InfoSec Briefing - September 10, 2026

🎧 Audio Briefing

Playback Speed:

Security news from the BlueTeamSec community for Thursday the 10th of September 2026. A busy one, with twelve stories to cover.

Cisco Talos have written up a ClearFake campaign from a Russian-based actor that's using WebDAV to deliver multiple stealers and remote access tools — Amatera, ZigCryptoStealer, and NetSupport Manager. The chain uses blockchain-hosted JavaScript for what they're calling EtherHiding, and there's a bring-your-own-driver technique in there to evade detection. We've seen this actor lean on driver abuse before; it appeared in coverage earlier this week.

Gen Digital are reporting that infostealers have started targeting AI development tools. Variants like Amatera, Remus, and Djinn Stealer are now going after local data stores from Cursor, Claude, Cline, and Gemini — lifting API keys, session tokens, and conversation logs that are often stored in plaintext. One for anyone running those tools locally with access to proprietary work.

CloudSEK have tracked a phishing-as-a-service operation called BigBear 2.0, first spotted in June, that's using Evilginx2 to run adversary-in-the-middle attacks against Microsoft 365 users. It's hit over four hundred organisations across forty countries, primarily IT and managed service providers, harvesting credentials and session cookies to bypass multi-factor authentication. We've seen some of the follow-on techniques in late August coverage on remote token extraction and cloud-based implants.

The US Department of Justice announced the extradition of a Russian national running a large-scale bank account takeover scheme. The operation used search-engine poisoning and spoofed banking sites to harvest over five thousand credentials, contributing to more than two hundred and sixty million dollars in reported losses since January last year.

Cisco Talos disclosed a type confusion vulnerability in the Windows Cloud Files Mini Filter Driver — that's the component behind things like OneDrive file placeholders. The flaw stems from a race condition and can crash the kernel or potentially give an attacker code execution with kernel-level privileges. Microsoft patched it on the eighth; it's scored eight-point-eight.

A researcher going by MSNightmare has published ShieldCrash, which bypasses Microsoft's patch for a previous Windows Defender vulnerability. It still allows arbitrary file reads with SYSTEM privileges and affects all supported Windows versions as of this month. There's a public proof-of-concept, and the researcher notes it could potentially be escalated further.

Matthew McPherrin has factored the RSA keys of a Certificate Authority from the nineteen-nineties. The keys were five-twelve-bit, so not exactly a surprise, but it's a useful reminder that legacy root certificates can still linger in trust stores. Adds useful context if you're managing certificate policy or conducting infrastructure reviews.

Researchers have disclosed WeWorm, described as the first zero-click worm that spreads through WeChat calls across iOS and Android. It exploits a memory corruption flaw in WeChat's VoIP stack, hijacks accounts, and then propagates autonomously by calling the victim's contacts — no user interaction required. Given WeChat's user base, this one's significant.

And another RouterOS issue: a proof-of-concept has been published for an SSH authentication bypass in MikroTik devices. The flaw allows unauthenticated access by exploiting weak RSA signature validation — specifically, using an exponent of one. MikroTik released patches on the third for current and legacy versions.

A researcher has published root-cause analysis and a proof-of-concept for a critical authentication bypass in Citrix NetScaler ADC and Gateway. The vulnerability affects SAML implementations using HTTP-Redirect binding and allows attackers to forge sessions by sending unsigned assertions that aren't properly validated. Patches are available for versions fourteen-point-one and thirteen-point-one, and there are configuration-based workarounds if patching isn't immediately possible. We covered a similar NetScaler issue back in early September.

Aikido are reporting that the Shai-Hulud NPM supply chain attack has resurfaced after a hundred and eleven days dormant. Four new packages were published on the seventh containing the identical malicious payload from May's incident — same file hash, same command-and-control domain. What's notable here is that it bypassed NPM's automated scanning despite being previously fingerprinted. The malware steals tokens, injects itself into downloaded packages, and republishes them. We covered the earlier wave and related registry incidents earlier this month.

Finally, a clarification: the repository ashwa is a legitimate open-source library providing hardware-accelerated substring search routines. No vulnerability, no incident — just a case of mistaken identity in the feed.

That's everything for today. The original articles are the work of their authors — the analysis here was automated. We'll be back tomorrow.

📰 Articles Covered

ClearFake WebDAV infection chain delivers Amatera stealer, ZigCryptoStealer, and NetSupport Manager - Cisco Talos

The precis you provided effectively summarizes the Cisco Talos report on the ClearFake WebDAV infection chain. To ensure your documentation is complete, here are a few additional technical nuances regarding the defensive posture and threat actor profile mentioned in the full analysis.

### Additional Insights for Defenders
* **Infrastructure Abuse:** Beyond the technical execution, the campaign highlights the attackers' reliance on decentralization. By utilizing the **BNB Smart Chain (EtherHiding)** to host their malicious JavaScript, the attackers make it significantly more difficult for defenders to perform traditional takedowns compared to standard hosting environments.
* **Defense Evasion (BYOVD):** The mention of "Bring Your Own Vulnerable Driver" is critical. Defenders should specifically look for the loading of known-vulnerable, legitimately signed drivers that are often abused by such actors to bypass Kernel Mode Code Signing (KMCS) and terminate security processes (EDR/AV).
* **Behavioral Monitoring:** Since the chain relies on `rundll32.exe` to trigger the WebDAV-hosted DLL, monitoring for parent-child process relationships and unexpected network connections from standard system binaries (like `rundll32.exe` or `msiexec.exe`) remains a primary detection strategy.

### Threat Actor Context
* **Attribution:** Cisco Talos attributes this campaign to **UAT-10820**, a threat actor cluster assessed to be Russian-based. This attribution is based on the specific targeting patterns and the TTPs (Tactics, Techniques, and Procedures) observed, specifically the use of the "ClickFix" social engineering framework combined with these specific payload configurations.

If you are maintaining an internal knowledge base on this incident, ensure that the IOCs provided by Cisco Talos are ingested into your SIEM/XDR platforms, as they provide specific domain, IP, and file hash information that can be used to scan for historical infection attempts within your environment.
Infostealers Have Found a New Target: Your AI Agent - Gen Digital Inc.

The article outlines a significant evolution in the tactics of information-stealing malware, which now specifically target the local data stores of AI-assisted development tools and agents. Below is a detailed summary based on the provided insights.

### What Happened
Information-stealing malware families are aggressively expanding their data-collection capabilities to target local directories associated with popular AI development tools and agentic software (e.g., Cursor, Claude, Cline, Gemini, and others). Attackers are actively updating their collection rules remotely to ensure they can harvest data from the latest AI-powered platforms as these tools gain traction.

### Who Is Affected
Users of AI-assisted development and agentic software—including developers, engineers, and power users—are the primary targets. The threat impacts both Windows and macOS environments, with thousands of detections already recorded across a broad user base.

### Security Implications
The theft of data from these tools has severe consequences:
* **Account Compromise & Resource Theft:** Attackers gain unauthorized access to paid AI accounts, allowing them to abuse API capacity or resell access to premium services.
* **Exposure of Intellectual Property:** Stolen "context" (such as prompt histories, project records, and proprietary source code) grants attackers immediate access to sensitive internal infrastructure information and secrets, significantly accelerating their reconnaissance phase.

### Technical Details
Malware such as Amatera, Remus, CallbackBeaver, and Djinn Stealer leverages established infection chains to target these files. Key data points stolen include:
* **Authentication Data:** API keys, access tokens, and refresh tokens, often found in Model Context Protocol (MCP) configuration files.
* **Contextual Information:** Conversation logs, prompt histories, project documentation, and user identity identifiers.
* **Vulnerability:** Many of these tools store sensitive data in predictable local paths, and in some instances, this information is stored in plaintext, making it trivial for automated malware to harvest.

### What Defenders Should Know
* **Remediation:** Incident response protocols must be updated to include AI-agent credentials as part of the broader attack surface. Following an infection, organizations should prioritize revoking all active AI-service sessions and rotating any credentials used by MCP integrations.
* **Defense & Hardening:**
* **Credential Storage:** Avoid storing secrets in plaintext files; prioritize the use of secure OS-level keychains.
* **Data Hygiene:** Limit the permissions granted to MCP integrations and avoid pasting sensitive secrets or infrastructure details directly into prompts.
* **Product Responsibility:** Developers of AI tools must prioritize security by minimizing the storage of sensitive data locally, utilizing robust OS-level protection for credentials, and implementing clear, intuitive data retention controls.
Tracking BigBear 2.0 Evilginx2 Phishing Campaign - CloudSEK

The BigBear 2.0 phishing campaign represents a sophisticated evolution in Phishing-as-a-Service (PhaaS) operations. Below is a detailed summary based on the report.

### **What Happened**
Discovered in June 2026, BigBear 2.0 is a rebranded PhaaS operation that utilizes an Evilginx2-based framework. It employs an **Adversary-in-the-Middle (AiTM)** attack model to intercept traffic between victims and legitimate Microsoft 365 services. By proxying this traffic, attackers successfully harvest both plaintext credentials and session cookies, allowing them to bypass multi-factor authentication (MFA) and hijack active user sessions.

### **Who Is Affected**
* **Scale and Reach:** The campaign is global, affecting 461 organizations and 3,331 unique victim IP addresses across more than 40 countries. The countries with the highest volume of victims include India, France, Saudi Arabia, New Zealand, and Germany.
* **Targeted Sectors:** Attackers heavily prioritized the **IT Services/Managed Service Provider (MSP)** sector. Other significant targets include SaaS/Technology companies, Oil & Gas, Pharmaceuticals, and Consulting.

### **Security Implications**
Successful exploitation grants attackers full account takeover (ATO). This level of access permits:
* Unauthorized entry into sensitive services like email, Microsoft Teams, and SharePoint.
* Persistent access to connected third-party SaaS applications.
* Facilitation of Business Email Compromise (BEC) and data exfiltration.
* The use of compromised accounts as a beachhead for further attacks, including ransomware deployment.

### **Technical Details**
* **Framework:** The campaign is operated by an individual known as "General Boss," who manages a multi-user, role-based panel leased to at least five affiliate operators.
* **Infrastructure:** The infrastructure relies on 42 VPS nodes, largely hosted on Vultr, and uses 69 country-specific residential proxies to mimic legitimate user behavior and evade geo-anomaly detection.
* **Advanced Evasion:**
* **Custom JavaScript:** Injected scripts specifically disable FIDO2/WebAuthn, strip anti-phishing telemetry/canary tokens, and force "Keep Me Signed In" (KMSI) to extend the lifecycle of stolen session cookies.
* **Bot Protection:** The platform utilizes `ipapi.is` to identify and block security researchers, datacenters, and VPN traffic, rendering the phishing panel inaccessible unless the user possesses a residential IP.

### **What Defenders Should Know**
* **Prioritize Phishing-Resistant MFA:** Traditional MFA (SMS, TOTP, push notifications) is insufficient against AiTM attacks. Organizations must transition to **FIDO2/WebAuthn-based MFA**, which is inherently resistant because it is origin-bound and will not authenticate against malicious phishing domains.
* **Active Monitoring:**
* Inspect network traffic for indicators of Evilginx activity, such as specific cookies (e.g., `bigbear_session`) or uncommon HTTP headers (e.g., `x-evg-`).
* Watch for outbound traffic directed to Telegram APIs that transmit credentials or session data.
* **Incident Response:** If a compromise is identified, defenders must immediately reset user passwords, perform a global revocation of all active session and refresh tokens, and enforce phishing-resistant MFA policies to prevent re-entry.
Russian National Extradited to United States for Bank Account Takeover Fraud Scheme Causing Millions of Dollars in Losses - United States Department of Justice

This precis details the criminal case against Sergei Anatolyevich Filimonov, a Russian web developer extradited to the United States for his role in a large-scale cyber-fraud conspiracy 【1】.

### What Happened
Filimonov and his co-conspirators operated a sophisticated, transnational bank account takeover scheme. They created spoofed websites designed to mimic those of federally insured U.S. financial institutions and used sponsored search-engine links to direct unsuspecting customers to these fraudulent pages. Once victims entered their credentials, the attackers used that data to access accounts, review balances, and initiate unauthorized wire transfers to steal funds 【1】.

### Who is Affected
The operation targeted bank customers across the United States. Victims included both individual account holders and corporate entities, with notable compromises confirmed in the Northern District of Georgia 【1】.

### Technical Details
Filimonov served as a technical architect for the operation, developing and maintaining the necessary infrastructure to support the fraud:
* **Credential Harvesting:** The group used specialized software to capture and transmit sensitive authentication data entered by victims on spoofed sites 【1】.
* **Centralized Infrastructure:** Filimonov maintained interactive databases to store stolen information; one such backend server, `web3adspanels.org`, was previously seized by the Department of Justice and contained over 5,000 stolen credentials 【1】.

### Security Implications
This case highlights the efficacy of "search-engine poisoning"—purchasing advertisements to manipulate search results and lure users into phishing traps. Because these spoofed sites appear in the sponsored links section of search engines, they often bypass user suspicion, leading to direct exposure of financial credentials. The scale of the threat is significant; since January 2025, the FBI has tracked over 5,100 complaints related to this type of account takeover, resulting in over $262 million in reported losses 【1】.

### What Defenders and Users Should Know
To defend against and mitigate the risk of these types of attacks, the FBI recommends the following best practices:
* **Direct Navigation:** Avoid clicking on search-engine advertisements to reach banking portals. Instead, use browser "Bookmarks" or "Favorites" to ensure you are visiting the official, legitimate website.
* **Vigilance:** Maintain strict defenses against phishing attempts and regularly monitor financial accounts for unauthorized activity.
* **Security Posture:** Organizations should be aware of the prevalence of impersonation-based fraud and educate employees on identifying deceptive search results and spoofed URLs.
Microsoft Windows Cloud Files Mini Filter Driver CldiStreamPrepareRequestForMoreProcessing Type Confusion vulnerability - Cisco Talos

The vulnerability TALOS-2026-2445 (CVE-2026-80093) involves a serious flaw in the Microsoft Windows Cloud Files Mini Filter Driver (`cldflt.sys`) that could allow local attackers to crash the kernel or potentially gain arbitrary code execution in kernel mode 【1】.

### Overview of the Vulnerability
The issue is a type confusion vulnerability caused by a race condition occurring in the kernel. A local attacker can trigger this flaw by executing a specially crafted application 【1】.

### Who is Affected
The vulnerability affects the following versions of the Microsoft Windows Cloud Files Mini Filter Driver:
* 10.0.26100.8457
* 10.0.26100.8655

### Security Implications
With a CVSSv3 score of 8.8, this vulnerability poses a significant risk. While the primary immediate impact is a kernel crash (Denial of Service), the ability to influence fields within a "fake" request object creates the potential for a write primitive, which could lead to arbitrary code execution in kernel mode 【1】.

### Technical Details
The vulnerability stems from a race condition between two kernel threads interacting with the `OpenStream->RequestListHead` request list:
* **Thread 1 (`CldiStreamProcessPendingHydrationRequests`):** Inserts a stack-based `LIST_ENTRY` sentinel into the intrusive request list to manage list iterations safely during mutations.
* **Thread 2 (`CldStreamAbortOperation`):** Simultaneously walks the same list but fails to account for the stack-based sentinel. It incorrectly processes the sentinel as if it were part of a `CLD_STREAM_REQUEST_PARTIAL` object, which leads to the calculation of a pointer to a fake request object located on the first thread's kernel stack.
* **Result:** The system subsequently dereferences fields from this fake object, leading to type confusion, system instability, and potential exploitation 【1】.

### What Defenders Should Know
* **Patch Status:** Microsoft released a patch to address this vulnerability on September 8, 2026.
* **Tracking:** This vulnerability is tracked as **CVE-2026-80093**.
* **Action:** Ensure all systems running the affected versions of the Windows Cloud Files Mini Filter Driver are updated immediately. Further information can be found in the [Microsoft Security Update Guide](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-80093) 【1】.
ShieldCrash: Windows Defender 0day Vulnerability - MSNightmare

The "ShieldCrash" repository describes a vulnerability identified as a bypass of a previous security fix, known as "ShieldBreak" (CVE-2026-69414). Below is a précis based on the available information regarding this issue.

### What Happened
A proof-of-concept (PoC) has been released demonstrating that a vulnerability previously addressed by Microsoft in the "ShieldBreak" fix remains exploitable. Although Microsoft implemented patches to resolve the original CVE-2026-69414, researchers discovered that these fixes were incomplete, allowing the core issue to be triggered under specific conditions 【1】.

### Who is Affected
The vulnerability affects all supported versions of the Windows operating system as of September 2026 【1】.

### Security Implications
The vulnerability allows for an arbitrary file read executed with `SYSTEM` privileges 【1】. This is a critical security flaw, as it permits unauthorized access to sensitive files on the system that would otherwise be restricted, potentially leading to privilege escalation or the exposure of system-level data.

### Technical Details
* **Nature of Flaw:** It is a bypass of the patch for CVE-2026-69414, where the underlying logic error persists despite Microsoft's previous remediation efforts.
* **Current PoC Status:** The repository contains a "skeleton" PoC that demonstrates the arbitrary file read capability. The author has indicated the possibility of upgrading this to a full `SYSTEM` privilege escalation PoC in the future 【1】.

### What Defenders Should Know
* **Vigilance:** Systems should be monitored for unusual file access patterns, particularly those originating from processes that typically would not require access to sensitive system files.
* **Patch Management:** Organizations should monitor Microsoft’s official security update channels for a new advisory or a revised patch that addresses this specific bypass of CVE-2026-69414.
* **Risk Mitigation:** Given that this is a publicly available PoC affecting all supported Windows versions, defenders should treat this as an active, unpatched vulnerability and apply standard defense-in-depth practices to limit the impact of potential exploitation while awaiting a vendor fix.
WeWorm: The first zero-click worm to spread through WeChat calls across iOS and Android. - Calif

The research article details the discovery of "WeWorm," a critical security vulnerability in the WeChat messaging application. Below is a detailed summary based on the provided report.

### **What Happened**
Researchers discovered and demonstrated a "zero-click" worm that exploits a memory corruption vulnerability within WeChat’s VoIP (Voice over IP) stack 【1】. The worm allows an attacker to automatically hijack a victim’s WeChat account simply by calling them 【1】. Once compromised, the victim's account is used to call their own contacts, propagating the worm from phone to phone in a self-sustaining chain 【1】.

### **Who is Affected**
WeChat users on both iOS and Android platforms were vulnerable 【1】. Given that WeChat is an "everything app" with over a billion users globally—particularly within China and Chinese communities worldwide—the potential reach of this exploit was massive 【1】.

### **Security Implications**
* **Zero-Click Nature:** The exploit requires no user interaction. The victim does not need to answer, see, or interact with the call for the attack to succeed 【1】.
* **Account Hijacking:** Successful exploitation grants the attacker full control over the WeChat account, enabling them to read messages, send messages, and make further calls on the victim's behalf 【1】.
* **Systemic Risk:** When chained with additional underlying operating system bugs (such as those previously reported for Android and iOS), this exploit could theoretically lead to full control of the host device, not just the messaging application 【1】.
* **Propagation:** While the exploit requires the attacker to be on the victim's friend list, the worm bypasses this barrier by compromising a contact first and using their account to reach the next target 【1】.

### **Technical Details**
* **Mechanism:** The vulnerability resides in a memory corruption issue within the WeChat VoIP stack 【1】.
* **Status:** The researchers have withheld specific technical details for now and plan to present a full analysis at a future conference 【1】.

### **What Defenders Should Know**
* **Mitigation:** The researchers reported the vulnerability to Tencent in July, and the company has since successfully mitigated the exploit for all users 【1】.
* **Recommendation:** Users should ensure their WeChat application is updated to the latest version provided by the manufacturer to receive these security patches.
* **Research Context:** This finding serves as part of a broader industry effort to investigate and secure zero-click attack surfaces in mobile messaging ecosystems 【1】.
mikrotrick-poc: CVE-2026-67276 RouterOS SSH public-key authentication bypass lab PoC - Nicolas Krassas

The "MikroTrick" exploit chain represents a critical security vulnerability affecting MikroTik RouterOS devices. Below is a detailed precis based on the disclosed information.

### What Happened
On September 5, 2026, CERT Polska disclosed a chain of six vulnerabilities collectively dubbed "MikroTrick." This chain allows for unauthenticated, full device takeover of MikroTik routers when the SSH service is exposed to the internet. The exploit leverages flaws in how the device handles authentication and signature verification 【1】.

### Who is Affected
Devices running RouterOS versions within the following ranges are vulnerable:
* **v7.24 to 7.24.2 (exclusive)**
* **v7.0.0 to 7.23.4 (exclusive)**
* **v6.0.0 to 6.49.21 (exclusive)**

MikroTik released patches for these vulnerabilities on September 3, 2026, in versions **7.25beta3, 7.24.2, 7.23.4, and 6.49.21** 【1】.

### Technical Details
The specific vulnerability referenced in the proof-of-concept (CVE-2026-67276, CWE-347) targets the SSH public-key authentication process:
1. **Improper Validation:** When verifying a public key, RouterOS checks the key type and modulus ($n$) but fails to compare the exponent ($e$).
2. **Client-Supplied Exponent:** The system uses the client-supplied public key for signature verification.
3. **Authentication Bypass:** By presenting a public key where $e=1$, the mathematical requirement for a valid signature becomes $sig^1 \equiv hash \pmod n$. Since $sig \equiv hash$, the attacker can craft a valid "signature" without possessing the corresponding private key, provided they know the target user's authorized RSA public modulus ($n$).
4. **Result:** This allows the attacker to establish an SSH command channel with the privileges of the target user 【1】.

### Security Implications
This vulnerability allows for unauthenticated full device takeover. By hijacking an SSH session, an attacker can gain administrative control, potentially altering network configurations, intercepting traffic, or using the device as a pivot point for further network compromise. The attack requires only the target username and that user's authorized RSA public modulus (which may be obtained via leaked files or provisioning records) 【1】.

### What Defenders Should Know
* **Patch Immediately:** Update all RouterOS instances to the latest fixed versions (7.25beta3, 7.24.2, 7.23.4, or 6.49.21).
* **Restrict Exposure:** As an interim measure, restrict access to management services (SSH, WWW, bandwidth-test) to trusted internal management networks only. Avoid performing RouterOS-initiated SSH/TLS connections from devices that remain unpatched.
* **Indicators of Compromise (IOCs):**
* Look for specific log entries: `login failure for user -2 via ssh` and `user <name> added by ssh:-2@<ip>`.
* Check for the presence of an unknown, highly privileged user named `ops`.
* Inspect `/system/device-mode/print` for a "Flagged" marker, which indicates a confirmed compromise (though its absence does not guarantee security).
* Monitor for connections from known attacker IPs such as `82.192.72.4` and `103.102.31.18` 【1】.
CVE-2026-19490: NetScaler ADC/Gateway SAML unsigned-assertion bypass via HTTP-Redirect binding (CTX696939) - root cause analysis + PoC - TarPeg007

The provided analysis accurately summarizes the vulnerability based on the technical details outlined in the repository. To ensure comprehensive coverage, here is a structured summary of the incident and recommended actions.

### Executive Summary: CVE-2026-19490
CVE-2026-19490 is a critical session forgery vulnerability impacting Citrix NetScaler ADC and Gateway. It enables unauthenticated attackers to bypass authentication by exploiting flaws in how the SAML HTTP-Redirect binding handler processes assertions.

### Core Details

| Category | Description |
| :--- | :--- |
| **Vulnerability Type** | Unauthenticated Session Forgery (CWE-288) |
| **Impact** | Authentication bypass; full session takeover as any `NameID` |
| **Severity** | High (CVSS 4.0: 9.3) |
| **Primary Vector** | Crafted `GET /cgi/samlauth` requests bypassing signature validation |

### Technical Analysis
The vulnerability stems from two specific misconfigurations within the `nsppe` (NetScaler packet engine):
* **Parser Laxity:** Unlike the secure POST binding path, the Redirect binding path uses a non-strict parser configuration, leaving it vulnerable to malformed inputs 【1】.
* **Signature Enforcement Failure:** The handler incorrectly interprets the `rejectUnsignedAssertion` setting, failing to reject unsigned assertions unless the configuration is explicitly set to `STRICT` mode 【1】. As a result, the device processes SAML assertions without performing necessary digest or RSA signature verification 【1】.

### Affected Versions & Remediation
Systems utilizing SAML actions bound to a Gateway or AAA vserver are at risk if running the following versions:
* **NetScaler ADC / Gateway 14.1:** Versions prior to `14.1-73.32`
* **NetScaler ADC / Gateway 13.1:** Versions prior to `13.1-63.21`

**Recommendations for Defenders:**
* **Immediate Upgrade:** The primary mitigation is to upgrade to the patched versions listed above.
* **Configuration Hardening:** If an immediate upgrade is not feasible, apply the `-samlRejectUnsignedAssertion STRICT` setting to your `samlAction`. Note that this change may impact compatibility with your Identity Provider (IdP) and requires verification 【1】.
* **Detection Strategy:** Implement monitoring for `GET` requests sent to `/cgi/samlauth` that contain a `SAMLResponse` parameter, as standard SAML flows typically utilize `POST` for responses 【1】.
A Shai-Hulud npm payload came back 111 days later - Aikido

The "Shai-Hulud" NPM supply chain attack, originally identified in May 2026, has resurfaced after a 111-day dormancy period. Despite widespread documentation and registry-level security measures, the malware successfully bypassed automated detection.

### What Happened
On September 7, 2026, a threat actor republished the exact same malicious payload used in the May 19, 2026, `@AntV` supply chain attack. Four new package versions were pushed to the NPM registry within a single hour, all containing a file hash that had been publicly identified and fingerprinted by security vendors months prior. This marks the longest dormancy-to-reactivation gap observed for this specific malware.

### Affected Packages (September 2026 Wave)
* `feishu-docx-mcp@0.3.2`
* `bmc-i18n-extract-cli@1.1.1`
* `blueai-cli@0.7.0`
* `bmc-translate-utils@1.1.1`

### Security Implications
The primary concern is the failure of "publish-time" automated scanning at the registry level. This security measure, intended to intercept known malware before it reaches users, failed to catch a payload that was not only previously identified but also unchanged (matching a known SHA256 hash). This indicates that even the most basic signature-based defenses are currently vulnerable, suggesting that attackers can potentially bypass these systems with minimal effort.

### Technical Details
* **Payload Hash (SHA256):** `e37e3ddeeaaa9e0c4fdbcb829b4895a6521031c80053fc436625b61e6ee5b1a6`
* **Execution:** The payload is triggered via a `preinstall` script that executes `bun run index.js`.
* **C2 Communication:** The malware communicates with `t.m-kosche.com`.
* **Persistence Mechanisms:** The malware modifies `.vscode/tasks.json` and `.claude/settings.json`.
* **Behavior:** It performs outbound validation checks against the NPM registry using stolen tokens and executes an automated cycle of downloading tarballs, injecting the malicious payload, bumping versions, and republishing.

### What Defenders Should Know
* **Beyond Signatures:** Reliance on static hash-based detection is insufficient. If a known, "easy" signature can bypass registry scans, advanced variants that utilize obfuscation or novel delivery methods will likely succeed.
* **Proactive Vigilance:** Security teams cannot rely solely on registry-level protections. Organizations should maintain their own internal scanning corpuses and monitor for suspicious behavior in development environments, particularly regarding file changes in configuration folders like `.vscode` and `.claude`.
* **Supply Chain Monitoring:** The reappearance of "zombie" payloads after months of silence demonstrates that threat actors may reuse infrastructure and code long after an initial campaign concludes. Monitoring for these recurring indicators is vital.
ashwa: Hardware accelerated routines for single substring search. - pid7-org

It appears there may be a misunderstanding regarding the nature of the `pid7-org/ashwa` GitHub repository. Based on a thorough review of the repository and available public information, **there is no cybersecurity incident, article, or vulnerability report associated with "Ashwa."**

The `pid7-org/ashwa` repository is a legitimate, open-source software project dedicated to providing hardware-accelerated routines for single substring search. It supports various environments (Node.js, Bun, Deno, and browsers) by automatically selecting optimal backends, such as native SIMD (Single Instruction, Multiple Data) bindings or WebAssembly SIMD 【2】【3】.

The repository includes a standard `SECURITY.md` file, which is a common practice in open-source projects to provide instructions for researchers to privately report potential vulnerabilities, rather than an indication of an active security threat 【1】.

If you were referred to this repository in the context of a cybersecurity article or threat report, it is possible that:
1. **The information source is incorrect:** The repository might have been misidentified or linked in error.
2. **Contextual confusion:** The term "Ashwa" might be used elsewhere in a cybersecurity context unrelated to this software library.

If you have a specific article, URL, or document that discusses a security incident related to this project, please provide that specific link, and I will be happy to analyze it for you.
I’ve factored the RSA keys of a Certificate Authority... … from the 90s. - Matthew McPherrin

Thank you for the detailed summary of the article. Since you have already provided a comprehensive precis covering all the requested points—what happened, who is affected, the security implications, technical details, and defender takeaways—I have no further information to add.

The summary accurately reflects the core message of the article: that while modern systems remain secure, the ability to factor these legacy 512-bit RSA keys underscores the critical importance of deprecating insecure cryptographic standards and ensuring that outdated, vulnerable root certificates are purged from modern environments.