Netskope Threat Labs (blog 24 September 2026; Ars Technica amplify 25 Sep) tracks a cloud-hosted tech-support-scam kit delivered via Google Ads. Victims click an ad on legitimate high-traffic maps/weather/real-estate/document/sports publisher sites, land on a spinner then a benign-looking “ShopEase” storefront; after a mouse-movement bot gate the kit AES-decrypts a hidden C2, fetches an OS-specific encrypted payload, and assembles a full-screen fake Microsoft Defender (Windows) or Apple (macOS) security locker entirely in browser memory (no inspectable file download). Locker uses requestFullscreen, hides the cursor, swallows exit keys, lags the browser, and pressures a call to a bogus support line for payment / remote access / personal data. Window observed 31 August–14 September 2026: ≥619 organisations in Netskope telemetry clicked the ads (Netskope blocked content so those customers were not scammed); geography of clicks ~62% US, ~16% Japan, ~14% Australia; >250 Google Ads campaign IDs across ≥284 publisher sites. Google statement (via Ars): zero tolerance for scams; actively investigating and will act on policy-violating accounts. No CVE. Distinct from desk ClickFix / browser-infostealer cards. Primary: Netskope; wire: Ars Technica 25 Sep.
Netskope Threat Labs — A Fake Security Locker, Delivered by Google Ads (24 Sep 2026)
DCSO CyTec (Medium, 24 September 2026) documents Sauron Loader, a previously undocumented Windows loader seen as the final stage in multiple recent German customer engagements. Delivery chains used ClickFix-style lures and voice phishing (spam flood then fake IT-support callback). An analyzed MSI (SHA-256 ee727d639eaa4ee2e0d7cafbe496e14aaac8df0955d9fb599f2c11dfa1d0f8f2) side-loads via legitimate rnpkeys.exe loading malicious rnp.dll / tdwp.dll, decrypts the loader in memory, persists with a keyroll scheduled task, and talks C2 over encrypted HTTPS with changing paths (Salsa20 + RSA per research). Capabilities: host fingerprint, download/execute varied payloads (EXE/DLL/MSI/scripts), screenshot exfil. Underground alias S4ur0n advertised the loader to Russian-speaking buyers with claimed restrictions on public-sector / post-Soviet targets — not proof of operator attribution for the German cases. IoCs and tooling on DCSO GitHub (Blog_CyTec). Primary: DCSO CyTec Medium; GitHub companion artifacts.
DCSO CyTec — Sauron Loader: A New Loader Lurking in Underground Forums (24 Sep 2026)
Huntress (24 September 2026) reports an early-September 2026 intrusion that began with exploitation of Samsung MagicINFO 9 Server CVE-2025-4632 (path traversal / arbitrary file write as SYSTEM; incomplete fix lineage from CVE-2024-7399). After access via the Tomcat-hosted MagicINFO service, the actor repeatedly tried to install AnyDesk (source IP 194.87.89.30), created a local admin, disabled Microsoft Defender, then compiled a Silent XMR Miner–based Monero miner on the endpoint (noisy csc/gcc/tcc/donut telemetry) and pointed it at auto.c3pool.org:19999. NVD / Samsung PSIRT: CVSS 3.1 9.8 CRITICAL (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H); affected MagicINFO 9 Server before 21.1052; fixed May 2025. CISA KEV entry (added 2025-05-22; catalog still lists). Primary: Huntress; CVE metadata: NVD; vendor notes via KEV → security.samsungtv.com SVP-MAY-2025.
Huntress — The Not So Silent Miner (MagicINFO → on-host Monero build) (24 Sep 2026)
Cryptology ePrint Archive paper 2026/2131 (“Forging 1024-bit RSA signatures in nearly SNFS time”; Laura Shea, Miro Haller, Adam Suhl, Nadia Heninger, Emmanuel Thomé) and Ars Technica (Dan Goodin, 24 September 2026) describe a classical-computing signature-forgery method that breaks RSA without factoring the modulus — building on an under-appreciated 2007 Joux–Naccache–Thomé oracle algorithm. Practical demonstration: forging against deprecated 1024-bit RSA took a handful of months on an academic CPU cluster, far below nation-scale GNFS factoring estimates for that size. Authors and independent cryptographers (quoted in Ars) stress widely deployed RSA-2048+ implementations remain practically safe for now, but the result is a conceptual break from the long-held “RSA security ≈ factoring hardness” assumption and further argues against any remaining 1024-bit RSA. Peer review pending. Primary: ePrint 2026/2131; wire: Ars Technica 24 Sep.
IACR ePrint 2026/2131 — Forging 1024-bit RSA signatures in nearly SNFS time
Socket (24 September 2026; update 25 Sep) documents that GitHub Actions actions-cool/issues-helper and actions-cool/maintain-one-comment — compromised in the May 2026 Mini Shai-Hulud campaign and disabled by GitHub on 19 May — became downloadable again on 16 September 2026 without cleaning release tags. Tags still pointed at the May 18 malicious commits, so workflows referencing either action by mutable version tag (e.g. @v2.2.1) resumed fetching and executing the payload (Bun install + obfuscated index.js; credential harvest / exfil cluster overlap with t.m-kosche[.]com). issues-helper alone has ~15,000 dependent repositories on GitHub's dependency graph; housekeeping workflows often run daily or on issue/PR events, so many repos likely re-ran the payload within a day of re-enablement with no further attacker action. SHA-pinned clean pre-May-18 commits were not affected. Socket update 25 Sep: both repositories disabled again by GitHub Staff (ToS); tag-referenced workflows now fail at job setup instead of running the payload. Distinct from desk card shai-hulud-ai-session-20260916 (Mandiant AI coding-assistant session worm). Primary: Socket; wire: The Hacker News 25 Sep 2026.
Flare Research (blog dated 24 September 2026; Cyber Security News amplify 25 Sep) documents TWEAKOS, a Telegram-native credential theft and monetization workflow recovered after source appeared on Pastebin. Two co-designed Python components share one bot token and admin IDs: a Windows-oriented stealer that persists via Startup / user Run key (no admin needed), harvests Discord tokens from Discord / Discord PTB / Chrome default-profile LevelDB (.log/.ldb), validates them against Discord’s API, drives an interactive Telethon sign-in to mint a fresh Telegram .session, and exfils validated tokens/sessions to hardcoded admin IDs; plus a single-process Telegram bot backend (SQLite) that inventories victims/products/orders and sells “telegram” and “discord” accounts under the TWEAKOS brand with 5%/day time-decay pricing settled in Telegram Stars. Flare assesses this as the first documented case of a stealer and its own storefront running inside the same bot process. Delivery lure and victim count unknown; bot reachability at disclosure not confirmed. No CVE. Distinct from RemControl / Psychedelic Stealer desk cards. Primary: Flare; wire: Cyber Security News 25 Sep 2026.
Microsoft Threat Intelligence (24 September 2026) details Storm-2570, a ransomware affiliate observed since April 2025 whose final payload rotates among Qilin, DragonForce, Anubis, and BERT while post-compromise tradecraft stays consistent. Victims span US, Canada, UK, Spain, Netherlands and Puerto Rico across healthcare, education, energy and manufacturing. After access (initial vector not established in the post), operators install remote-management tools (MeshAgent/MeshCentral often renamed; also Atera, NinjaRMM, ScreenConnect, Splashtop, Remotely_Agent), tunnel with Cloudflare Tunnel or ngrok, harvest credentials (Mimikatz, LaZagne, pypykatz, AD database copy), disable AV/real-time protection, move laterally via PsExec/Impacket/NetExec/RDP, then exfiltrate and encrypt. Microsoft urges defenders to hunt affiliate behaviours before ransomware deployment rather than by payload name alone. Primary: Microsoft Security Blog.
Microsoft — Beyond the ransomware: Tracking Storm-2570 (24 Sep 2026)
GitLab’s critical patch release (docs: 19.4.1, 19.3.3, 19.2.7) remediates two CVSS 9.9 flaws that let an authenticated user achieve arbitrary code execution on the GitLab server via specially crafted regular expressions in CI/CD configuration. CVE-2026-89078 is a double-free in the regular-expression parser (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L); CVE-2026-93577 is an integer overflow in the regex compiler (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). Both affect GitLab CE/EE from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1. GitLab.com is already on the fixed build; GitLab Dedicated customers need no action; self-managed admins must upgrade immediately. Reported via HackerOne by joaxcar. Distinct from desk gitlab-email-push-aikido-20260923 (issue-email push path). Primary: GitLab critical patch release notes; wire: Cyber Security News 25 Sep.
Payy (@payy_link) said on X at 14:04 UTC on 24 September 2026 that at 4:21 UTC that day its bridge contract on Ethereum 'was exploited and drained of its full balance', and that while it investigates 'all Payy Network transactions are paused including deposits, withdrawals, transfers and card transactions'. In follow-up posts that day Payy said it had notified law enforcement and was working with multiple incident response organisations (14:35 UTC); that 'Law enforcement, exchanges, blockchain analytics companies and other relevant parties have been notified of attacker addresses' (16:02 UTC); that 'We have paused functionality on Payy Wallet' (16:04 UTC); and that 'the stolen funds were users' non-custodial deposits to Payy Network / Payy Wallet' (17:58 UTC). Those posts did not give the amount stolen, the vulnerability class or the attacker addresses. Primary: Payy posts on X (24 Sep 2026).
Payy (@payy_link) on X — bridge contract exploited and drained; Payy Network transactions paused (24 Sep 2026, 14:04 UTC)
Crypto casino Duelbits co-founder Joe (@DuelbitsJoe) wrote on X on 24 September 2026: "Confirming a ~$7M hack. Still investigating exactly what happened and how. Until we have clarity, Duelbits stays offline. User funds are safe." The next steps he listed were to finish the investigation, re-top hot wallets and bring Duelbits back online. In a follow-up post he wrote: "We’ve identified what happened. An official statement will follow within 24 hours." He said the site should be back up within about 15 hours and that Duelbits was rebuilding its deposit and withdrawal servers. Duelbits has not published a technical root cause in these posts. Primary: co-founder posts on X. Correction (27 Oct 2026): removed on-chain outflow figures credited to Scam Sniffer, Ethereum flow details, a researcher assessment of a private-key or signing compromise and a comparison with the Bitget incident, all of which came only from Cyber Security News, which does not serve its pages to this desk; that link and credit are removed too. (source: Duelbits co-founder Joe on X)
Cloudflare Blog (published 24 September 2026 15:00 UTC; joint write-up with Accomplish) and Accomplish (24 Sep) document a cross-tenant data-exposure flaw in Cloudflare Containers (also affecting Sandboxes / Browser Run that share the disk stack). Oren Yomtov (Accomplish) reported via HackerOne on 4 September 2026. Root cause: Linux device-mapper thin provisioning (dm-thin) pools used skip_block_zeroing; when a container’s writable /dev/vdc thin disk was deleted, 64 KiB physical blocks returned to a multi-tenant pool uncleared. A Workers Paid tenant could force allocation of a recycled block with a 4 KiB write into free ext4 space then raw-read residual bytes (directory structures, DB pages, SQLite) left by prior tenants on the same host — opportunistic (no victim/host targeting; placement automatic). PoC saw residual material on 18/24 placements across four continents. No CVE / no vendor CVSS in the posts. Cloudflare removed skip_block_zeroing fleet-wide, retired running container disks and pre-mitigation OCI image snapshot caches, drained/restarted hosts, and built disk-I/O detection for the 4 KiB-write / large-read pattern; retained telemetry showed only researcher and authorized validation activity — no evidence of malicious exploitation. No customer-side config change required. Primary: Cloudflare Blog; researcher: Accomplish.
Cloudflare Blog — cross-tenant data exposure in Containers (24 Sep 2026)
