FlagThis — Daily Cybersecurity Intelligence Briefing

During Microsoft's September 2026 Patch Tuesday, a critical CVSS 10.0 authentication bypass (CVE-2026-85889) was disclosed in the Azure AI Foundry internal management API. This vulnerability allowed unauthenticated network attackers to invoke privileged functions, enabling immediate administrator role escalation. A subsequent chain of five vulnerabilities (CVE-2026-85890 through CVE-2026-85894) facilitated cross-tenant access, session hijacking, and arbitrary code execution within the Foundry sandbox. Concurrently, two Windows zero-day vulnerabilities in win32k.sys (CWE-416) and spoolsv.exe (CWE-120) were observed being actively exploited in the wild for approximately 72 hours before out-of-band patches were released. While the Azure vulnerability was mitigated server-side, immediate client-side patching is required for all Windows systems to prevent kernel-mode exploitation.

The Warlock ransomware group is conducting targeted campaigns against critical infrastructure sectors, including energy, water, and healthcare, by exploiting unpatched Microsoft SharePoint vulnerabilities. Attackers utilize CVE-2023-29357 for unauthenticated remote code execution (RCE) and CVE-2022-24521 for privilege escalation. Following initial access, the threat actor deploys webshells for persistence and utilizes living-off-the-land binaries like certutil and bitsadmin for lateral movement. The campaign employs AES-256 and RSA-4096 hybrid encryption coupled with double extortion via data exfiltration to leak sites. Immediate application of SharePoint Cumulative Updates is required to mitigate these high-impact exploitation vectors.

Threat actor JADEPUFFER (Storm-3168) conducted a highly automated, destructive campaign against Microsoft Azure tenants using compromised service principals. Initial access was achieved through service principal secrets exposed in public GitHub issue histories. Following a 15-hour reconnaissance phase involving ~300 read-only API calls, the actor executed a seven-minute burst of over 150 destructive operations. This included deleting >100 storage accounts, Azure Key Vaults, SQL databases, and removing Azure Site Recovery and backup protection locks. Post-destruction, the actor attempted credential harvesting via storageAccount/listKeys calls. The attack pattern—combining rapid resource destruction with recovery-impairment tactics—suggests an extortion-focused methodology designed to pressure victims through immediate operational paralysis.

The September 2026 Microsoft Patch Tuesday release addresses a historic 974 CVEs, including over 100 critical vulnerabilities. Of significant concern are two actively exploited zero-day vulnerabilities: CVE-2026-81963 (improper link resolution in the Windows Update Stack) and CVE-2026-85880 (Windows ALPC heap-based buffer overflow), both enabling elevation of privilege and sandbox escapes. Additionally, a CVSS 9.8 RCE in the Windows DNS Server presents a high risk of wormable, infrastructure-wide compromise, reminiscent of the SigRed vulnerability. With 723 vulnerabilities affecting the Windows core and high-severity RCEs in Remote Desktop Services, immediate remediation is critical to prevent lateral movement and widespread perimeter breach.

Microsoft, in coordination with law enforcement and industry partners, has dismantled EvilTokens, a Phishing-as-a-Service (PaaS) platform that exploited the Microsoft OAuth 2.0 device-code authentication flow. The campaign compromised over 12,000 Microsoft 365 mailboxes across 10,000 organizations globally by intercepting valid session tokens rather than traditional passwords. The platform utilized an integrated AI chatbot to automate mailbox reconnaissance and Business Email Compromise (BEC) fraud generation. The disruption involved seizing 50 websites and over 150 domains, following the arrest of two UK-based operators. This incident highlights the critical risk of abusing legitimate authentication flows to bypass multi-factor authentication (MFA) and the increasing integration of generative AI into automated cybercrime ecosystems.

Microsoft is integrating OpenAI's GPT-6 Astra into Copilot Cowork and Copilot Studio, introducing "Work IQ" to enable autonomous high-level task delegation grounded in organizational data. This integration expands the enterprise attack surface by allowing the LLM to access cross-application data—including chats, meetings, and files—creating new vectors for prompt injection and unauthorized data exfiltration. The primary technical risk involves potential privilege escalation where the model's reasoning engine may bypass granular Microsoft 365 permission structures, leading to the exposure of sensitive business intelligence and the execution of unauthorized actions.

The "CaptiveCrunch" campaign, attributed to the Russian state-sponsored actor Storm-2945 (a Midnight Blizzard sub-cluster), targets global travelers by compromising hospitality WiFi gateways. The attack utilizes DNS hijacking and poisoning to redirect users from legitimate captive portals to malicious, Microsoft-themed phishing sites. This redirection facilitates two primary objectives: the theft of Microsoft 365 credentials through OAuth token interception and the deployment of the CornFlake Remote Access Trojan (RAT). CornFlake enables persistent endpoint surveillance, including keystroke logging and audio/visual interception. This sophisticated operation, active since May 2026, represents a high-severity threat to enterprise users traveling internationally.

A critical patch bypass vulnerability has been identified within the Microsoft Defender Malware Protection Engine, specifically impacting systems previously remediated for CVE-2026-50656 (RoguePlanet). While Microsoft released Engine version v1.1.26060.3008 in July 2026 to mitigate a race condition and improper link resolution in mpengine.dll, a new exploit chain dubbed "ShieldBreak" has successfully circumvented this fix. Discovered by researcher Chaotic Eclipse, the ShieldBreak proof-of-concept (PoC) allows local, low-privilege users to escalate privileges to NT AUTHORITY\SYSTEM. This vulnerability presents an immediate risk of full system compromise, as the PoC is publicly available, facilitating rapid exploitation of patched environments.

Microsoft has released MAI-Cyber-1-Flash, a domain-specific small language model (SLM) optimized for cybersecurity workflows. Integrated within the MDASH (Multi-model vulnerability identification and remediation harness) orchestration framework, the model targets the automation of vulnerability identification and remediation. By utilizing a tiered architecture alongside GPT-5.4 and GPT-5.3 Codex, Microsoft aims to reduce operational costs by 50% while maintaining high precision, evidenced by a 95.95% score on the CyberGym benchmark. The deployment of Project Perception further enables autonomous AI-driven patching, shifting the defensive posture from manual vulnerability management to agentic, end-to-end remediation.

Akira ransomware affiliates are deploying a sophisticated evasion tactic by forcing compromised Windows environments into Safe Mode with Networking. By leveraging bcdedit and msconfig.exe to modify boot configurations, attackers effectively neutralize endpoint security agents—including Microsoft Defender and Huntress—that fail to initialize in the minimal Safe Mode startup environment. This technique follows initial access via credential spraying against MFA-deficient VPNs, such as SonicWall, and subsequent RDP-based lateral movement. While the Safe Mode transition successfully blinds security telemetry and facilitates data exfiltration via s5cmd to AWS S3, the akira.exe payload has encountered stability issues, including "Out of Virtual Memory" errors, which can occasionally impede the final encryption phase.