Cyber Threat Brief — September 13 2026
⚠️ This report is AI-generated. Always validate findings.
1. Passkey/SSO Vishing → M365 Exfil — Storm-3121 / Storm-3032
TL;DR: Microsoft (blog 2026-09-09; THN amplify 2026-09-13): Storm-3121 (→ ShinyHunters/Falcon) and Storm-3032/UNC6671 (→ Helix) use helpdesk vishing/SMS passkey-SSO lures into AiTM or device-code flows, then register attacker MFA (NO_DEVICE / SoftwareTokenActivated), Graph-recon, and paced SharePoint/OneDrive/python-httpx + Exchange REST exfil (since May 2026).
What’s New:
- THN 2026-09-13 elevates Microsoft’s cloud-compromise writeup; BC covered 2026-09-11 — first brief lead
- Lure domains (company as subdomain):
passkeyhelpdesk.com,secure-passkey.com,setupmypasskey.com,add-passkey.com,integratedsso.com,oktasession.com,keysyncos.com,oskeysync.com,oskeysetup.com,oskeyregister.com,syncmykey.com,myconnectkey.com,oskeyconnect.com,validationsetupac.com,portalsetuphub.com - Persistence: Entra
Update user.adding MFA withDeviceName=NO_DEVICE,DeviceToken=NO_DEVICE_TOKEN,DeviceTag=SoftwareTokenActivated - Exfil:
UserAgentcontainspython-httpxon SharePoint/OneDrive FileDownloaded/FileAccessed; Exchange REST via apps One Outlook Web / AppIds9199bf20-a13f-4107-85dc-02114787ef48,d3590ed6-52b3-4102-aeff-aad2292ab01c - Mitigate: phishing-resistant MFA CA; block device-code flow; require managed device for SPO/EXO/Graph; revoke sessions + remove attacker MFA on hit
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
Domains passkeyhelpdesk.com, secure-passkey.com, setupmypasskey.com, add-passkey.com, integratedsso.com, oktasession.com, keysyncos.com, oskeysync.com, syncmykey.com, portalsetuphub.com (and *. org-name subdomains) | Phishing infra | T1566.002 / T1598.003 | DNS / proxy / Secure Email Gateway | Block + hunt historical resolves/clicks; alert company. + passkey/SSO keywords |
Entra Sign-in authenticationProtocol=deviceCode (or originalTransferMethod=deviceCodeFlow) after helpdesk/SMS passkey lure | Device-code phish | T1528 / T1566.002 | Entra SignInLogs / Splunk azure:monitor:aad | Alert; revoke refresh tokens; Conditional Access block device code except allow-listed apps |
Audit Update user. MFA add with DeviceName=NO_DEVICE / DeviceToken=NO_DEVICE_TOKEN / DeviceTag=SoftwareTokenActivated | Attacker MFA persist | T1556.006 | Entra AuditLogs / CloudAppEvents | Remove unauthorized methods; force phishing-resistant re-registration; reset password + revoke sessions |
| Sign-in to OfficeHome from unmanaged device → rapid My Apps / My Sign-Ins / SharePoint Online / Outlook Web within ~1h | Post-ATO recon | T1078.004 / T1087.004 | Entra SignInLogs | Correlate sessionId; treat as compromise if followed by MFA add or Graph blast |
Graph URIs /users, /groups, /directoryRoles, /authentication/methods, /sites, /drives, /messages, /attachments (≥3 categories, same actor+IP, 30m) | Graph recon | T1087.004 / T1069.003 | GraphAPIAuditEvents / Microsoft Graph activity logs | Alert; revoke tokens; review OAuth grants Mail.Read / Files.Read.All / Directory.Read.All |
O365 UserAgent contains python-httpx + FileDownloaded/FileAccessed on SharePoint/OneDrive (AppId 20892/15600) or Exchange REST ≥500/h (AppId 20893) | Automated exfil | T1567 / T1530 / T1114 | O365 Unified Audit / CloudAppEvents | Isolate identity; revoke sessions; hunt FileDownloaded volume since first suspicious sign-in |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | Partial — verified logic — Azure AD Device Code Authentication (properties.authenticationProtocol=deviceCode); Azure AD New MFA Method Registered For User (User registered security info Add); O365 Exfiltration via File Download (FileDownloaded count>50) | No ESCU for python-httpx UA, NO_DEVICE/SoftwareTokenActivated MFA tags, or Graph multi-category recon matrix |
| Elastic | Partial — verified logic — Entra ID OAuth Device Code Grant by Unusual User; Entra ID OAuth Device Code Flow with Concurrent Sign-ins; O365 device-code on noncompliant device | No mapped rule for Storm-3121 domain list or python-httpx SPO exfil |
| Sigma | Partial — verified logic — Application Using Device Code Authentication Flow (properties.message: Device Code) | No SigmaHQ ET-2026 rules for passkeyhelpdesk*/NO_DEVICE MFA persistence |
Hunt hint: Chain (1) DNS/proxy hits to named passkey/SSO domains → (2) Entra deviceCode or unmanaged OfficeHome → (3) MFA Add with NO_DEVICE/SoftwareTokenActivated → (4) Graph /users+/sites+/messages same IP → (5) python-httpx FileDownloaded. On hit: revoke sessions/tokens, remove attacker MFA, reset creds, block device-code CA.
Sources: Microsoft Security Blog, The Hacker News 2026-09-13, BleepingComputer
2. SGLang SafeUnpickler Unauth RCE — CVE-2026-86793
TL;DR: VicOne (2026-09-11): CVE-2026-86793 bypasses SGLang SafeUnpickler via allowed builtins.__import__ + builtins.getattr → os.system. Unauth POST /update_weights_from_tensor (and related /load_lora_adapter_from_tensors) when no API keys configured; affected ≤0.5.14 (CVE also cites through 0.5.18). No official patch as of disclosure — enable auth keys + network-restrict endpoints.
What’s New:
- VicOne primary + CERT/CC CVE 2026-09-11; X amplify 2026-09-13 (still unpatched / “Safe” naming called out)
- Root cause:
"builtins."inALLOWED_MODULE_PREFIXES+ incompleteDENY_CLASSES(misses__import__/getattr) after CVE-2025-10164 mitigation - Entry: base64 pickle in
serialized_named_tensorsonPOST /update_weights_from_tensor(AuthLevel.ADMIN_OPTIONAL→ open if no keys) - Interim: set
--api-key/--admin-api-key; firewall SGLang HTTP to trusted nets; prefer exact-name builtins allowlist (VicOne/PRs)
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| SGLang versions ≤0.5.14 (CVE range through 0.5.18) (CVE-2026-86793) | Vulnerable AI inference | T1190 | CMDB / pip show sglang / container image tags | Inventory all SGLang HTTP servers; treat internet-exposed unauthenticated instances as critical |
Unauth POST /update_weights_from_tensor with body field serialized_named_tensors (base64 pickle) | Exploit probe / RCE | T1190 / T1059 | Reverse proxy / SGLang access log / WAF | Alert + block unauthenticated POSTs; require --api-key/--admin-api-key; isolate host on 200 + anomalous child processes |
Unauth POST /load_lora_adapter_from_tensors (no @auth_level / NORMAL when only admin key set) | Alternate RCE path | T1190 | Same HTTP logs | Same alert; disable endpoint or front with auth middleware |
Pickle gadget resolving builtins.__import__ then builtins.getattr toward os.system | Deserialization bypass | T1059.006 | App debug / EDR on SGLang worker | Hunt SGLang process spawning shell (bash/sh/curl); rotate secrets on host if RCE suspected |
Host artifact /tmp/poc_confirmed (VicOne PoC pattern) or unexpected files under SGLang cwd after weight-update POSTs | Post-exploit marker | T1105 | Host FS / Sysmon 11 / auditd | Hunt; reimage inference node if confirmed |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None — verified search | 0 CVE-2026-86793 / SGLang / update_weights_from_tensor / SafeUnpickler detections |
| Elastic | None — verified search | 0 mapped SGLang pickle / LoRA-from-tensors rules |
| Sigma | None — verified search | 0 SigmaHQ ET-2026 SGLang CVE-2026-86793 rules |
Hunt hint: On AI inference perimeter logs, alert POST /update_weights_from_tensor or POST /load_lora_adapter_from_tensors without API-key header; correlate SGLang PID → shell. Until vendor ships fix for CVE-2026-86793, require API keys and deny internet to SGLang admin HTTP.
Sources: VicOne analysis, CVE-2026-86793, GitHub issue #30165, OpenCVE
Status Updates
- MikroTrick CVE-2026-67277 / CVE-2026-86060: CISA KEV due TODAY 2026-09-13 — patch RouterOS 7.24.2 / 7.23.4 / 6.49.21; hunt
login failure for user -2and privilegedops/ssh:-2@. Sep 6 · Sep 11 - CVE-2026-85706 (GitLab) / CVE-2026-84869 (ScreenConnect): KEV due 2026-09-14 — GitLab 19.1.8/19.2.6/19.3.2; ScreenConnect clients 26.6.5+ + remove TransferFiles until done. Sep 12
- PaperCut CVE-2026-81578/82078: KEV due 2026-09-14 — continue AI-swarm hunts (
45.142.193.132,pc-*.hiv). Sep 11 - CVE-2026-20079 (FMC) / CVE-2025-25249 (Fortinet) / CVE-2026-19490 (Citrix): KEV due was 2026-09-12 — confirm hotfixes applied; continue post-deadline exposure/IR if late. Sep 10 · Sep 12
- Check Point CVE-2026-85102/85103: Dutch NCSC (2026-09-12) rates exploitation imminent — LivePatch Take 24 / Jumbo R81.20 Take 166 / R82 Take 126 / R82.10 Take 44; restrict Site-to-Site peers. Sep 11
- CVE-2026-42016/42018 (JFrog): KEV due 2026-09-25 — continue aws/token +
token:anonymoushunts. Sep 12 - Chrome CVE-2026-85046 (due Sep 18) / Windows CVE-2026-81963+85880 (due Sep 22) / Chrome CVE-2026-87491 (due Sep 23) / BlueMoon: Chrome ≥153.0.8010.36 + Sep LCU; keep BlueMoon browser→curl→
%TEMP%\msgbox.exehunts. Sep 11 · Sep 9 - PoisonedRefresh / FalconFlank: No material change — keep prior hunts. Sep 9 · Sep 5