Anomali Cyber Watch: Blob URL Phishing, Attackers Probing GitLab, WeChat Worm, Hackers Abused Claude, Rogue ScreenConnect Clients, Cisco Vulnerabilities

A phishing technique builds a fake login page inside the victim's browser, using a blob URL, a browser-generated address referencing content in local memory rather than on a website. The page has no stable URL to blocklist in advance, though the campaign relies on observable infrastructure, including the Microsoft redirect chain and the resource loaded from cdn.bloom[.]io. The attack begins with a DocuSign-themed email carrying a calendar invite that is not itself the malicious payload but points to a legitimate Microsoft OAuth endpoint, making the message look routine. The browser converts that resource into a blob URL and renders the phishing page locally. Researchers observed a service worker and sandboxed iframe managing the page, with backend infrastructure sending live instructions instead of a fixed redirect. Researchers said hidden command-and-control (C2) configuration indicated the page was part of a centrally managed phishing platform steered across many victims. Recommended defenses include monitoring OAuth flows and redirect chains, watching blob URL activity during authentication, flagging service worker registrations tied to external content, adopting phishing-resistant multifactor authentication such as FIDO2 keys or passkeys, using email security tools that analyze a full click path, and training staff to question document-signing requests routed through Microsoft infrastructure.

Source

Analyst Comment

For defenders, the practical shift here is narrower than it might sound: the final phishing page loses its fixed address, but the chain leading to it, including the redirects, OAuth activity, and the external resource request, can remain observable where browser, proxy, or identity telemetry captures those events. Phishing-resistant authentication provides the strongest direct control against credential harvesting in this scenario, while targeted staff training offers a complementary measure that doesn't rely on identifying the final blob URL. Blob URL and service worker monitoring can also help, but they require telemetry capable of exposing in-browser activity and may not be available everywhere, making this a useful detection-maturity goal rather than an assumed capability. The clearest lesson for users is that parts of the journey before the final phishing page, particularly the Microsoft domains and infrastructure, can be entirely genuine, so familiar branding or a trusted intermediary should not by itself be treated as evidence the destination is safe. On attribution, the hidden command and control configuration points toward a managed, centrally operated platform, though the public evidence doesn't establish how widely it has been deployed or how many victims are involved, so treat scale and reach as an open question.

GitLab released versions 19.3.2, 19.2.6, and 19.1.8 for Community Edition and Enterprise Edition on September 10, 2026, fixing a critical vulnerability tracked as CVE-2026-85706. The flaw sits in GitLab's repository commits API and, under certain conditions, allowed an unauthenticated user, meaning someone with no account or login, to read arbitrary files from the server due to improper path confinement and missing authentication checks. GitLab assigned it a Common Vulnerability Scoring System (CVSS) score of 10.0, the maximum possible rating. The bug affects GitLab CE/EE versions from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2. GitLab.com was already running the patched version at disclosure, and GitLab Dedicated customers were told no action was required. Researchers reviewed GitLab's technical details, reproduced the vulnerability, and assess with high confidence that it will rapidly transition to indiscriminate, in-the-wild exploitation, citing the flaw's low complexity. A global honeypot network operated by researchers had already detected behavioral probes targeting the flaw, which they said indicates attackers had reverse engineered and reproduced it. Defenders were advised to review logs for HTTP POST requests to the repository commits API containing file path parameters, and to patch affected self-hosted instances or restrict public access immediately.

Source

Analyst Comment

This moved from patch to confirmed exploitation in about a day, and that speed is the real story here. GitLab shipped a fix on September 10, researchers saw probing within a day, and CISA added the flaw to its Known Exploited Vulnerabilities catalog by September 11, the second critical GitLab vulnerability in recent weeks to see exploitation attempts shortly after disclosure. If you run a self-managed CE/EE instance in the affected range and it faces the internet, treat this as immediate rather than queued, since CISA's listing confirms exploitation occurred in the wild, though it does not establish how widespread or indiscriminate that activity has become. GitLab.com and GitLab Dedicated customers do not need to take patching action for this vulnerability. Patching answers whether the door is now closed, not whether anyone already walked through it, so anyone exposed during that window should also check logs for the documented indicator, POST requests to the repository commits API containing a file.path parameter, rather than assuming the patch alone ends the response. The broader pattern is that developer infrastructure holding CI/CD secrets and source code is increasingly targeted, since one foothold can unlock access well beyond the platform itself.

Researchers at California-based cybersecurity firm Calif developed WeWorm, a proof-of-concept worm that exploits a memory corruption vulnerability in WeChat's Voice over Internet Protocol (VoIP) stack to achieve zero-click remote code execution against vulnerable WeChat clients on both iOS and Android. The attack depends on the additional trust WeChat affords existing contacts, allowing a crafted incoming call from a user's friend list to trigger exploitation while the device is still ringing and before the recipient interacts with it. Successful exploitation takes only seconds and gives the attacker full control of the victim's WeChat account, enabling them to read and send messages, place calls, and act on the victim's behalf. Full control of the underlying device would require chaining additional Android or iOS vulnerabilities. WeWorm turns each compromised account into a propagation point, using it to call the victim's contacts and repeat the infection chain. Although the initial attacker must be on the target's friend list, compromising one trusted account provides access to additional users through their existing contact relationships. Calif reported the vulnerability to Tencent on July 24, 2026. Tencent published patched versions, Android 8.0.77 and iOS 8.0.76, on August 21. Calif confirmed on August 28 that its exploit had been blocked server-side for all users. Tencent reported no evidence the vulnerability was exploited or that any users were affected. Full technical details remain withheld pending a planned conference presentation.

Source

Analyst Comment

WeWorm is patched and Tencent has confirmed no evidence of exploitation, but the disclosure carries forward-looking significance defenders should not overlook. The friend-list prerequisite limits initial targeting, though its protective value diminishes once one account is compromised, as the hijacked identity provides a trusted path to additional contacts. Enterprise exposure will vary by geography, workforce demographics, and business relationships. Where WeChat is present on unmanaged personal devices used for work, an account compromise may fall outside normal endpoint and email monitoring, and could support executive or supplier impersonation, credential phishing, or attempts to pivot targets into corporate communication channels. The more significant intelligence signal is Calif's confirmation that WeWorm is the first in a research series examining zero-click attack surfaces across mobile messaging platforms. Further disclosures should be anticipated, potentially involving applications with greater enterprise penetration. Calif also reported that, with AI assistance, its team produced an initial remote code execution exploit in approximately two days and completed the worm roughly one week later, suggesting AI may be lowering the time and specialist effort required for this class of work. When the full technical analysis is released at conference, defenders should reassess WeChat-specific exposure and consider whether disclosed exploitation primitives or trust relationships have meaningful analogues in other messaging platforms.

Anthropic's September 2026 threat intelligence report documents the disruption of threat actor operations abusing Claude between December 2025 and August 2026 across seven harm areas, including cyber operations, influence operations, surveillance, and biological misuse. A suspected ShinyHunters affiliate operating as 'frkoo' built a credential-harvesting pipeline across ten cloud workers that mass-downloaded 1.8 million Android application files (APKs), decompiled them, and scanned for hardcoded secrets using TruffleHog, routing verified findings in real time to a Telegram group organized into over 100 source types; a parallel pipeline harvested GitHub Personal Access Tokens through organization email enumeration. These pipelines supplied initial access for confirmed breaches at a technology provider (over one terabyte exfiltrated), an airline (tens of millions of passenger records accessed), and an energy company where operators claimed the ability to remotely control customers' electric-vehicle chargers, as well as a supply chain attack exposing data from approximately 200 downstream customers of a compromised software-as-a-service (SaaS) provider. A separate suspected ShinyHunters affiliate extracted over 2,100 Azure Active Directory (AD) authentication token sets across more than 40 corporate tenants in approximately 34 hours, with AI agents performing nearly all of the work. Midnight Blizzard, attributed to Russian state-nexus espionage consistent with public reporting, automated its full attack lifecycle through Claude, including a feedback loop that rebuilt malware each time security products detected it, targeting Ukrainian government entities, drone supply chain companies, and diplomatic missions. A Chinese-speaking group tracked as GTG-10007 ran unattended AI workflows that produced multiple previously-unknown vulnerabilities and working exploits for network and security appliances, with confirmed compromises at an education-technology company, a retailer, and a Southeast Asian government agency across a targeting scope of approximately 50 organizations.

Source

Analyst Comment

Actor class is no longer a reliable signal of campaign sophistication. A suspected financially motivated affiliate, university students, and an assessed state intelligence service ran operationally comparable campaigns within the same reporting window, reflecting a structural shift in the threat environment rather than escalation by any individual actor. For most organizations, the ShinyHunters activity is most directly relevant: exposure is determined by secrets management practices, not organizational prominence, and any application that has shipped with a hardcoded credential may already have contributed to an attacker's initial access inventory. Downstream supply chain victims had limited ability to prevent their own exposure in either documented mechanism, as attackers abused delegated trust within infrastructure the victims did not control. Defensive priorities include short token lifetimes, credential rotation following confirmed supplier compromise, supplier security assessment, and monitoring for anomalous OAuth activity. AI API keys warrant the same access controls and rotation policies as production infrastructure credentials; this report documents stolen keys used as operational infrastructure for secondary attacks against unrelated third parties, with activity attributed to the legitimate key owner. Attack tempo varied across operations; autonomous agentic workflows can sustain activity while human operators are absent, which erodes detection strategies dependent on human behavioral patterns or working-hours activity windows. Attribution for state-nexus activity reflects Anthropic's assessments; defenders should weight documented tactics and procedures accordingly.

Researchers identified worm-like activity abusing ConnectWise ScreenConnect across three unrelated incidents in August 2026, each initiated through social engineering: a Quick Assist tech-support scam, an MSI installer likely delivered via phishing, and a fake Geek Squad refund form. Rogue ScreenConnect clients spawned wscript.exe to execute a four-stage Visual Basic Script (VBScript) chain (1.vbs through 4.vbs). The first script profiles the host by enumerating named endpoint security products, checking available RAM, and verifying existing ScreenConnect installations, writing a three-bit state value to %TEMP%\value.txt that directs subsequent stages to the appropriate payload for that machine's security posture. Later stages download an encrypted payload map from Dropbox, retrieve the matching payload, then launch runner.ps1, which decrypts the payload using AES-CBC and executes a second PowerShell script (PyTorchFix.ps1) delivering one of three outcomes: a hidden ScreenConnect backdoor, privilege escalation and persistence tooling, or tunneling utilities paired with an XMRig cryptocurrency miner. Modified ScreenConnect clients push the VBScript chain to newly connected host sessions, creating worm-like propagation. Persistence is maintained via a WindowsServiceHost registry Run Key. CISA added CVE-2026-84869 (CVSS 9.9) to its Known Exploited Vulnerabilities catalog on September 11, 2026; on-premises deployments should upgrade to ScreenConnect version 26.6.5, and hosts confirmed as compromised should be reimaged from known-good media.

Source

Analyst Comment

Spread is not autonomous; it requires an active Host session, meaning someone connecting to a compromised machine is the necessary condition for further infection. The risk is bounded by behaviour rather than network reachability, but that is limited reassurance in environments where routine support activity generates frequent ScreenConnect connections. MSP technicians and internal IT staff connecting to managed endpoints are the likely downstream victims, not through initial infection, which involved standard end-user social engineering, but through routine support activity thereafter. CVE-2026-84869 is the mechanism that makes propagation possible, not a parallel concern; it describes the client-side flaw allowing file-transfer actions to execute on a connecting Host without authorisation. Patching to 26.6.5 closes that path but does not remediate hosts already compromised. The payload branching logic merits attention: the chain profiles each host's security posture, with defence degradation and cryptocurrency mining delivered when only Microsoft Defender is present and no existing ScreenConnect clients are installed, while machines meeting only the Defender condition receive privilege escalation and persistence tooling instead. Whether this reflects deliberate operational discipline or a more developed payload set for lower-security targets is unclear from available sources. All pre-26.6.5 deployments should be upgraded immediately; upgrading requires reinstalling host clients and updating access agents, and cloud deployments still require a client-side refresh despite the server updating automatically. Hosts where compromise is confirmed or suspected should be reimaged rather than remediated in place.

Cisco Talos is tracking active exploitation of two Secure Firewall Management Center (FMC) vulnerabilities by three distinct threat clusters. CVE-2026-20079 (CVSS 10.0) is a critical authentication bypass granting unauthenticated remote attackers root-level operating system access; CVE-2026-20316 (CVSS 5.3) exposes hardcoded static credentials for low-privileged access, chainable with other FMC flaws to escalate privileges. UAT-12197 planted a web shell and Java-based command executor via CVE-2026-20079, extracting user credentials from internal databases. UAT-11823, a cluster Talos attributes with high confidence to an APT actor with tooling overlapping the Russian state-sponsored Sandworm group, deployed Netcat reverse shells and the Cyclops Blink modular implant; documented capabilities include persistence, DNS-over-HTTPS resolution, credential harvesting, network scanning, and packet sniffing. UAT-11988 accessed the FMC via static credentials, conducted Active Directory reconnaissance, established tunneling for persistent network access, deployed AV killers, and executed Qilin ransomware on selected endpoints; Talos assesses with high confidence that UAT-11988 is a ransomware operator, with post-access TTPs consistent with Qilin affiliate behavior. Cisco's hotfixes prevent future exploitation but do not remediate already-compromised devices; organizations identifying the published indicators of compromise should contact Cisco TAC for recovery guidance. CISA added CVE-2026-20079 to its Known Exploited Vulnerabilities (KEV) catalog with a September 12, 2026 patching deadline for federal agencies.

Source

Analyst Comment

Three operationally distinct threat actors have been observed exploiting the same two vulnerabilities within the same window of activity, which may suggest working knowledge of these flaws became broadly available quickly, though independent discovery cannot be ruled out. The most actionable finding concerns patch prioritisation. UAT-11988, the Qilin-affiliated ransomware operator, gained initial access through CVE-2026-20316, the CVSS 5.3 static credential flaw, not the CVSS 10.0 authentication bypass. CVSS scores measure exploitability and impact in isolation and do not reflect how attackers chain or sequence vulnerabilities in practice; this case illustrates that gap directly. Organisations following CISA's Known Exploited Vulnerabilities (KEV) catalog would have been directed to patch CVE-2026-20316 by August 1, underscoring that intelligence-driven prioritisation frameworks already address the blind spot CVSS-only triage creates. The UAT-11823 cluster, regardless of whether the Sandworm tooling overlap reflects direct attribution or reuse, shows behavior consistent with strategic intelligence collection rather than immediate disruption, and should be assessed separately from the ransomware cluster. An attacker with FMC management-plane access can silently alter firewall policy, degrade traffic visibility, and abuse trust relationships across the managed device estate. Cisco advises hotfix application and use of published Snort signature IDs; hotfixes do not remediate already-compromised devices. Analyst assessment additionally recommends treating a confirmed compromise as grounds to rotate credentials the FMC has accessed and extend investigation to the managed firewall estate.