Cisco 0-Day Under Attack, Token-Stealing Phishing Kits, and a $250 RAT Subscription

Cisco Secure Email Gateway 0-Day Under Active Exploitation

Cisco disclosed on Monday that attackers are actively exploiting a critical 0-day in Secure Email Gateway, and CISA has already given federal agencies a hard deadline to fix it.

What You Need to Know

The flaw, CVE-2026-76461, carries a CVSS score of 9.8. It lets an unauthenticated attacker send a specially crafted email that triggers malicious SQL statements, ultimately allowing arbitrary command execution on the underlying OS with root privileges. Cisco's PSIRT confirmed in-the-wild exploitation this month, and CISA added the flaw to its KEV catalog on Monday, giving federal agencies until September 17 to remediate.

What's Vulnerable

The bug stems from an email-parsing issue in AsyncOS, the operating system that powers Cisco's Secure Email Gateway appliances. It affects both physical and virtual versions of the product in any configuration. Secure Email and Web Manager and Secure Web Appliance are not affected. Cisco has released IoC, but cautions that because attackers gain root access, they can remove or hide those IoCs to cover their tracks. Cisco hasn't shared specifics on the attacks themselves or attributed them to any known actor. The company also discovered several other Secure Email Gateway and Secure Email and Web Manager vulnerabilities internally during the same review that turned up CVE-2026-76461.

Why This Matters

This marks only the second Secure Email Gateway vulnerability to land on CISA's KEV list, the first being CVE-2025-20393, which China-linked hackers exploited in late 2025. It also follows separate warnings about active exploitation of two Cisco Secure Firewall Management Center flaws, CVE-2026-20079 and CVE-2026-20316, which Cisco says both Russian state-sponsored groups and financially motivated criminals have been using. Taken together, it's a reminder that Cisco's security infrastructure products, the tools meant to protect email and network perimeters, have themselves become a recurring target for both nation-state and criminal actors.

What to Do

Cisco has issued an advisory and confirmed active exploitation of CVE-2026-76461. Organizations should review the advisory for fixed releases or available mitigations, apply Cisco’s recommended remediation immediately, and hunt for compromise because root-level access can allow attackers to remove or conceal forensic artifacts.

Given how attractive email and firewall management infrastructure has become as an attack target this year, this is a good moment to double-check that your gateway appliances aren't more exposed to the internet than they need to be.

Shai-Hulud Worm Spread Through a Hijacked AI Coding Session

Mandiant documented an intrusion in which an attacker hijacked an active AI coding-assistant session and used its trusted developer access to spread a self-propagating worm across roughly 100 internal repositories.

What You Need to Know

An attacker at an unnamed software-as-a-service provider took over a live AI coding-assistant session and used the credentials and context already attached to it to deploy the Shai-Hulud worm across approximately 100 internal repositories. The case shows that AI coding assistants carry the same access as the developers they assist, source code, packages, repositories, and credentials, which makes a hijacked session a high-value target in its own right. Mandiant did not name the victim, disclose when the intrusion happened, or explain how the initial session was hijacked, but the attack chain itself is the real lesson here.

What Happened

The intrusion began when the coding assistant recommended software the attacker had already poisoned. Once the user accepted that recommendation, the attacker used the active session to install an infostealer through a poisoned PyPI package and harvest GitHub OAuth tokens. With those tokens and the session's existing trust, the attacker deployed the self-propagating Shai-Hulud worm across internal repositories, pulled out repository secrets and proprietary source code, and published a poisoned package under the organization's own official namespace. A second employee later installed that compromised package version, opening a separate infection path inside the same environment.

Why This Matters

This incident treats an AI coding assistant the same way an attacker would treat any other privileged identity: something worth stealing session access to, not just a tool to trick into bad output. Once the session was hijacked, the attacker inherited everything the assistant could already reach, including OAuth tokens and repository access, and used that trust to move laterally and self-propagate without needing to compromise each developer individually. A poisoned package published under the company's own namespace is especially dangerous because internal teams have every reason to trust it, which is exactly how the second infection happened.

What to Do

Treat AI coding assistants as privileged development identities rather than productivity tools, with access scoped and monitored accordingly. Require dependency provenance checks and internal package allowlists before any software an AI tool suggests moves into production workflows. Make GitHub OAuth tokens, package registry tokens, cloud credentials, and CI/CD secrets short-lived, scoped to the minimum repositories needed, and continuously monitored for anomalous use. Alert on mass repository access, unexpected package publication from official namespaces, broad token reuse, and automated commits or workflow changes spanning multiple repositories. Isolate AI agents from unrestricted shell execution, limit their reach into sensitive repositories and secret stores, and require human approval before dependency installation, package publication, credential use, or CI/CD pipeline changes.

As AI coding assistants gain deeper access to development environments, they become worth attacking directly, and defenses need to catch up.

N0va Phishing Kit Hijacks Real Login Flows to Steal Access Tokens

A new phishing kit called N0va is targeting organizations in North America and Europe by working through real authentication systems instead of relying on a fake login page alone.

What You Need to Know

N0va lets attackers walk a victim through a real authentication flow, then capture the access and refresh tokens that come out the other end. Once an attacker has those tokens, they can often establish single sign-on access to a victim's email, files, and connected cloud services without needing malware or a stolen password in the traditional sense. Government, technology, consulting, and healthcare organizations have all been hit, and the kit's reliance on trusted business platforms means almost any company using cloud collaboration tools is a potential target.

How N0va Works

N0va's lures imitate services people use every day: Microsoft Teams, SharePoint, OneDrive, DocuSign, Google Drive, Dropbox, Zoom, and Adobe Sign. Rather than sending victims to a straightforward fake login screen, the kit guides them through a legitimate authentication process, which makes the interaction look and feel credible. The attack chain runs from a trusted-brand lure through device code phishing, into a genuine authentication step, then to capturing access and refresh tokens, and finally to abusing token exchange or device registration to gain SSO access into corporate systems. The compromise does not require password capture through a lookalike login page. Instead, it relies on persuading a victim to approve an attacker-initiated device-code authentication request, enabling theft or abuse of the resulting tokens.

Who's Being Targeted

Activity tied to N0va has turned up across government, technology, consulting, healthcare, and other sectors in North America and Europe. The campaign isn't narrowly aimed at one industry. Its use of widely deployed business and cloud platforms as cover broadens the pool of plausible targets, and organizations that lean heavily on Microsoft or Google ecosystems for daily collaboration are particularly exposed.

Why This Matters

A single compromised identity rarely stays contained to one inbox. Once an attacker has SSO access tied to a real account, the blast radius depends entirely on what that account can reach: customer records, intellectual property, financial systems, or other connected cloud resources. The longer that access goes undetected, since it looks like normal authenticated activity rather than an obvious intrusion, the more time an attacker has to move laterally, and the more expensive the eventual cleanup becomes. Costs can include fraud losses, incident response and containment work, regulatory exposure if protected data is touched, and reputational damage with customers and partners.

What to Do

Treat N0va-style phishing as an identity problem, not just an email filtering problem. Security teams should build the ability to tell whether a suspicious indicator, like a matching URL pattern or domain, is an isolated event or part of a broader campaign, rather than triaging every alert from scratch. Behavioral visibility matters here too: sandboxing suspicious links so junior analysts can watch the actual authentication and redirect chain play out cuts down on unnecessary escalations to senior staff. Finally, push confirmed indicators into SIEM, SOAR, EDR, and firewall tooling so a single confirmed N0va case strengthens detection across the environment, not just closes one ticket. On the prevention side, monitoring for unusual token exchange or device registration activity, and enforcing conditional access policies that flag logins from new devices, will catch this pattern even when the initial lure looks convincing.

Phishing built on real authentication flows is harder to spot by instinct alone, which makes process and tooling the difference between catching N0va early and finding out about it after the fact.

GhostCode Hijacks Microsoft Entra Device Enrollment to Outlast Token Revocation

A new phishing kit turns a single approved login into a lasting foothold inside Microsoft Entra, one that session revocation alone won't remove.

What You Need to Know

A newly identified phishing kit called GhostCode abuses the OAuth 2.0 device authorization grant to hijack Microsoft Entra accounts, then quietly registers rogue devices that outlive any token or session revocation. Researchers at eSentire's Threat Response Unit observed the campaign in late August 2026. Within 78 seconds of a victim approving a device-code login, the operators had registered three Entra devices. They obtained a Primary Refresh Token, giving them tenant-wide single sign-on that persists even after the stolen credentials are cut off.

How the Attack Works

GhostCode starts with social engineering, not a fake login page. Operators impersonated procurement staff from legitimate organizations, including BJ's Wholesale Club, and submitted routine inquiries through company Salesforce contact forms. Once a sales team replied, the attackers introduced a fake NDA-signing process and sent a password-protected HTML attachment through WeTransfer. eSentire linked the sender domain, bjssourcing[.]com, to more than 30 recently registered lookalike domains impersonating US distributors, manufacturers, and warehouse firms, domains that were mail-enabled but had no live websites, a pattern typical of business-email-compromise staging.

The HTML attachment, disguised as a document-sharing portal called FlipBook, layers three separate evasion tricks. It pads the file with junk data to throw off similarity-hash scanning, injects HTML comments between visible characters so the text renders normally but resists parsing by security tools, and encrypts the next-stage redirect with AES-256-GCM. The decryption key comes from PBKDF2-HMAC-SHA256 using a hard-coded salt and the password the victim types in, with the actual decryption happening client-side through the Web Crypto API. That means mail gateways, sandboxes, and proxies typically never see the real phishing destination unless they replicate the exact password-gated workflow a human would follow.

Once past the password gate, victims are routed through an anti-bot stage, Cloudflare Turnstile, GeoIP checks, and user-agent filtering before landing on the final phishing page, hosted on a subdomain of what appears to be a compromised legitimate site and built to look like a document portal rather than a Microsoft login clone. The kit then initiates a real device-code request as an OAuth client, using Microsoft Authentication Broker's application ID and requesting Microsoft Graph default permissions plus offline_access. The victim enters the genuine Microsoft-issued code on Microsoft's own device-login page and completes a normal sign-in, including MFA, which is what makes this attack so dangerous: Microsoft sees a technically valid, user-approved authentication.

After approval, GhostCode polls for the authorization result and redirects the victim to a convincing NDA PDF to avoid suspicion, while the real damage happens in the background. Within five seconds, the operators start hitting Intune Enrollment, Device Registration Service, Windows Azure Active Directory, and Microsoft Graph. In under 80 seconds, they've enrolled three devices and pulled a Primary Refresh Token, which supports single sign-on across tenant resources and stays tied to what now looks like a managed, registered device. eSentire found that the resulting Intune enrollment record persisted until someone explicitly removed it, even after the original token was revoked. The campaign also rotated traffic through residential proxies using UK exit nodes matched to victim geography, making the login prompt look more credible and dodging country-based Conditional Access rules.

Why This Matters

The core problem is that revoking a stolen session or refresh token doesn't undo the damage if a rogue device is still enrolled. Once GhostCode has a Primary Refresh Token tied to an attacker-controlled device, that device keeps functioning as a trusted endpoint inside the tenant, giving the attacker a persistence mechanism that standard incident response playbooks (kill the session, rotate the password) don't fully address. For any organization that hasn't restricted device-code flow, this turns one successful phish into a standing foothold rather than a one-time credential theft.

What to Do

Treat rogue device registrations as a containment priority, not an afterthought to session revocation. Microsoft's emergency-response guidance calls for deactivating the affected account, revoking refresh tokens, and explicitly disabling any registered devices tied to the compromised user. Security teams should review Entra sign-in and audit logs for deviceCode authentication activity, rapid Device Registration Service calls, unexpected Intune enrollments, Microsoft Graph sessions using incoming primaryRefreshToken credentials, and anomalous user agents like python-requests. Watch for device names patterned after user identities, tenant-ID fragments, or retry suffixes. The longer-term fix is to block device-code flow for any user without a documented business need, using Conditional Access authentication-flow controls, piloting the policy in report-only mode first, and keeping scoped exception groups tightly for legitimate shared-device, Teams-room, IoT, or CLI cases.

A valid MFA approval used to be the finish line for authentication risk. GhostCode is a reminder that for device-code flow specifically, it's just the starting point.

VectraRAT: A Full-Stack RAT Subscription for $250 a Month

Researchers have uncovered VectraRAT, a new malware-as-a-service platform that bundles credential theft, remote access, and Windows privilege escalation into an affordable subscription.

What You Need to Know

VectraRAT is a purpose-built remote access trojan ecosystem, not a repackaged version of AsyncRAT, XWorm, or QuasarRAT like most commodity RATs on the market. Subscriptions start at $250 per month and hand affiliates a complete toolkit: a Linux command-and-control server, a browser-based management panel, a Windows payload builder, and Telegram support. That price point lowers the bar for attackers who want a capable implant without building or maintaining their own infrastructure, and the platform is already being distributed through tax-themed phishing lures.

What Happened

Researchers attribute VectraRAT to a single developer running it as a subscription business, not a modified open-source project. The stack pairs a Go-based Linux C2 server, branded VectraHub, with a native C++ Windows implant. Operators manage infected machines through a browser panel. They can customize command-and-control settings, modify PE metadata, and toggle a UAC bypass option directly in the payload builder before deployment.

Initial access has been tied to Amadey loader activity and ClickFix-style social engineering campaigns, including lures that impersonate TurboTax and walk victims through pasting commands into the Windows Run dialog.

The Details

VectraRAT communicates over TCP port 3308 using a proprietary binary protocol with MessagePack-encoded payloads, which can slip past detections tuned mainly for HTTP or HTTPS command-and-control traffic. Once installed, the implant can pull saved credentials from Chromium, Firefox, and Internet Explorer, enumerate network connections, and search the filesystem for .env, .conf, and .config files that often hold secrets. It also supports hidden VNC sessions, remote CMD and PowerShell access, keylogging, clipboard monitoring, file transfers, process discovery, and SOCKS5 proxying. The clipboard monitoring feature also doubles as a clipboard replacement tool, creating a real risk of cryptocurrency-address hijacking during transactions.

The UAC bypass abuses Windows auto-elevating binaries, including computerdefaults.exe, to spawn a high-integrity payload process without ever triggering a user prompt.

Why This Matters

A $250-a-month subscription with a support channel and a point-and-click builder means the skill and cost barrier to running a full-featured RAT campaign just dropped. The custom binary protocol on port 3308 is a deliberate attempt to dodge web-focused detection tooling, and the credential and clipboard theft capabilities put both corporate access and personal finances at risk. Because delivery leans on social engineering, like fake tax software prompts that ask victims to run commands manually, the human layer is as much a target as the endpoint.

What to Do

Build behavior-based detections around unexpected child processes launched from computerdefaults.exe, short-lived winver.exe executions, and suspicious PowerShell activity. Flag long-lived outbound TCP connections over port 3308, and watch for the LocalVectra.Client.SingleInstance mutex or the creation of %TEMP%\callback.json as host-level indicators. Monitor for unusual access to browser credential stores and configuration files containing secrets. On the awareness side, make the message explicit: no legitimate verification process requires pasting commands into Run, PowerShell, Terminal, or Command Prompt.

VectraRAT is a reminder that the barrier to running a capable RAT campaign keeps getting lower, and defenders need to watch behavior, not just infrastructure, to keep up.