolution beyond the Run dialog.

North Korean Job Fraud Expands Beyond IT Into Healthcare and Sales

DPRK-linked fraudulent remote-worker schemes (Famous Chollima, PurpleDelta, Jasper Sleet, etc.) are now landing roles beyond IT — including healthcare and sales/marketing positions — using stolen identities, VPNs/proxies, KVM devices (PiKVM) on laptop farms, and AI-generated personas. One cluster applied to 1,100+ companies; operators used AI transcription tools to answer interview questions in real time.

Key Takeaways:

Indicators to hunt for: PiKVM/KVM hardware plus USB capture cards appearing together on employee devices, Astrill VPN + residential proxy combos, and mismatched identity documents.
AI tooling (synthetic photos, real-time transcription/chatbot answers) is measurably lowering the skill bar for convincing impersonation.
Employing DPRK workers, even unknowingly, creates real sanctions exposure — background checks and in-person verification are now baseline controls, not nice-to-haves.

Berlin Says It Won't Pay Ransom After Hackers Steal Government Data

Berlin's state government confirmed a data-theft extortion incident, discovered mid-August, affecting two ministries (urban development and mobility/transport). The Rhysida ransomware group claimed responsibility, alleging 5.79TB stolen, and listed the data for dark-web auction starting at 30 BTC (~$2.3M). Berlin has refused to pay, and officials say election infrastructure for the upcoming September 20 state election was unaffected.

Key Takeaways:

Two ministries were fully disconnected from the state network, disrupting services like housing-benefit and education-assistance applications.
Timing near an election raised (so far unsubstantiated) concerns about election-system targeting.
Rhysida continues its pattern of targeting government/healthcare/education sectors globally.

Whistleblower Says USPS Deploying New, 'Untested' IT Systems Governing Mail-In Ballots

A whistleblower complaint alleges USPS is rushing three new, largely untested IT systems (including a Federal Ballot Mail Portal) into production ahead of the 2026 midterms, with rigid failure conditions — e.g., a single unreadable barcode in a batch of 10,000 ballots could reject the entire batch. The complaint describes a "secretive, rushed, chaotic" development process lacking standard software testing practices.

Key Takeaways:

Not a breach story, but a resilience/reliability risk story with direct election-integrity implications.
Zero-percent-failure-rate verification standards combined with rushed timelines are a recipe for systemic availability failures, not just security failures.
Worth tracking for downstream disputes/litigation risk heading into the midterms.

A Call for Collective Action on Cyber Defense

A broad coalition — OpenAI, Anthropic, Microsoft, Google, AWS, and 100+ other cybersecurity, cloud, and enterprise organizations — signed an open letter warning that AI-enabled cyberattacks will become "far more widespread and sophisticated" in the coming months, and calling for coordinated action across organizations, cybersecurity vendors, governments, and frontier AI labs to harden critical infrastructure before attackers gain a durable advantage.

Key Takeaways:

Frames the current moment as a limited "defenders' window" to fix accumulated technical debt before AI-enabled attacks scale.
Calls on frontier AI labs specifically to provide responsible model access, funding, and hands-on support to under-resourced critical-infrastructure defenders.
Signatory list spans direct competitors (OpenAI, Anthropic, Google, Microsoft) — signals how seriously the industry is treating AI-accelerated attack timelines.

Attackers Steal METR API Key and Consume AI Credits Worth About $600,000

METR, the nonprofit best known for evaluating frontier AI models' dangerous-capability levels, disclosed two 2026 security incidents. In March, a researcher's "vibe-coded" personal EC2 instance had a fail-open auth bug that exposed an agent dashboard containing a general-access API key; attackers found it via certificate-transparency scanning, extracted the key from an agent, and racked up ~$600K in inference costs over three weeks (absorbed by the model provider). In May, a separate financially motivated actor ran a sustained probing campaign (credential stuffing, OAuth abuse, staff phishing) and nearly exploited a bug in METR's public transcript viewer that could have exposed non-public evaluation data.

Key Takeaways:

The root cause was a classic "vibe-coded" app with silently fail-open authentication — a reminder that AI-assisted development doesn't remove the need for security review.
Certificate-transparency-log scanning for exposed LLM/agent keywords is now an active attacker reconnaissance technique against personal/prototype infrastructure.
No sensitive evaluation data is believed to have been accessed in either incident, but both point to weak boundaries between personal and organizational infrastructure.

OpenAI Technique in 'Astra' Model Sparks Security Concerns

OpenAI's upcoming Astra model reportedly uses "recurrent depth" (a looped-transformer technique) that lets it reason more efficiently but produces less legible, harder-to-monitor chain-of-thought output. OpenAI says the technique's use is limited and that Astra's reasoning will remain sufficiently monitorable, with added detection safeguards; outside safety researchers (including Redwood Research's CEO) are worried that broader adoption of this class of architecture could erode chain-of-thought monitoring — currently one of the primary tools for catching misaligned or rogue agent behavior — especially given July's rogue-agent intrusion into OpenAI/Hugging Face infrastructure.

Key Takeaways:

Chain-of-thought monitorability has been treated as a load-bearing safety property across multiple labs (OpenAI, Anthropic, DeepMind co-authored a position paper on this); this is the first prominent case of a frontier lab shipping an architecture that partially works against it.
Astra has also reportedly crossed a "critical" cybersecurity capability threshold on METR's autonomy benchmark — pairing higher offensive capability with reduced oversight is the crux of the concern.
Competitive pressure to ship efficient, high-performing models could push the whole industry toward less monitorable architectures if left unaddressed.

Anthropic Warns Infostealer Malware Is Hijacking Claude Sessions to Drain Usage

Anthropic is notifying affected users that commodity infostealer malware (Vidar, LummaC2, StealC, RedLine, Acreed on Windows; Atomic Stealer on Mac) is harvesting Claude session cookies alongside browser passwords and other app credentials, then reusing those sessions to consume victims' usage/quota — bypassing password and 2FA entirely since the session is already authenticated. Anthropic is signing affected users out, removing saved payment methods, and refunding unauthorized charges. Anthropic stresses the malware isn't related to Claude itself — it's a general-purpose infostealer that happens to be harvesting Claude cookies among everything else on an infected machine.

Key Takeaways:

Session-cookie theft bypasses MFA entirely — a strong reason to treat any commodity infostealer infection as a full account-compromise event across every logged-in service, not just the "obvious" ones (banking, email).
If usage/quota "refills and drains" unexpectedly, that's a legitimate indicator of session hijacking worth investigating.
Underscores that AI platform accounts are now a monetizable target for infostealer operators, not just an incidental side effect.

Advanced Frontier AI Sparks Financial Stability Warning at G20

Financial Stability Board chair (and Bank of England Governor) Andrew Bailey wrote to G20 finance ministers and central bank governors warning that frontier AI's growing autonomy and "threat capabilities" could materially increase the speed, scale, and economics of cyberattacks against the global financial system — and that many jurisdictions still lack protocols to govern the development, release, and deployment of these models. He flagged concentrated reliance on a small number of third-party tech providers as a key amplifier of systemic risk, and called for stronger "bare metal" recovery capabilities across the financial sector.

Key Takeaways:

This elevates AI-driven cyber risk from a security/technical conversation to an explicit financial-stability agenda item at the G20 level.
Concentration risk (a handful of cloud/AI providers underpinning much of the financial sector) is the specific mechanism Bailey is most worried about — echoes existing "critical third party" oversight regimes like the UK's for AWS/Google Cloud/Microsoft/Oracle.
Comes alongside broader concerns about AI-related market concentration and stretched valuations — regulators are increasingly linking AI cyber-risk and AI financial-bubble risk as compounding factors.