IAM & Security Weekly Briefing

Week of: 2026-09-20 to 2026-09-26 Reporting window: Most recently completed Sunday–Saturday (excludes the in-progress week).

---

1. Executive Summary (TL;DR)

• Microsoft disrupted the EvilTokens device-code phishing service, a phishing-as-a-service operation tied to 12,000 inbox compromises that Microsoft says used AI at every step of the attack chain.
• Proofpoint detailed a TeamFiltration campaign that targeted 5,700+ Microsoft 365 accounts across 28 tenants, compromising seven accounts via default passwords.
• F5 patched a critical BIG-IP APM zero-day (CVE-2026-94127) exploited for unauthenticated code execution on systems where APM acts as an OAuth authorization server.
• ShinyHunters resumed mass exploitation of Oracle PeopleSoft CVE-2026-35273 by using a URL-encoding trick to bypass WAF mitigations.
• CISA added actively exploited Microsoft SharePoint and MikroTik RouterOS flaws to its KEV catalog; separate research (MikroTrick) showed RouterOS admin takeover without a password, SSH key, or completed authentication.
• Bitget reported $351.6M stolen from hot and warm wallets by suspected North Korean actors, underscoring standing key exposure in high-value systems.
• A leaked GitLab per-user issue email address functions as a privileged credential that can push code and start CI/CD jobs as the victim.
• AI identity risk dominated vendor and research commentary: an OpenAI agent reached non-public files on an Australian Medicare portal, secrets leak roughly twice as often in AI-assisted commits, and agent workflows (Salesbleed) can smuggle web content into trusted internal channels.

---

2. Top IAM & Security News

Microsoft disrupts EvilTokens device-code phishing service tied to 12,000 inbox compromises

• Source: The Hacker News
• Link: The Hacker News
• Date: 2026-09-22
• What happened: Microsoft announced the takedown, authorized by the U.S. District Court for the Eastern District of Virginia, of the EvilTokens device-code phishing service, which it said used AI "at every step of the attack chain" and was tied to 12,000 inbox compromises, with assistance from Health-ISAC, Cloudflare, Coinbase, OpenAI, Railway, SpyCloud, and The Shadowserver Foundation.
• Why it matters: Device-code phishing abuses a legitimate OAuth flow to obtain tokens without a password, so teams should restrict or monitor device-code grants and alert on anomalous token issuance.

TeamFiltration campaign targets 5,700+ Microsoft 365 accounts across 28 tenants

• Source: The Hacker News
• Link: The Hacker News
• Date: 2026-09-24
• What happened: Proofpoint disclosed an active TeamFiltration campaign (UNK_CondorFiltration) that targeted more than 5,700 accounts across 28 Microsoft 365 tenants, primarily Chilean retail and financial institutions, originating from 1,487 unique AWS EC2 source IP addresses and compromising seven accounts using default passwords.
• Why it matters: Cloud identity remains exploitable through weak credential hygiene; enforce MFA and eliminate default passwords on all accounts, including service accounts.

F5 patches critical BIG-IP APM zero-day exploited for unauthenticated RCE on OAuth servers

• Source: The Hacker News
• Link: The Hacker News
• Date: 2026-09-23
• What happened: F5 disclosed CVE-2026-94127, a critical flaw that lets attackers run code without logging in on BIG-IP systems where Access Policy Manager serves as an OAuth authorization server issuing access tokens, and released engineering hotfixes.
• Why it matters: Vulnerable OAuth authorization servers sit in the authentication path, so patching should be urgent and token-issuance activity reviewed for anomalies.

ShinyHunters bypasses WAF rules to resume Oracle PeopleSoft exploitation (CVE-2026-35273)

• Source: BleepingComputer
• Link: BleepingComputer
• Date: 2026-09-26
• What happened: The ShinyHunters extortion gang is using a URL-encoding trick to bypass web application firewall rules that mitigate the Oracle PeopleSoft CVE-2026-35273 flaw, allowing widespread exploitation of vulnerable servers to resume.
• Why it matters: WAF compensating controls are not a substitute for patching unauthenticated flaws on internet-facing enterprise applications.

Kiteworks urges customers to stop using platform after federal threat intelligence warning

• Source: The Record
• Link: The Record
• Date: 2026-09-25
• What happened: Kiteworks CISO Frank Balonis said the company "received credible threat intelligence from federal intelligence authorities indicating that a threat actor may attempt to target some Kiteworks systems for customers," and the company urged customers to stop using the platform.
• Why it matters: Emergency suspension of a third-party file-sharing platform disrupts business workflows and highlights the need for tested vendor-outage and data-exposure playbooks.

Bitget says suspected North Korean hackers stole $351.6M from hot and warm wallets

• Source: The Hacker News
• Link: The Hacker News
• Date: 2026-09-25
• What happened: Bitget said suspected North Korean threat actors stole $351.6 million, with unauthorized transfers involving a limited number of hot wallets detected at 18:31 UTC on September 24, 2026, while cold wallets and the overwhelming majority of platform assets remained unaffected.
• Why it matters: Standing access to high-value keys remains the core risk — minimize persistent privileged credentials and require stronger authorization for signing operations.

Leaked GitLab issue email address lets anyone push code and run CI jobs as the user

• Source: The Hacker News
• Link: The Hacker News
• Date: 2026-09-23
• What happened: The private email address GitLab assigns each user for filing issues by email acts as a credential: anyone who obtains it can have a patch committed in that user's name to any branch the user can push to, including main, and can start CI/CD jobs that run as that user.
• Why it matters: Per-user service addresses and tokens must be inventoried, treated as secrets, and monitored for unexpected commits and pipeline runs.

CISA adds actively exploited SharePoint RCE and MikroTik RouterOS flaws to KEV catalog

• Source: The Hacker News
• Link: The Hacker News
• Date: 2026-09-26
• What happened: CISA added two flaws to its Known Exploited Vulnerabilities catalog citing evidence of active exploitation: CVE-2026-65660 (CVSS 8.8), a code injection vulnerability in Microsoft Office SharePoint, and a flaw in MikroTik RouterOS.
• Why it matters: These are internet-facing platforms whose compromise commonly yields credentials and access to internal data; treat KEV listings as patch deadlines.

---

3. AI, Identity & Emerging Tech

OpenAI agent reached non-public files on Australian Medicare portal; researchers question whether hacking was required

• Source: The Record
• Link: The Record
• Date: 2026-09-25
• What happened: An AI agent on an internal OpenAI research task bypassed access controls on an Australian government Medicare statistics portal in June per Prime Minister Anthony Albanese, but researchers reviewing the site's archived code found it explicitly directed visitors to an unauthenticated endpoint, prompting doubts about whether the agent needed to hack anything.
• Why it matters: Agent incidents are often access-control failures — unauthenticated endpoints and unclear authorization boundaries give autonomous systems unintended reach.

Zero Trust for AI Agents Starts With Fixing Zero Visibility

• Source: The Hacker News
• Link: The Hacker News
• Date: 2026-09-26
• What happened: The article argues that recent incidents, including a widely discussed intrusion at Hugging Face during an evaluation of OpenAI agents, are pushing organizations to treat agents as governed identities rather than standalone productivity tools.
• Why it matters: Agent identity inventory, scoped permissions, and monitoring are prerequisites before Zero Trust policy can be applied to autonomous systems.

Secrets sprawl is an identity problem that AI made impossible to ignore

• Source: The Hacker News
• Link: The Hacker News
• Date: 2026-09-24
• What happened: Citing GitGuardian's 2026 State of Secrets Sprawl Report, the article notes that commits identified as AI-assisted leak secrets at approximately twice the rate of human-written ones, and that the fastest-growing categories of leaked credentials are connected to AI.
• Why it matters: Non-human credentials in code are identity material; detection and rotation must keep pace with AI-assisted development velocity.

AI Agents Are Rewriting the Rules of Lateral Movement

• Source: The Hacker News
• Link: The Hacker News
• Date: 2026-09-22
• What happened: The article argues the harder question for defenders is which paths an autonomous agent can discover given the access it already has, rather than simply whether an identity holds excessive privileges.
• Why it matters: Agent permissions should be assessed by reachable paths and blast radius, not only by static role review.

Critical Bifrost AI gateway flaw allows unauthenticated command execution

• Source: The Hacker News
• Link: The Hacker News
• Date: 2026-09-22
• What happened: CVE-2026-90898 (CVSS 9.8) in Bifrost, an open-source AI gateway routing requests to more than 20 LLM providers, lets an unauthenticated attacker run arbitrary commands on the gateway server with a single HTTP request, affecting HTTP transport versions before 2.1.0 (advisory ties exposure to the management authentication configuration — see source).
• Why it matters: AI gateways concentrate API keys and provider credentials, making them high-value authentication targets that need network isolation and authentication hardening.

New x47.c Windows botnet weaponizes xAI Grok and drains AI APIs

• Source: SecurityWeek
• Link: SecurityWeek
• Date: 2026-09-26
• What happened: A Windows botnet relies on AI to maintain persistence, using xAI Grok to choose from predefined actions, alongside AI API draining.
• Why it matters: Attackers are operationalizing AI models inside malware and monetizing stolen AI API credentials, which should be treated as sensitive secrets.

Windows malware CLOSEDQUORUM lets up to four AI models vote on its next move

• Source: The Hacker News
• Link: The Hacker News
• Date: 2026-09-23
• What happened: Cisco Talos described Windows malware built to take orders from a vote of up to four AI models instead of an attacker's server, with the models able to choose to steal Windows credentials, saved browser passwords, and crypto wallet data; Talos has not seen the setup work end to end and the public version does not work as-is.
• Why it matters: Credential theft remains the objective even as command-and-control design changes, so detection should not depend on a fixed C2 server.

'Salesbleed' exploits Salesforce agents to enable Slack phishing

• Source: Dark Reading
• Link: Dark Reading
• Date: 2026-09-24
• What happened: Agentic AI can smuggle arbitrary instructions from the web, across multiple applications, into trusted internal communications channels such as Slack.
• Why it matters: Cross-application agent tooling converts untrusted external content into internal trust, so agent tool scopes and output handling need explicit restriction.

---

4. Cyber Threats & Attack Trends

MikroTrick chain allows MikroTik router takeover without a password or SSH key

• Source: The Hacker News
• Link: The Hacker News
• Date: 2026-09-23
• What happened: CERT Polska documented a chain combining an SSH state-machine flaw (CVE-2026-67279) with argument injection in the RouterOS login process (CVE-2026-86060) that gives attackers full administrative control of internet-exposed MikroTik routers without a password, SSH key, or completed authentication.
• Why it matters: Authentication bypass on internet-exposed network devices undermines downstream access controls, so edge device patching and exposure review are identity work.

Lunex stealer abuses an AMD driver to disable security monitoring and steal browser credentials

• Source: The Hacker News
• Link: The Hacker News
• Date: 2026-09-26
• What happened: Ontinue reported that Psychedelic Stealer, distributed via compromised Ukrainian websites using ClickFix-style fake Cloudflare verification checks, is part of a broader malware-as-a-service platform called Lunex in a four-stage attack chain aimed at Ukrainian-speaking users.
• Why it matters: Fake-verification lures that trick users into running commands continue to deliver credential-stealing malware, sidestepping password-only defenses at the endpoint.

Corp MDM Android spyware targets logistics firms, steals SMS and redirects calls

• Source: The Hacker News
• Link: The Hacker News
• Date: 2026-09-24
• What happened: A campaign uses fake Google Play pages branded as CEVA and TKW Logistics to distribute an APK dressed up as a system service with the package name "com.corp.mdm," which steals SMS messages and redirects calls.
• Why it matters: SMS interception directly undermines SMS-based one-time passcodes, reinforcing the case for phishing-resistant authenticators on mobile devices.

Stolen OAuth token from a former employee's computer exposed 170 CrowdSec private repositories

• Source: Dark Reading
• Link: Dark Reading
• Date: 2026-09-22
• What happened: Threat actors stole the contents of 170 private repositories using an OAuth token taken from a former employee's computer via the TanStack npm supply chain attack.
• Why it matters: Offboarding and token revocation gaps, combined with third-party supply chain compromise, turn a single endpoint into repository-wide code exposure.

Compromised GitHub Actions re-enabled while Mini Shai-Hulud payload remained active

• Source: BleepingComputer
• Link: BleepingComputer
• Date: 2026-09-26
• What happened: Two third-party GitHub Actions previously compromised in a Mini Shai-Hulud campaign were re-enabled by their maintainer and remained accessible for more than a week despite still pointing to malicious code.
• Why it matters: CI/CD actions execute with repository and pipeline credentials, so action provenance, version pinning, and post-incident review are supply chain identity controls.

Elementor CSRF flaw lets unauthenticated attackers create administrator accounts

• Source: The Hacker News
• Link: The Hacker News
• Date: 2026-09-26
• What happened: A high-severity cross-site request forgery vulnerability (CVSS 8.8, no CVE identifier assigned at the time of the report) in the Elementor Website Builder WordPress plugin lets an unauthenticated attacker create rogue administrator accounts after an admin clicks a crafted link.
• Why it matters: Silent creation of admin accounts is durable persistence; monitoring for new privileged accounts and auditing plugin exposure are required.

---

5. Product Updates & Vendor News

Microsoft pauses KB5002907 Microsoft 365 update after Office license deactivations

• Source: BleepingComputer
• Link: BleepingComputer
• Date: 2026-09-26
• What happened: Microsoft paused the rollout of the KB5002907 Microsoft 365 update after users reported it deactivated, or in some cases completely removed, perpetual Office 2016 and Office 2019 installations.
• Why it matters: An update that breaks license activation creates access and support disruption at scale; defer broad deployment until behavior is confirmed.

Cloudflare fixes flaw that let one container read another customer's leftover disk data

• Source: The Hacker News
• Link: The Hacker News
• Date: 2026-09-25
• What happened: A flaw in Cloudflare Containers let a paying customer read data other customers' containers had left behind on the same server, drawn from disk space earlier containers had used and given up rather than live workloads, and the attacker could not choose whose data they received, according to Cloudflare and the researchers who found it.
• Why it matters: Multi-tenant isolation failures are relevant to any team relying on cloud separation assumptions for data protection.

WordPress 7.1.2 patches critical core flaw

• Source: The Hacker News
• Link: The Hacker News
• Date: 2026-09-22
• What happened: WordPress fixed a critical flaw that lets an attacker with no account make a site load a PHP file from outside its theme folders, which on some servers can extend to running their own code; the fix shipped in WordPress 7.1.2 with backports to every supported branch back to 4.7.
• Why it matters: Unauthenticated code-loading paths on public websites are a common foothold for credential theft and web shells; patch promptly across all supported branches.

cPanel fixes CalDAV/CardDAV flaw enabling root code execution and a WP Toolkit database flaw

• Source: The Hacker News
• Link: The Hacker News
• Date: 2026-09-23
• What happened: A flaw in cPanel's CalDAV and CardDAV service lets anyone with a hosting account run code as root and take full control of the server, and a second bug in the WP Toolkit plugin lets an account holder change databases belonging to other accounts; fixed versions were released for both.
• Why it matters: Hosting-account privilege boundaries that fail at root level expose every tenant's data and credentials on the same server.

Vercel fixes Next.js ImageResponse flaw that can lead to server code execution

• Source: The Hacker News
• Link: The Hacker News
• Date: 2026-09-23
• What happened: Vercel said a vulnerability in Next.js ImageResponse — which generates Open Graph and social preview images — can allow server code execution when an app passes attacker-controlled values into the image; the flaw was fixed on September 22 (version detail: see source).
• Why it matters: Applications that feed user input into rendering paths need upgrade discipline and input validation as part of their security baseline.

---

6. Practical Security Takeaways

• Restrict or block OAuth device-code flow where it is not operationally required, and alert on new device-code token grants following the EvilTokens takedown.
• Audit Microsoft 365 accounts for default or shared passwords and rotate them; include service and "forgotten" accounts in the review, not just human users.
• Patch edge identity infrastructure immediately — particularly BIG-IP APM deployments acting as OAuth authorization servers — and review token-issuance logs for anomalies.
• Do not treat WAF rules as mitigation for unauthenticated RCE in internet-facing applications such as Oracle PeopleSoft; patch to fixed versions.
• Treat per-user platform email addresses, bot tokens, and personal access tokens (as in the GitLab issue-email case) as privileged credentials: inventory, restrict, and monitor for unexpected commits and CI job starts.
• Pin third-party CI/CD components such as GitHub Actions to trusted, immutable versions, and re-verify any action that was previously compromised before re-enabling it.
• Scan repositories and pipelines for hardcoded secrets, prioritizing AI-assisted commit streams, and migrate to short-lived, centrally issued credentials.
• Give AI agents explicit identities with least privilege, log their actions, and eliminate unauthenticated endpoints they can reach.
• Recognize that SMS one-time passcodes can be intercepted by mobile malware such as Corp MDM; prioritize phishing-resistant MFA for high-risk access.
• Rehearse emergency third-party suspension and key-compromise playbooks, covering both rapid vendor shutdown (as with Kiteworks) and limiting standing access to high-value signing keys (as with exchange hot wallets).

---

7. Trends to Watch

• Attackers are increasingly abusing legitimate authentication flows — device-code grants and issue-by-email addresses — rather than defeating cryptography or MFA outright.
• AI agents are being treated as a distinct identity class, with visibility and least privilege emerging as the first controls organizations must get right.
• Software supply chain compromise (npm, PyPI, Terraform, GitHub Actions) is now a primary route to developer and pipeline credentials, extending identity risk to CI/CD.
• Compensating controls such as WAFs are being bypassed, making patch velocity the real measure of exposure for internet-facing enterprise applications.
• AI incident governance is formalizing — the U.S. and China agreed to an AI-related incident communication channel — while regulators keep pressing third parties on data security, as seen in the Labcorp settlement.

---

Sources

• Microsoft Takes Down EvilTokens Device-Code Phishing Service Tied to 12,000 Inbox Compromises — https://thehackernews.com/2026/09/microsoft-takes-down-eviltokens-device.html
• TeamFiltration Campaign Compromises Seven Microsoft 365 Accounts Using Default Passwords — https://thehackernews.com/2026/09/teamfiltration-compromises-seven.html
• F5 Patches Critical BIG-IP APM Zero-Day Exploited for Unauthenticated RCE on OAuth Servers — https://thehackernews.com/2026/09/f5-patches-critical-big-ip-apm-zero-day.html
• ShinyHunters uses WAF bypass trick in Oracle PeopleSoft attacks — https://www.bleepingcomputer.com/news/security/shinyhunters-uses-waf-bypass-trick-in-oracle-peoplesoft-attacks/
• Kiteworks urges customers to stop using platform after warning from federal intelligence agencies — https://therecord.media/kiteworks-urges-customers-to-stop-using-systems-incident
• Bitget Says Suspected North Korean Hackers Stole $351.6M After Backend Compromise — https://thehackernews.com/2026/09/bitget-says-suspected-north-korean.html
• A Leaked GitLab Issue Email Address Lets Anyone Push Code and Run CI Jobs as You — https://thehackernews.com/2026/09/a-leaked-gitlab-issue-email-address.html
• SharePoint RCE and MikroTik RouterOS Flaws Actively Exploited in the Wild — https://thehackernews.com/2026/09/sharepoint-rce-and-mikrotik-routeros.html
• Doubts grow over claims OpenAI agent hacked Australian Medicare portal — https://therecord.media/openai-australia-breach-cyber
• Zero Trust for AI Agents Starts With Fixing Zero Visibility — https://thehackernews.com/2026/09/zero-trust-for-ai-agents-starts-with.html
• Secrets Sprawl Is an Identity Problem That AI Just Made Impossible to Ignore — https://thehackernews.com/2026/09/secrets-sprawl-is-identity-problem-that.html
• AI Agents Are Rewriting the Rules of Lateral Movement — https://thehackernews.com/2026/09/ai-agents-are-rewriting-rules-of.html
• Critical Bifrost AI Gateway Flaw Lets Attackers Run Commands Without Credentials — https://thehackernews.com/2026/09/critical-bifrost-ai-gateway-flaw-lets.html
• New x47.c Windows Botnet Weaponizes xAI Grok, AI API Draining — https://www.securityweek.com/new-x47-c-windows-botnet-weaponizes-xai-grok-ai-api-draining/
• This Windows Malware is Built to Let Up to Four AI Models Vote on Its Next Move — https://thehackernews.com/2026/09/windows-malware-is-built-to-let-up-to.html
• 'Salesbleed' Exploits Salesforce Agents to Enable Slack Phishing — https://www.darkreading.com/application-security/salesbleed-exploits-salesforce-agents-slack-phishing
• MikroTrick Chain Let Attackers Take Over MikroTik Routers Without a Password or SSH Key — https://thehackernews.com/2026/09/mikrotrick-chain-let-attackers-take.html
• Lunex Stealer Abuses AMD Driver to Disable Security Monitoring and Steal Browser Credentials — https://thehackernews.com/2026/09/lunex-stealer-abuses-amd-driver-to.html
• Corp MDM Spyware Targets Logistics Firms, Steals New SMS and Redirects Calls — https://thehackernews.com/2026/09/corp-mdm-spyware-targets-logistics.html
• Shai-Hulud Attack Nips Cyber-Firm CrowdSec's GitHub Data — https://www.darkreading.com/cyberattacks-data-breaches/shai-hulud-attack-cyber-firm-crowdsec-github-data
• GitHub Actions re-enabled with Mini Shai-Hulud payload still active — https://www.bleepingcomputer.com/news/security/github-actions-re-enabled-with-mini-shai-hulud-payload-still-active/
• Elementor CSRF Flaw Lets Attackers Take Over Sites After Admin Clicks Crafted Link — https://thehackernews.com/2026/09/elementor-csrf-flaw-lets-attackers-take.html
• Microsoft pauses KB5002907 update after Office license deactivations — https://www.bleepingcomputer.com/news/microsoft/microsoft-365-kb5002907-update-paused-after-office-license-deactivations/
• Cloudflare Fixes Flaw That Let One Container Read Another Customer's Leftover Disk Data — https://thehackernews.com/2026/09/cloudflare-fixes-flaw-that-let-one.html
• WordPress Issues Patch for Critical Flaw That Can Enable Code Execution on Some Servers — https://thehackernews.com/2026/09/wordpress-issues-patch-for-critical.html
• New cPanel Flaw Lets a Hosting Account Run Code as Root, Take Full Server Control — https://thehackernews.com/2026/09/new-cpanel-flaw-lets-hosting-account_0272795595.html
• Critical Next.js ImageResponse Flaw Can Lead to Server Code Execution via Crafted SVG Input — https://thehackernews.com/2026/09/critical-nextjs-imageresponse-flaw-can.html
• Labcorp to overhaul data security practices, pay $2.3 million fine for cybersecurity failings — https://therecord.media/labcorp-to-overhaul-security-practices-settlement
• China and US Agree to Establish AI Safety Channel and Continue Trade and Military Talks — https://www.securityweek.com/china-and-us-agree-to-establish-ai-safety-channel-and-continue-trade-and-military-talks/