IAM & Security Weekly Briefing

1. Executive Summary (TL;DR)

Snowflake extortionist Connor Riley Moucka pleaded guilty, closing a landmark identity-enabled breach affecting 165+ organizations and 100M+ people.
Device code phishing kits like Kali365 and a 1,500% surge in device code phishing show attackers weaponizing legitimate login flows to bypass MFA.
Active exploitation of unauthenticated flaws in Metabase, TeamCity, Langflow, LoadMaster, and N-central drove multiple CISA KEV additions.
Windows Hello for Business keys can be abused by malware for persistent Entra ID access, exposing limits of phishing-resistant MFA on compromised devices.
AI agents are a fast-growing attack surface: Atlassian Rovo, Claude Code, Gemini CLI, AWS/Google/Vercel agent infrastructure, and sandbox escapes all made headlines.
Vishing groups like UNC6671 are targeting employees' personal phones to steal SaaS data, bypassing corporate email security and MFA defenses.
Supply chain compromise continued via trojanized installers (TrueConf, QuickFox) and nearly 800 malicious npm packages.

2. Top IAM & Security News

Canadian Man Pleads Guilty in Snowflake Extortions

Source: KrebsOnSecurity
Link: KrebsOnSecurity
Date: 2026-08-06
What happened: Connor Riley Moucka pleaded guilty to hacking and extorting more than 165 Snowflake customer organizations and stealing call/text records of more than 100 million AT&T customers.
Why it matters: The case underscores how stolen cloud credentials and poor identity hygiene at scale enabled mass extortion and one of the most consequential cybercrime campaigns of 2024.

Malware Can Abuse Windows Hello for Business Keys for Persistent Entra ID Access

Source: The Hacker News
Link: The Hacker News
Date: 2026-08-07
What happened: Researcher Dirk-jan Mollema demonstrated that malware in a signed-in Windows session can silently use the victim's Windows Hello for Business key to authenticate to Entra ID, register a device, obtain a Primary Refresh Token, and add authentication methods.
Why it matters: Phishing-resistant MFA keys can become a persistence vector once a device is compromised; IAM teams need stronger device trust, session monitoring, and token-loss detection.

Kali365 Weaponizes Microsoft Authentication Against US Companies

Source: The Hacker News
Link: The Hacker News
Date: 2026-08-05
What happened: The Kali365 phishing kit uses attacker-controlled device codes that victims approve on Microsoft's real authentication page, yielding access and refresh tokens for email, documents, and cloud resources.
Why it matters: Device code flows abuse legitimate Microsoft login UI to bypass traditional phishing defenses and MFA, requiring conditional access restrictions on device-code authentication.

Microsoft 365 AitM Phishing Hijacks Accounts to Collect Payroll and Finance Emails

Source: The Hacker News
Link: The Hacker News
Date: 2026-08-07
What happened: A widespread adversary-in-the-middle (AitM) email campaign takes over Microsoft 365 accounts to identify finance personnel and gather payroll and financial email, using residential proxies to disguise malicious sign-ins.
Why it matters: AitM phishing defeats standard MFA by relaying session tokens, so organizations need phishing-resistant MFA (FIDO2) and anomaly detection on sign-in traffic.

UNC6671 Vishing Attacks Target Personal Phones to Steal SaaS Data

Source: The Hacker News
Link: The Hacker News
Date: 2026-08-07
What happened: Extortion group UNC6671 is running voice-phishing campaigns that pose as IT help desk staff conducting urgent security migrations, often contacting employees on their personal phones, to compromise financial services, private equity, and professional services firms.
Why it matters: Attackers are bypassing corporate phishing defenses by going after employees' personal devices, making out-of-band identity verification and help desk abuse prevention critical.

Metabase Zero-Day Exploited in the Wild Allows Admin Access Without Authentication

Source: The Hacker News
Link: The Hacker News
Date: 2026-08-08
What happened: A CVSS 10.0 SQL injection flaw in Metabase (no CVE identifier) was exploited as a zero-day, allowing unauthenticated attackers to inject arbitrary SQL and gain admin access; Framework and Tally confirmed data-theft impact.
Why it matters: Unauthenticated admin takeover of business intelligence instances enables direct customer data theft, and unpatched Metabase deployments should be treated as compromised.

Swiss Government SharePoint Breach Compromised 200 Accounts

Source: BleepingComputer
Link: BleepingComputer
Date: 2026-08-06
What happened: Switzerland's federal IT office said hackers exploited vulnerabilities in its Microsoft SharePoint servers and compromised approximately 200 accounts.
Why it matters: On-premises Microsoft collaboration platforms remain prime targets, and compromised accounts can quickly become a beachhead for broader government data access.

Levi Strauss & Co. Says Hackers Stole Corporate Data in Cyberattack

Source: BleepingComputer
Link: BleepingComputer
Date: 2026-08-07
What happened: Levi Strauss & Co. said hackers used social engineering on three employees to gain access to and steal corporate data from their machines.
Why it matters: The incident highlights that targeted social engineering against individual employees remains an effective way to bypass perimeter controls and steal corporate data.

3. AI, Identity & Emerging Tech

Critical One-Click Vulnerability in Atlassian's Rovo AI Exposed Enterprise Data

Source: SecurityWeek
Link: SecurityWeek
Date: 2026-08-08
What happened: The "RovoBlast" attack method identified by Varonis could be exploited with one click to steal Confluence, Jira, and SharePoint data through Atlassian's Rovo AI assistant; The Hacker News separately reported attacker-controlled instructions can make Rovo exfiltrate data a signed-in user can access.
Why it matters: AI assistants that sit on top of enterprise collaboration data are a new and dangerous data-exfiltration channel requiring strict access scoping and egress controls.

Claude Code and Gemini CLI Flaws Let a GitHub Issue Reach CI Workflow Secrets

Source: The Hacker News
Link: The Hacker News
Date: 2026-08-07
What happened: Novee Security showed that a GitHub issue from an account with no repository privileges could execute code on CI runners behind Anthropic's and Google's coding-agent repositories, and hijack the next agent run on OpenAI's.
Why it matters: AI coding agents inherit powerful CI/CD credentials; default configurations can let untrusted input reach secrets, so agent workflows need least privilege and human approval gates.

AWS, Google, and Vercel Agent Flaws Let Attackers Trigger Tools Without Running the Model

Source: The Hacker News
Link: The Hacker News
Date: 2026-08-06
What happened: Flaws in agent infrastructure from AWS, Google, and Vercel allowed untrusted or forged instructions to reach agent tools without any model authorization; in several paths the model never ran, bypassing system prompts and guardrails.
Why it matters: Tool-authorization gaps mean AI agent guardrails can be silently skipped; organizations must instrument agent tool calls independently of model behavior.

AI Agent Sandbox Escapes Reported at OpenAI, Anthropic, and Meta

Source: Dark Reading
Link: Dark Reading
Date: 2026-08-06
What happened: Within three weeks, OpenAI, Anthropic, and Meta each disclosed AI agent sandbox escape events affecting real organizations.
Why it matters: Sandbox escapes are no longer theoretical; AI agents handling sensitive data must run in isolation with monitored egress and kill-switch capabilities.

Paperclip AI Flaws Let Attackers Run Host Commands via Malicious Agent Imports

Source: The Hacker News
Link: The Hacker News
Date: 2026-08-05
What happened: Two flaws in the open-source Paperclip AI agent control plane allow command execution on a server or developer machine by importing and starting a malicious agent; a third flaw exposes sensitive data via API routes.
Why it matters: Open-source agent orchestration platforms are becoming a supply chain and remote-code-execution risk, and agent imports must be treated like untrusted code.

AI Recommendation Poisoning: How "Ask AI" Buttons Silently Alter LLM Memory

Source: The Hacker News
Link: The Hacker News
Date: 2026-08-06
What happened: Researchers documented production websites embedding hidden prompt-injection payloads inside "Ask AI" buttons, abusing pre-filled deep links to poison AI assistant memory without malware or stolen credentials.
Why it matters: Prompt injection is spreading through standard web features, meaning AI assistants need output/input filtering and protections against untrusted deep-link content.

Researcher Claims Control of ChatGPT Secure Sandbox

Source: Dark Reading
Link: Dark Reading
Date: 2026-08-06
What happened: A researcher demonstrated a proof-of-concept attack chain at Black Hat USA 2026 that provided C2-style influence over ChatGPT's isolated sandbox.
Why it matters: Even the most heavily defended AI sandboxes are being probed successfully, reinforcing that AI runtimes are a critical new trust boundary.

4. Cyber Threats & Attack Trends

New CSS Attacks Can Break Webmail Defenses to Steal Passwords and Tokens

Source: The Hacker News
Link: The Hacker News
Date: 2026-08-08
What happened: PortSwigger research shows email content can escape its message boundary and interfere with webmail interfaces across Outlook, Gmail, Fastmail, Proton Mail, Yahoo Mail, and AOL Mail, enabling password capture, token leaks, and takeover of third-party accounts.
Why it matters: Email is a core identity channel; CSS-based attacks can harvest credentials and session tokens from webmail without traditional phishing lures.

ClickFix Attack Pushes macOS Infostealer for Crypto Theft Attacks

Source: The Hacker News
Link: The Hacker News
Date: 2026-08-07
What happened: ClickFix-style attacks deliver a Go-based macOS malware that steals cryptocurrency assets, browser-stored passwords, Apple iCloud Keychain data, and cached credentials; operators use browser fingerprinting across 250+ domains to hide lures from crawlers.
Why it matters: Credential theft is expanding to Apple Keychain and crypto wallets on macOS, and ClickFix social engineering bypasses traditional user-awareness training.

Nearly 800 Malicious npm Packages Deliver Cross-Platform RAT and Infostealer

Source: The Hacker News
Link: The Hacker News
Date: 2026-08-07
What happened: A campaign published nearly 800 malicious packages to the npm registry using AI-generated typo-squatted names, all delivering a cross-platform RAT and infostealer payload for Windows, Mac, and Linux.
Why it matters: Malicious open-source packages are a direct avenue into developer machines and CI pipelines, where elevated permissions and stored credentials make impact severe.

QuickFox Supply Chain Attack Delivers FDMTP Backdoor via Trojanized Windows Installer

Source: The Hacker News
Link: The Hacker News
Date: 2026-08-05
What happened: Fortinet disclosed a long-standing supply chain attack on the QuickFox VPN tool, ongoing since at least August 2025, in which a trojanized installer delivers the FDMTP backdoor.
Why it matters: Trusted software installers remain an effective distribution channel for backdoors, reinforcing the need for binary integrity verification and software inventory controls.

Leaked n8n API Tokens Exposed Live Instances to Credential Theft

Source: The Hacker News
Link: The Hacker News
Date: 2026-08-05
What happened: GitGuardian found 321 live n8n instances accepting API tokens exposed in public GitHub commits and demonstrated four ways attackers could use them to reach sensitive data and downstream credentials without any software vulnerability.
Why it matters: Leaked non-human identity (API) tokens in public repositories are a systemic risk; secret scanning, token rotation, and scoped short-lived credentials are essential.

Attackers Exploit N-able Patch Bypass Flaw on RMM Servers

Source: The Hacker News
Link: The Hacker News
Date: 2026-08-08
What happened: N-able issued a fresh round of hotfixes for N-central after attackers began exploiting a new auth bypass vector (CVE-2026-18577) that grants administrator access, with ongoing exploitation observed on managed systems.
Why it matters: RMM tools are high-value targets because admin compromise of N-central can cascade into full control of every managed endpoint.

5. Product Updates & Vendor News

CISA Flags Langflow RCE, Tomcat, and N-central Flaws as Actively Exploited

Source: The Hacker News
Link: The Hacker News
Date: 2026-08-05
What happened: CISA added three flaws to its KEV catalog including CVE-2026-9198 (Langflow code injection, CVSS 9.8) allowing unauthenticated full remote code execution, plus actively exploited Tomcat and N-central vulnerabilities.
Why it matters: AI application frameworks (Langflow) are now joining traditional infrastructure on the actively exploited list, expanding the patch priority set for IAM and security teams.

Progress Kemp LoadMaster Flaw Hits CISA KEV After 792 Reported Exploit Attempts

Source: The Hacker News
Link: The Hacker News
Date: 2026-08-08
What happened: CISA added CVE-2026-8037 (CVSS 9.6), a command injection flaw in Progress Kemp LoadMaster, to the KEV catalog after 792 reported exploit attempts.
Why it matters: Load balancers sit in front of identity and application infrastructure; command injection here can enable credential harvesting or full network compromise.

CISA Flags TeamCity CVE-2026-63077 RCE Flaw Under Active Exploitation

Source: The Hacker News
Link: The Hacker News
Date: 2026-08-06
What happened: CISA added CVE-2026-63077 (CVSS 9.8), an unauthenticated deserialization flaw in on-premise JetBrains TeamCity, to the KEV catalog following active exploitation.
Why it matters: TeamCity servers hold CI/CD credentials and source code; unauthenticated RCE there is a direct path to software supply chain compromise.

Veeam, Terraform MCP, Django Patch Critical Flaws, Led by CVSS 10.0 Cross-Tenant Bug

Source: The Hacker News
Link: The Hacker News
Date: 2026-08-05
What happened: HashiCorp, Veeam, and Django patched 11 vulnerabilities, including an unauthenticated Veeam console flaw that hands over managed agent credentials (CVSS 9.5) and a cross-tenant Terraform MCP Server flaw that lets one user's Terraform token be reused by later users.
Why it matters: Cross-tenant token reuse and exposed agent credentials directly threaten cloud identity and infrastructure-as-code environments, requiring urgent patching and token invalidation.

Cisco Patches 12 SD-WAN and IOS XE Flaws, Including Three 9.9 CVSS Score Bugs

Source: The Hacker News
Link: The Hacker News
Date: 2026-08-06
What happened: Cisco released updates addressing multiple critical vulnerabilities in Catalyst SD-WAN and IOS XE Software, including three rated CVSS 9.9, found during an internal security review.
Why it matters: SD-WAN and IOS XE devices are network trust anchors; patching these flaws is critical before attackers chain them into network-level access.

New WordPress Pre-Auth XSS Could Lead to PHP Code Execution

Source: The Hacker News
Link: The Hacker News
Date: 2026-08-07
What happened: WordPress fixed CVE-2026-64638 (CVSS 8.9), a pre-authentication reflected XSS in the login screen that can be chained into server-side PHP code execution when a logged-in administrator clicks an attacker-controlled page.
Why it matters: The WordPress login screen is a universal identity entry point; pre-auth XSS there puts admin accounts and site integrity at risk.

6. Practical Security Takeaways

Patch actively exploited flaws immediately: Prioritize Metabase, TeamCity (CVE-2026-63077), Langflow (CVE-2026-9198), Kemp LoadMaster (CVE-2026-8037), N-central (CVE-2026-18577), WordPress (CVE-2026-64638), and Cisco SD-WAN/IOS XE within days, not weeks.
Restrict device-code authentication flows: Apply conditional access policies that block or tightly scope device code auth for Microsoft 365, and monitor for anomalous device-code approvals.
Deploy phishing-resistant MFA (FIDO2/WebAuthn) for privileged and finance workflows: AitM relays defeat one-time codes and push MFA.
Treat Windows Hello for Business keys as a persistence risk on compromised devices: Monitor for PRT requests, unexpected device registrations, and new authentication methods added from managed endpoints.
Harden help desk and identity-recovery processes: UNC6671-style vishing targets personal phones; require out-of-band verification for password resets, MFA changes, and "urgent security migrations."
Audit non-human identities and leaked secrets: Scan public code repositories for API tokens (e.g., n8n, Terraform MCP), rotate exposed credentials immediately, and enforce scoped, short-lived tokens.
Apply least privilege to AI agents and CI runners: Review default agent configurations from Claude Code, Gemini CLI, AWS, Google, and Vercel; require human approval for tool calls that access secrets or external systems.
Restrict AI assistant access to enterprise data: Scope Atlassian Rovo and similar AI tools to the minimum data needed, and monitor for anomalous bulk retrieval or external exfiltration.
Verify software supply chain integrity: Check hashes/signatures for installers (QuickFox, TrueConf) and scan npm/Open VSX dependencies for typosquatted or newly published packages.
Treat webmail as a credential attack surface: Test webmail configurations for CSS boundary escapes and consider stripping risky CSS/content from inbound email.

7. Trends to Watch

Device code phishing and vishing are rising sharply because they bypass MFA and leave limited forensic evidence — expect more identity-centric campaigns built on these techniques.
AI agents are becoming a first-class identity surface, with sandbox escapes, prompt injection, and tool-authorization gaps forcing new governance models.
CISA KEV is expanding beyond traditional infrastructure into AI frameworks (Langflow) and RMM tools (N-central), signaling that patch prioritization must broaden.
Supply chain attacks are shifting to developer trust boundaries — npm registries, VS Code extensions, MCP servers, and CI coding agents.
Non-human identities (API tokens, service accounts, agent credentials) are emerging as a primary target for data theft, demanding dedicated secrets management and rotation programs.

Sources

Canadian Man Pleads Guilty in Snowflake Extortions — https://krebsonsecurity.com/2026/08/canadian-man-pleads-guilty-in-snowflake-extortions/
Malware Can Abuse Windows Hello for Business Keys for Persistent Entra ID Access — https://thehackernews.com/2026/08/malware-can-abuse-windows-hello-for.html
Kali365 Weaponizes Microsoft Authentication Against US Companies: New Enterprise Risk — https://thehackernews.com/2026/08/kali365-weaponizes-microsoft.html
Microsoft 365 AitM Phishing Hijacks Accounts to Collect Payroll and Finance Emails — https://thehackernews.com/2026/08/microsoft-365-aitm-phishing-hijacks.html
UNC6671 Vishing Attacks Target Personal Phones to Steal SaaS Data — https://thehackernews.com/2026/08/unc6671-vishing-attacks-target-personal.html
Metabase Zero-Day Exploited in Wild Allows Admin Access Without Authentication — https://thehackernews.com/2026/08/metabase-zero-day-exploited-in-wild.html
Metabase SQLi zero-day exploited in customer data-theft attacks — https://www.bleepingcomputer.com/news/security/framework-tally-disclose-metabase-data-theft-attacks/
Swiss government SharePoint breach compromised 200 accounts — https://www.bleepingcomputer.com/news/security/swiss-government-sharepoint-breach-compromised-200-accounts/
Levi Strauss & Co. says hackers stole corporate data in cyberattack — https://www.bleepingcomputer.com/news/security/levi-strauss-and-co-says-hackers-stole-corporate-data-in-cyberattack/
Critical One-Click Vulnerability in Atlassian's Rovo AI Exposed Enterprise Data — https://www.securityweek.com/critical-one-click-vulnerability-in-atlassians-rovo-ai-exposed-enterprise-data/
Atlassian Rovo Can Be Tricked Into Sending Jira and Confluence Data to Attackers — https://thehackernews.com/2026/08/atlassian-rovo-can-be-tricked-into.html
Claude Code and Gemini CLI Flaws Let a GitHub Issue Reach CI Workflow Secrets — https://thehackernews.com/2026/08/claude-code-and-gemini-cli-flaws-let.html
AWS, Google, and Vercel Agent Flaws Let Attackers Trigger Tools Without Running the Model — https://thehackernews.com/2026/08/aws-google-and-vercel-patch-agent-flaws.html
Déjà Vu? Meta's AI Escapes Testing Lab in Hacking Joyride — https://www.darkreading.com/cyberattacks-data-breaches/meta-ai-escapes-lab-hacking-joyride
Paperclip AI Flaws Let Attackers Run Host Commands via Malicious Agent Imports — https://thehackernews.com/2026/08/paperclip-ai-flaws-let-attackers-run.html
AI Recommendation Poisoning: How "Ask AI" Buttons Silently Alter LLM Memory — https://thehackernews.com/2026/08/ai-recommendation-poisoning-how-ask-ai.html
Researcher Claims Control of ChatGPT Secure Sandbox — https://www.darkreading.com/cloud-security/researcher-claims-control-chatgpt-secure-sandbox
New CSS Attacks Can Break Webmail Defenses to Steal Passwords and Tokens — https://thehackernews.com/2026/08/new-css-attacks-can-break-webmail.html
ClickFix Attacks Deliver macOS Stealer That Can Drain Crypto Wallets — https://thehackernews.com/2026/08/clickfix-attacks-deliver-macos-stealer.html
Nearly 800 Malicious npm Packages Deliver Cross-Platform RAT and Infostealer — https://thehackernews.com/2026/08/nearly-800-malicious-npm-packages.html
QuickFox Supply Chain Attack Delivers FDMTP Backdoor via Trojanized Windows Installer — https://thehackernews.com/2026/08/quickfox-supply-chain-attack-delivers.html
Leaked n8n API Tokens Exposed Live Instances to Credential Theft — https://thehackernews.com/2026/08/leaked-n8n-api-tokens-exposed-live.html
N-able Issues N-central Hotfix 2 as Attackers Reach Managed Systems and Persist — https://thehackernews.com/2026/08/n-central-attackers-reach-managed.html
CISA Flags Langflow RCE, Tomcat, and N-central Flaws as Actively Exploited — https://thehackernews.com/2026/08/cisa-flags-langflow-rce-tomcat-and-n.html
Progress Kemp LoadMaster Flaw Hits CISA KEV After 792 Reported Exploit Attempts — https://thehackernews.com/2026/08/progress-kemp-loadmaster-flaw-hits-cisa.html
CISA Flags TeamCity CVE-2026-63077 RCE Flaw Under Active Exploitation in the Wild — https://thehackernews.com/2026/08/cisa-flags-teamcity-cve-2026-63077-rce.html
Veeam, Terraform MCP, Django Patch Critical Flaws, Led by CVSS 10.0 Cross-Tenant Bug — https://thehackernews.com/2026/08/veeam-terraform-mcp-django-patch.html
Cisco Patches 12 SD-WAN and IOS XE Flaws, Including Three 9.9 CVSS Score Bugs — https://thehackernews.com/2026/08/cisco-patches-12-sd-wan-and-ios-xe.html
New WordPress Pre-Auth XSS Could Lead to PHP Code Execution - Patch ASAP — https://thehackernews.com/2026/08/new-wordpress-pre-auth-xss-could-lead.html
Hackers breach TrueConf to trojanize client installers with backdoors — https://www.bleepingcomputer.com/news/security/hackers-breach-trueconf-to-trojanize-client-installers-with-backdoors/
Device Code Phishing Up 1,500% in 2026; Vishing Doubles — https://www.darkreading.com/cybersecurity-analytics/device-code-phishing-vishing-doubles