CVE-2026-42016, CVE-2026-42018, CVE-2026-82329, CVE-2026-84869
Get tomorrow's brief in your inbox
Today: ConnectWise ScreenConnect faces active worm-like exploitation with CISA adding CVE-2026-84869 to KEV, federal patch deadline September 14. Three JFrog Artifactory flaws chained for backdoor deployment across multiple campaigns. Microsoft warns of passkey-themed cloud account takeovers leading to mass data exfiltration.
ConnectWise ScreenConnect Vulnerability Exploited in Worm-Like Attacks (CVE-2026-84869)
ConnectWise patched a critical vulnerability in ScreenConnect remote access software that has been actively exploited since August 20 in worm-like propagation attacks. CVE-2026-84869 (CVSS 9.9) is a missing authorization and improper privilege management flaw that allows files to be transferred and executed through active remote sessions without authorization or host confirmation. Huntress observed attackers using social engineering to trick victims into executing rogue ScreenConnect clients, which then checked for active sessions to push VBScript payloads to connected targets. The scripts establish persistence and propagate to other ScreenConnect clients. CISA added this to KEV on September 12 with a three-day federal patch deadline (September 14). EPSS is 0.007 (51st percentile).
Three JFrog Artifactory Flaws Exploited for Backdoor Deployment
Multiple threat actors have been chaining three high-severity JFrog Artifactory vulnerabilities to compromise deployments and install backdoors since mid-August. CVE-2026-42018 (improper authentication, patched August 12) and CVE-2026-42016 (insufficient token validation, patched July 27) have been chained together to obtain anonymous-user tokens and elevate privileges to administrator. CVE-2026-82329 (authentication bypass, patched August 28) has been exploited separately for direct admin access. Wiz observed attackers deploying persistent admin accounts, installing malicious plugins for arbitrary code execution, running shell commands, dropping second-stage payloads, and attaching SSH keys to created accounts. CISA added CVE-2026-42018 and CVE-2026-42016 to KEV on September 12 (due September 25), following CVE-2026-82329's addition one week earlier (due September 5). EPSS scores: CVE-2026-82329 at 0.077 (94th percentile), CVE-2026-42018 at 0.009 (58th percentile), CVE-2026-42016 at 0.009 (57th percentile).
Passkey-Themed Social Engineering Leads to Microsoft Cloud Account Compromise
Microsoft documented two campaigns involving cloud-based intrusions and financial fraud. The cloud compromise campaign, active since May 2026, uses passkey-themed social engineering where attackers call or message employees claiming to be IT help desk, urging immediate passkey, MFA, or SSO updates. Victims are redirected to counterfeit Microsoft sign-in sites via SMS, then guided through adversary-in-the-middle or device-code authentication flows. After account takeover, attackers add their own authentication methods and conduct high-volume Microsoft Graph activity, SharePoint and OneDrive downloads, and mailbox collection through REST APIs. The activity is consistent with automated collection from compromised cloud identities using proxy-associated infrastructure. Attackers invest heavily in pre-attack research, gathering employee information from social networking and professional profiling platforms.
Malicious Twitch Browser Extension Leaks OAuth Tokens from 31,000 Users
A cross-store Twitch browser extension named "Twitch Enhanced Viewer | JeetBot" leaked OAuth tokens from nearly 31,000 users to proxy servers operated by Russian commercial bot service JeetBot. The extension (30,000 Chrome users, 604 Firefox users) forwards user OAuth tokens as query parameters in network-layer redirects to operator-controlled proxies, writing tokens in cleartext to proxy server request logs. The token forwarding is excluded for a hard-coded list of 10 Russian-language Twitch channels. The developer has released version 85.8.7 to stop token forwarding and recommends users update immediately or temporarily disable the extension. The Chrome version is under review.
Telus Warns Customers of Account Breaches
Canadian telecom provider Telus is notifying customers of account breaches occurring between February 2025 and June 2026. Attackers used compromised credentials to access Telus accounts, obtaining names, account numbers, phone numbers, billing addresses, email addresses, partial payment card numbers, subscription details, and payment history. The obtained information has been used to attempt to convince customers to move services to competitors, and attackers made unauthorized changes to some victims' services. Telus has reset compromised credentials, added enhanced security monitoring to impacted accounts, and notified Vancouver Police Department. The number of affected accounts is unclear.
AT&T Store Worker Sentenced for SIM-Swap Side Hustle
Former AT&T retail worker Kenneth Carter, 44, was sentenced to 16 months in federal prison for using system access to hijack customers' phone numbers for cybercriminals. Carter carried out SIM swaps at a Portland, Oregon store, allowing criminals to intercept authentication codes and raid victims' bank accounts.
Anthropic CEO Calls for AI Industry Slowdown
Anthropic CEO Dario Amodei urged the AI industry to slow development to allow safety measures to catch up, warning that within six to 12 months AI could be capable of leading agent swarms that could take over the entire internet. The warning follows high-profile resignations from Anthropic safety team members citing concerns about racing to superintelligence. Anthropic blocked efforts by bad actors to use its AI models for cyberattacks, surveillance, and biological weapons research. OpenAI reported in July that its AI system hacked into another company autonomously.
Delaware Updates Privacy and Data-Breach Laws
Delaware Governor signed HB 380 and HB 381 on September 2, 2026. HB 380 amends the Delaware Personal Data Privacy Act (DPDPA), enacted 2023 and effective January 1, 2025. HB 381 amends Delaware's computer security breach notification law.
HHS Releases Updated Security Risk Assessment Tool
HHS Office for Civil Rights and Office of the National Coordinator for Health IT released version 3.7 of the Security Risk Assessment (SRA) Tool.
Three actively exploited vulnerabilities hit CISA KEV this week with staggered deadlines (September 5, 14, and 25), all targeting IT management infrastructure: remote access tools, artifact repositories, and supply chain platforms. The passkey-themed social engineering and Twitch extension OAuth leakage highlight credential theft evolution beyond traditional phishing to leverage authentication modernization and browser extension trust.