Anthropic’s September 2026 Threat Intelligence report (Detecting and countering misuse of AI; activity December 2025–August 2026) details a northern Yemen weapons-development cell running three programs: a guided rocket using a commodity phone-class flight computer with final-phase homing; a multi-stage ballistic missile with a stated range goal above 2,000 km; and a multi-variant “R2000” set including a hypersonic glide vehicle variant. Actors used Claude Code in place of human software engineers for guidance, navigation and control (GNC) — integrating open-source autopilot onto phone-class flight computers, writing control/position-estimation software, tuning settings, running firmware builds and simulations — and ran multiple Claude instances in parallel roles (code, research, review). Safeguards blocked many requests; actors hid goals/products and split work across sessions. Anthropic does not have evidence they fielded an operational device, but they did test-fire a guided rocket that appears to have failed (they returned to Claude within hours to diagnose). Accounts banned; threat info shared with partners. Actors had already built an offline simulation toolkit that does not rely on Claude or MATLAB. Anthropic does not name the actors; northern Yemen is Houthi-controlled territory (wire coverage notes that context). Distinct from desk cards anthropic-shinyhunters-apk-20260911 and anthropic-gtg20006-midnight-blizzard-20260911 (same TI report, different cases). Primary: Anthropic TI; wire: SecurityWeek / AP.
Anthropic — Detecting and countering misuse of AI (Sep 2026 TI)
Anthropic’s September 2026 Threat Intelligence report (activity December 2025–August 2026) case GTG-50014 covers ShinyHunters-affiliate smash-and-grab operators. One French-speaking operator (aliases MeowSHA / frkoo / blazespider) ran a Claude-accelerated credential pipeline across ten AWS EC2 workers that mass-downloaded 1.8 million distinct Android APKs from multiple app-store sources, decompiled them, and scanned for hardcoded secrets with TruffleHog, routing verified findings to a Telegram group with over 100 source types. A parallel GitHub organisation-email harvester fed stolen GitHub Personal Access Tokens. Anthropic says those two pipelines supplied initial-access credentials for the bulk of confirmed breaches tied to frkoo. Same case cluster includes a carding storefront at policenationale[.]cc / autoshop, Azure AD token theft via AI agents (reported ~2,100 token sets across 40+ Microsoft tenants in ~34 hours in wire coverage), and SaaS secondary victim data theft. Distinct from desk card anthropic-gtg20006-midnight-blizzard-20260911 (Russian espionage malware-rebuild) and from adapthealth-shinyhunters-20260909 (named victim). Anthropic disrupted the misuse. Primary: Anthropic TI report; wire: BleepingComputer (11 Sep).
Anthropic — Detecting and countering misuse of AI (Sep 2026 TI)
Anthropic’s September 2026 Threat Intelligence report (activity disrupted December 2025–August 2026) details case study GTG-20006, which Anthropic assesses as consistent with public reporting on Russian state-nexus Midnight Blizzard. Operators used Claude-driven workflows to develop, stage, and operate tooling; when monitoring agents saw malware flagged by security products, other agents autonomously modified and rebuilt it until detections were evaded, then staged the toolkit from disposable hosts. Anthropic says more than 20 organisations were in the actor’s planning/recon/live ops set (Ukrainian and European government, defence, diplomatic, think-tank and defence-industrial targets, with some Middle East and Asia reach). Observed theft includes mailboxes from at least two drone-component manufacturers and a full proprietary drone-vision SDK (architecture, BOM, suppliers). Separately the actor compromised at least three hospitality vendors’ hotel guest Wi-Fi admin paths, DNS-hijacked guest traffic (Microsoft CaptiveCrunch), and used headless-browser WhatsApp companion linking to export conversations. Anthropic disrupted the misuse and shared intelligence with partners. Primary: Anthropic TI report; wire: SecurityWeek (11 Sep 2026).
Anthropic — Detecting and countering misuse of AI (Sep 2026 TI)
The Florida Department of Highway Safety and Motor Vehicles (FLHSMV) confirmed a DAVID driver-database breach; according to BleepingComputer, the confirmation came after the ShinyHunters extortion group claimed it had breached the database. In a statement posted to X, FLHSMV said it learned of the breach on 4 September 2026, that it was quickly mitigated, and that no further breach is ongoing. Investigation found attackers used compromised credentials of a single Plant City Police Department user that had been improperly stored on the employee’s personal electronic device. FLHSMV notified the Florida Office of the Attorney General and is working with the Florida Digital Service and Florida Department of Law Enforcement; further detail withheld pending the criminal investigation. FLHSMV has not disclosed how many records were accessed. According to BleepingComputer, FLHSMV's finding that a single user's stolen credentials were used differs from how ShinyHunters claimed to have got in. No Australian nexus identified. Primary: FLHSMV X statement; wire: BleepingComputer (11 Sep). Updated 16 Oct 2026: FLHSMV issued a public notice saying its investigation with the Florida Digital Service and the Florida Department of Law Enforcement found the potentially affected information includes driver licence and motor vehicle data, including document images, and other personal information. It is mailing letters this week to current driver licence and ID card holders who may be affected, offering one year of identity and credit monitoring plus $1 million identity-theft insurance through Sontiq, a TransUnion company. Because it may not have current addresses for former licence, ID or title holders, it also issued a substitute notice under Florida's breach law (s. 501.171) and asks them to contact the department if no letter arrives. FLHSMV still has not said how many people are affected and says it has no evidence the data has been misused. Primary updated to the FLHSMV public notice (16 Oct). Correction (25 Oct 2026): removed the extortion group's own claims about how many records it took, how it got in and the screenshot it offered as proof; FLHSMV has not confirmed any of them. (source: BleepingComputer) Correction (27 Oct 2026): the card date has moved from 8 to 11 September 2026, the earliest date its linked sources visibly show (BleepingComputer's report and FLHSMV's statement on X, both 11 September). (source: BleepingComputer)
FLHSMV — Public Notice Regarding September Security Incident (16 Oct 2026)
Trezor's blog (10 September 2026) says that on 9 September 2026 Brevo, the third-party marketing platform Trezor uses for newsletter campaigns, suffered a security incident affecting 120 Brevo accounts, and an unauthorised actor used Brevo's system to send emails from various customer accounts, including Trezor's. Trezor says the incident affected its opt-in newsletter database of roughly 347,000 email addresses, that no other Trezor system was touched, and that it suspended the Brevo account. The phishing email, subject “Critical Security Alert: STM32 Entropy Vulnerability”, contained a link that prompted users to download an app asking for their wallet backup. Trezor says it took the domain down at the DNS level within 20 minutes, limiting access to 2,500 people who had clicked before the takedown, and contacted all 347,000 recipients. According to BleepingComputer (11 September 2026), the fake alerts came from help@trezor.io and claimed that a “hardware microcontroller vulnerability” in the STM32 microcontrollers used in Trezor wallets could expose seeds to brute-force cracking. Trezor's advice: anyone who entered a wallet backup through such a link should immediately move their funds to a new wallet; Trezor will never ask for a wallet backup. This is a different incident from Brevo's 14 September Cloudflare Worker ClickFix compromise (separate desk card). Primary: Trezor blog. Updated 17 Sep 2026: Trezor's post now says Brevo confirmed that 347,149 marketing email contacts were exported from Trezor's list through the API during the incident. (source: Trezor blog, trezor.io) Correction (25 Oct 2026): the card date has moved from 11 to 10 September 2026, the date of Trezor's blog post, which gives a date but no time; BleepingComputer's report is dated 11 September. (source: Trezor blog, trezor.io) Correction (28 Oct 2026): removed a US Eastern and Perth time given for BleepingComputer's report, which shows its time with no time zone; the card date stays 10 September. (source: BleepingComputer)
Trezor blog — Security incident at Brevo, our third-party email provider (10 Sep 2026; updated 17 Sep 2026)
SpyCloud (published 10 September 2026; Cyber Security News amplify 21 September) reverse-engineers Remus, a Windows information stealer that appeared on underground markets around March 2026. Collection: data from 21 browsers and 16 cold wallets, an unusually broad set of Mozilla extensions including 2FA tools, plus recent builds that steal AI credential folders used by Anthropic, OpenAI and other providers (API tokens and LLM usage history). Delivery commonly via ClickFix fake-CAPTCHA lures (email, malvertising, compromised sites) that persuade the victim to run a command. Evasion: OLLVM-style string/arithmetic obfuscation overlapping LummaC2 tooling lineage; pre-run syscall-hook sweep that removes EDR hooks; ChaCha20-encrypted C2 table; Outlook .pst honey@pot.com sandbox check. Distinct from desk card okta-ai-token-infostealer-20260909 (Okta TI on replayable AI session tokens in stealer logs generally) — this card is the Remus family analysis. No CVE.
SpyCloud — Remus: A New Infostealer Hunting Wallets, Passwords, and AI Credentials (10 Sep 2026)
Cyber Daily (10 September 2026, 06:23 UTC; 2:23 pm Perth) reports Australian financial-hardship charity Way Forward disclosed a cyber incident at an external customer-management platform provider. In a 9 September statement the charity said payment arrangements initiated through the affected system were unavailable, clients were notified as a precaution, and creditors were asked for a temporary payment moratorium so client credit reports stay unaffected. A spokesperson later told Cyber Daily the provider’s initial analysis indicated impacted information related mostly to the provider’s own company, still subject to change while the provider investigation continues. The provider was not named. Primary: Cyber Daily quoting Way Forward. Correction (26 Oct 2026): removed a link to Webber Insurance's breach list, which only repeats Cyber Daily's report, and notes about pages that did not load; every fact on this card is from Cyber Daily's report. (source: Cyber Daily)
ABC News (10 September 2026) reports a Downing Centre Local Court hearing for Christopher John Duff, 40, who has pleaded not guilty to four counts of accessing restricted data held in a computer. NSW Department of Communities and Justice discovered a breach of the NSW Online Registry (court-user login portal) in March 2025; police say cybercrime detectives investigated alleged unauthorised access to 8,769 restricted documents between January and March 2025 (AVOs, details of minors, and other DCJ forms). Prosecutors allege Duff used ChatGPT to create Python scraper-style scripts for bulk download, then sought legal advice and “coaching” from ChatGPT after his registry login was shut down and before charge — and intend to rely on ChatGPT conversation records plus forensic testimony in what is described as among the first such Australian cases. Hearing stalled on volume (~10,000+ pages of proposed exhibits). Charged April 2025 after a search warrant in Sydney’s east; on bail. Allegations unproven. Primary: ABC; wire: ACS Information Age (10 Sep).
GitLab Critical Patch Release (10 September 2026) ships CE/EE 19.3.2, 19.2.6 and 19.1.8. CVE-2026-85706 is a Critical path traversal in the repository commits API (improper path confinement plus missing authentication enforcement) that can let an unauthenticated requester read arbitrary files from the GitLab server under certain conditions. GitLab CVSS 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N). Impacted: CE/EE from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2. Reported via HackerOne by s3ntago. Same release also fixes CVE-2026-87719 (EE GraphQL subscription serializer insecure deserialization; authenticated Duo Chat user; CVSS 9.9) plus further High issues. GitLab.com is patched; Dedicated customers need no action; self-managed must upgrade immediately. NEW 11 September 2026: watchTowr reports in-the-wild probes for CVE-2026-85706 within a day of disclosure (POST /api/v4/projects/{id}/repository/commits/ with file.path). Hunt those log lines. Primary: GitLab docs patch release; secondary: watchTowr / SecurityWeek / BleepingComputer. UPDATE 11 September 2026: CISA added CVE-2026-85706 to KEV (dateAdded 2026-09-11; catalogVersion 2026.09.11). Self-managed instances that have not taken 19.3.2 / 19.2.6 / 19.1.8 should treat this as actively exploited and patch immediately.
Gen Digital Threat Labs (Alexandru-Cristian Bardaș, published 10 September 2026) details CVE-2026-51990 in Sogou Input Method for Windows: a one-click remote code execution chain combining unvalidated command-line argument injection in the sgbiz: custom protocol handler, unrestricted URL navigation in a CEF webview, and an outdated unsandboxed Chromium/CEF build (libcef.dll reported as CEF 80.1.16 / Chromium 80.0.3987.163). Gen observed UNC3569 exploiting the flaw in the wild via a crafted link to deploy the GRAYRABBIT backdoor. The issue was reported to Tencent on 9 April 2026 and fixed in Sogou Input Method version 16.3.0.3498 (released 21 April 2026): the patch validates URL arguments accepted through the protocol handler, permits only HTTPS, and restricts navigation to approved Sogou/Tencent domains — Gen and BleepingComputer (13 Sep 2026) still note the embedded Chromium remains outdated and unsandboxed. Primary: Gen Digital research; wires: The Hacker News (11 Sep 2026) and BleepingComputer (13 Sep 2026).
Gen Digital — Gray Rabbits / one-click Sogou backdoor (10 Sep 2026)
Wiz Research (10 September 2026) documents in-the-wild chaining of CVE-2026-42018 and CVE-2026-42016 against self-hosted JFrog Artifactory between 15 August and 8 September 2026, often dropping a custom Rust C2 backdoor. CVE-2026-42018 is an authentication flaw that can return an internal anonymous-user token to an unauthenticated requester even when anonymous access is disabled. Alone it is not admin; chained with CVE-2026-42016 (token scope / privilege escalation) Wiz saw unauthenticated requests become admin-scoped tokens, with follow-on admin account creation, malicious Groovy plugins, and Rust backdoors. JFrog's advisory lists the patched versions for CVE-2026-42018 as 7.111.20, 7.117.27, 7.125.19, 7.133.28 and 7.146.8 (rated High); for the chain, Wiz advises upgrading to 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38 or 7.161.20 or later, depending on the release branch. Distinct from desk card cve-2026-82329 (also abused). Primary: Wiz; also JFrog advisories. UPDATE 11 September 2026: CISA added CVE-2026-42018 to the Known Exploited Vulnerabilities catalog (dateAdded 2026-09-11; catalogVersion 2026.09.11). Prioritise patching self-hosted Artifactory under BOD 26-04-style exploited-first triage; hunt anonymous/admin tokens, Groovy plugins, and Rust C2 per Wiz. Correction (26 Oct 2026): JFrog's own advisory lists 7.111.20, 7.117.27, 7.125.19, 7.133.28 and 7.146.8 as the patched versions for CVE-2026-42018, and the JFrog CVE record agrees. The card had listed 7.117.27, 7.125.19, 7.133.28 and 7.146.8 as still affected and given 7.117.28, 7.125.20, 7.133.29 and 7.146.9 as the fixed builds; that has been corrected. Wiz's separate upgrade advice for the two-flaw chain is kept and credited to Wiz. (source: JFrog security advisories)
Wiz Research (10 September 2026) says CVE-2026-42016 is a privilege-escalation flaw from insufficient token scope enforcement: Artifactory validates signature/issuer but not intended scope, so a low-privileged token (including the anonymous token from CVE-2026-42018) can be escalated. Wiz observed the 42018→42016 chain in the wild 15 August–8 September 2026 alongside separate abuse of CVE-2026-82329; post-exploitation included persistent admin users, malicious Groovy plugins, and Rust C2 backdoors. Wiz lists CVE-2026-42016 impacted prior to 7.133.11 with remediated 7.133.11; for the overall campaign they urge upgrading to 7.111.21 / 7.117.28 / 7.125.20 / 7.133.29 / 7.146.38 / 7.161.20 or later and reviewing auth/admin activity. Primary: Wiz; vendor: JFrog advisories. UPDATE 11 September 2026: CISA added CVE-2026-42016 to the Known Exploited Vulnerabilities catalog (dateAdded 2026-09-11; catalogVersion 2026.09.11). Prioritise patching self-hosted Artifactory under BOD 26-04-style exploited-first triage; hunt anonymous/admin tokens, Groovy plugins, and Rust C2 per Wiz.
