Cyber Threat Brief — August 10 2026
⚠️ This report is AI-generated. Always validate findings.
1. CSS Webmail Attacks — Outlook Password Theft via Email-Embedded CSS
TL;DR: PortSwigger’s Gareth Heyes disclosed at Black Hat USA multiple CSS-based attack chains that break webmail sanitizer boundaries in Outlook, Gmail, Yahoo/AOL, and Fastmail — enabling real-time password capture and token exfiltration from crafted emails. Outlook’s label-jacking and Gmail’s image-set() bypass remain unpatched.
What’s New:
- CSS properties escape message
<div>boundaries in all major webmail clients, manipulating trusted UI elements (login prompts, navigation, labels) - Outlook/Firefox chain: CSS gadget spoofs Microsoft sign-in screen, captures typed password in real-time via CSS keylogger
- Yahoo/AOL chain: paste-race condition exposes Medium email-login tokens for account takeover
- Gmail chain:
image-set()bypass enables cross-origin data exfil; combined with AI email tools for prompt injection → Slack token theft - Fastmail fixed two CSS mutation bugs; Proton Mail proxy bypass self-resolved; Outlook and Gmail attacks still work as of August 6 publication
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
CSS position: fixed/absolute escaping message container | TTP | T1189, T1204.001 | Email gateway / HTML sanitizer logs | Hunt — audit sanitizer CSS property allowlists |
image-set() CSS function in email HTML | Exfil vector | T1567 | O365 message trace, email gateway | Block — strip image-set() from inbound email CSS |
CSS @import directives in email body | Exfil vector | T1071.001 | Email gateway, web proxy | Block — strip external CSS imports from email HTML |
Label for= attribute hijacking login inputs | Credential theft | T1056.004 | Browser telemetry, Outlook web logs | Detect — monitor for label elements targeting input fields outside message scope |
Emails with <style> blocks containing position: fixed or z-index > 9999 | Malicious indicator | T1204.001 | Email content inspection | Hunt — flag emails with UI-overlay CSS properties |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None | No rule for CSS property abuse in email content |
| Elastic | None | No rule for webmail CSS boundary escape |
| Sigma | None | No rule — new attack class requires email-layer CSS inspection |
Sources: The Hacker News, GBHackers, SecurityAffairs
2. AI-Autonomous Exploitation Campaign (knaithe) — CVE-2026-34486 Update
TL;DR: Unit42 attributed CVE-2026-34486 Tomcat EncryptInterceptor exploitation to a Chinese-speaking actor (knaithe/KnYuan, Zhuhai) using DeepSeek via the Hermes Agent framework for autonomous target selection and exploitation across 460+ targets.
What’s New:
- Unit42 disclosed full campaign details: knaithe used DeepSeek LLM as autonomous operator via open-source Hermes Agent framework
- AI agent autonomously identified targets, narrowed scope, and selected exploits — executing “hundreds of hours of manual targeting analysis in minutes”
- CVE-2026-34486 (Tomcat) exploited alongside Citrix NetScaler and Marimo Notebook vulnerabilities
- Confirmed impact: data exfil from 3 NetScaler targets, code execution on 11 Marimo instances
- Campaign used hybrid approach: AI-driven reconnaissance + manual exploitation for high-value targets
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| Tomcat Tribes clustering port 4000/TCP | Attack surface | T1190 | Firewall logs, netflow | Block — ensure clustering ports are not internet-exposed |
| CC6 gadget chain Java deserialization payloads | Exploitation payload | T1190 | WAF, IDS/IPS | Detect — Java deserialization signatures on port 4000 |
| knaithe / KnYuan | Threat actor alias | — | Threat intel platform | Track — emerging AI-augmented threat actor |
| Hermes Agent + DeepSeek autonomous scanning | TTP | T1595.002, T1190 | External scan logs, honeypots | Hunt — rapid sequential exploitation attempts across heterogeneous CVEs from single source |
| Tomcat versions 11.0.20, 10.1.53, 9.0.116 | Vulnerable asset | T1190 | Asset inventory | Patch — upgrade to 11.0.21, 10.1.54, 9.0.117 |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | Web or Application Server Spawning a Shell (generic) | No Tomcat EncryptInterceptor-specific rule |
| Elastic | None | No detection for Tribes clustering exploitation |
| Sigma | Suspicious Java Process Spawning Shell (generic) | No EncryptInterceptor fail-open detection |
Sources: Unit42, BleepingComputer, Infosecurity Magazine
Status Updates
- CVE-2026-8037 (Progress Kemp LoadMaster): Federal CISA KEV deadline TODAY August 10. 792 exploitation attempts from 65 IPs across 18 countries. Patch to GA 7.2.63.2 or LTSF 7.2.54.18. CISA. Brief: Aug 9.
- CVE-2025-68686 (FortiOS): Federal CISA KEV deadline TODAY August 10. Symlink persistence bypass enables post-compromise data access. Brief: Aug 7.
- CVE-2026-6875 (ServiceNow): Active exploitation entering 6th week. Two sandbox-escape gadget chains confirmed. Fortune 500 and critical infrastructure victims. Still NOT on CISA KEV. Brief: Jul 21.
- CVE-2026-15409/15410 (SonicWall SMA1000): INC ransomware exploitation continues. 885+ victims per Resecurity. Brief: Jul 15.
- Metabase SQLi Zero-Day: Exploitation ongoing since Aug 3. Framework and Tally confirmed victims. No CVE assigned. Not on CISA KEV. Brief: Aug 9.
- CVE-2026-63077 (JetBrains TeamCity): Federal deadline passed Aug 8. Active exploitation of pre-auth deserialization RCE. Brief: Aug 7.