← All threat briefs

Cybersecurity Brief - 2026-09-18

SECURITY // 2026-09-18

Cybersecurity Brief — 2026-09-18

Supply Chain & Malware

  • PhantomRaven npm supply-chain campaign attributed to LLM-assisted malware author — CrowdStrike analysis reveals a financially motivated threat actor (posing as a bug bounty hunter) developed and distributed PhantomRaven, a JavaScript info-stealer, via >100 typosquatted npm packages since October 2025. The malware uses a remote dynamic dependency (RDD) to evade static scans, harvesting CI/CD secrets, GitHub credentials, and system fingerprints. Statistical token analysis and verbose LLM-style comments indicate the code was likely generated by an LLM. The operator has claimed bounties from at least nine organizations across tech, retail, and hospitality, using stolen access as leverage. (Source: The Hacker News)

  • RatHat Android malware abuses ADB for post-uninstall persistence — Zimperium researchers detail RatHat, a China-linked Android malware delivered via smishing and malvertising. It chains Accessibility abuse with autonomous local ADB self-pairing to escape the sandbox, stage native daemons with shell privileges, and maintain access even after the victim uninstalls the app. An on-device GenAI assistant parses the live Accessibility tree to direct synthetic clicks and navigation. A Go agent (masquerading as liblocal-service.so) and an FRP reverse-proxy client provide a persistent C2 tunnel for arbitrary command execution, including hardware-level keylogging. (Source: The Hacker News)

Critical Vulnerabilities

  • Check Point Security Management CVE-2026-91843 (CVSS 9.8) — unauthenticated root RCE — A stack overflow in the pre-authentication login handler allows remote attackers to execute code as root by sending an excessively long username. The vulnerable path is reachable only via the "Trusted Clients" setting in SmartConsole. Check Point has deployed a fix via LivePatch and reports no evidence of exploitation. Censys confirms the trigger condition. (Source: The Hacker News)

  • Microsoft September Patch Tuesday — 974 vulnerabilities, largest batch ever — Microsoft patched 974 flaws across Windows and related software, surpassing the previous record of 570 (July 2026). Two actively exploited zero-days: CVE-2026-81963 and CVE-2026-85880 (both privilege escalation). Notable criticals: CVE-2026-69730 (DNS flaw in Windows Server 2012+, unauthenticated, likely exploitable) and CVE-2026-69829 (Windows Shell RCE, CVSS 9.8, no user interaction). 113 bugs rated Critical. Year-to-date total exceeds 2,600. AI-assisted discovery is driving volume; defenders struggle with testing/deployment cadence. (Source: Krebs on Security)

Data Privacy & Breach

  • Radaris.com and sister domains seized in Daniel's Law enforcement action — A New Jersey court ordered transfer of radaris.com and >12 related data-broker domains to Atlas Data Privacy Corp. after the Lubarsky brothers (operators) repeatedly ignored removal requests for law-enforcement personnel data under "Daniel's Law" ($1,000/violation). The operators used shell entities in the Marshall Islands, BVI, and Seychelles to evade service; one claimed managing entity didn't exist at the time of filing. The 2017 default judgment ($7.5M) was previously overturned on procedural grounds. (Source: Krebs on Security)

  • FBI investigates "Nexus" dark-web service selling 153M+ driver's license scans — A new identity-theft marketplace on the Exploit forum offers >153M US/Canadian driver's licenses, 10M+ ID cards, 3M+ travel documents, and 579K medical cards. Records include IR/UV scans with timestamps correlating to victims' car-rental dates (multiple victims rented from Hertz). The operator claims continuous exfiltration from a "major identity verification company" serving Fortune 500 clients. New Orleans FBI has opened an inquiry. (Source: Krebs on Security)