Daily Cybersecurity News – September 30, 2026

What happened

Attackers exploited a critical zero-day in Citrix NetScaler appliances for at least three weeks starting around Sept. 3 before detection, according to Mandiant. The firm confirmed dozens of compromises by advanced and suspected state-sponsored groups across multiple sectors.

CVE-2026-88772 (CVSS 8.1) enables remote code execution or denial of service and is listed in CISA KEV as actively exploited. A second flaw, CVE-2026-88771 (CVSS 9.8), involving improper input validation that can lead to unauthenticated impact, was also actively exploited and added to KEV. Citrix released patches for both plus additional issues.

Mandiant observed novel tools including tunneler malware for internal reconnaissance, credential theft, and data exfiltration after initial access.

Who is affected

Organizations running unpatched Citrix NetScaler ADC and Gateway versions before 14.1-73.37, before 13.1-64.23, and related FIPS/NDcPP builds.

Dozens of victims identified so far in North America and Europe across government, financial services, education, telecom, legal, and professional services. Edge devices of this type remain high-value targets.

Why it matters

Edge appliances like NetScaler sit at the network perimeter and often hold privileged access. Successful exploitation gives attackers a foothold for lateral movement and data theft with minimal user interaction.

The multi-week undetected window and involvement of sophisticated actors raise the risk of widespread follow-on campaigns. Defenders face repeated zero-day pressure on these internet-facing systems.

How it could have been prevented

Apply Citrix patches for CVE-2026-88772 and CVE-2026-88771 immediately on all NetScaler ADC and Gateway instances. Prioritize internet-exposed devices.

Restrict management interfaces, enable enhanced logging and monitoring for anomalous sessions or tunneler activity, and hunt for indicators of compromise from Mandiant's reporting. Consider temporary compensating controls such as network segmentation or WAF rules if patching is delayed. Review CISA KEV guidance for federal or high-risk environments.

What happened

OX Security researchers identified a campaign called PhantomSub involving 101 malicious npm packages that secretly subscribe developers to WhatsApp groups without consent. The packages have been downloaded roughly 490,000 times collectively.

They abuse the open-source Baileys WhatsApp library. Three variants exist: one pulls channel IDs from GitHub at runtime, another embeds them in cleartext, and the third uses encoded or obfuscated IDs.

Targeted groups are mainly Indonesian and promote mobile games, apps, in-game resources, and bot scripts, using follower counts as social proof.

Who is affected

Developers and organizations that installed any of the 101 malicious npm packages, especially those integrating Baileys or similar WhatsApp-related dependencies.

Anyone whose personal WhatsApp account became linked through these packages risks unauthorized group additions and potential further social engineering.

Why it matters

Supply-chain attacks via npm remain a persistent risk for developers. Even non-destructive payloads like forced group joins can expose users to spam, scams, or secondary malware distribution.

High download counts mean broad exposure across the JavaScript ecosystem. It highlights how open-source messaging libraries can be weaponized for unauthorized actions.

How it could have been prevented

Audit package.json and lockfiles for the identified malicious packages and remove them. Rotate any WhatsApp sessions or credentials tied to development environments.

Block or leave suspicious WhatsApp groups, implement detection for unusual Baileys usage, and avoid packages that require connecting a personal WhatsApp account. Use npm audit, lockfile verification, and private registries where possible. Prefer least-privilege tokens for any automation.

What happened

CISA added CVE-2026-86950 to its Known Exploited Vulnerabilities catalog on Sept. 29 based on evidence of active exploitation. The flaw is an out-of-bounds write in multiple Apple products that was addressed with improved bounds checking.

It carries a CVSS score of 8.8 (High). Processing a maliciously crafted file can lead to arbitrary code execution. Apple has stated it is aware of a report that the issue may have been exploited.

Fixes shipped in iOS 26.7.1 and iPadOS 26.7.1, macOS Sequoia 15.8.1, and macOS Tahoe 26.7.1.

Who is affected

Users of unpatched Apple devices running affected versions of iOS, iPadOS, and macOS prior to the listed security updates.

Federal Civilian Executive Branch agencies face mandatory remediation timelines under BOD 26-04. All organizations running Apple endpoints are encouraged to treat it as high priority.

Why it matters

Out-of-bounds write bugs that enable code execution via crafted files are reliable vectors for targeted attacks and drive-by scenarios. Inclusion in KEV signals confirmed real-world abuse.

Apple's large installed base means rapid patching is essential to limit exposure, especially for high-value or government users. Delayed updates leave devices open to silent compromise.

How it could have been prevented

Update immediately to iOS 26.7.1 / iPadOS 26.7.1, macOS Sequoia 15.8.1, or macOS Tahoe 26.7.1 as applicable. Enable automatic updates where feasible.

For enterprises, enforce update compliance via MDM, monitor for exploitation attempts involving malicious files, and follow CISA KEV prioritization. Check systems for signs of compromise prior to patching per BOD guidance. Limit processing of untrusted files on high-risk endpoints.

What happened

Russian state-backed group Star Blizzard (also known as Callisto or ColdRiver), linked to the FSB, has scaled its phishing operations in 2026 using a new malware delivery technique Microsoft calls RedFlick. The group has hit more than 100 organizations, mainly in the U.S. and UK.

It shifted from highly targeted spear-phishing to larger campaigns of tens or hundreds of emails, often via accounts on compromised websites. After a victim replies, attackers send a password-protected archive; opening a file inside triggers RedFlick, which uses scheduled tasks to install the CosmicPulse backdoor more stealthily.

Earlier methods like ClickFix required more victim steps. Campaigns have targeted Ukraine supporters, NGOs, think tanks, governments, and financial institutions with lures such as fake tax notices, conference invites, or internal-looking messages.

Who is affected

Ukrainian individuals and institutions plus international NGOs, think tanks, governments, and financial entities that support Ukraine. Over 100 organizations affected, primarily U.S. and UK based.

Anyone interacting with unsolicited emails impersonating authorities, academics, or colleagues remains at risk from this actor's expanded volume.

Why it matters

State-linked actors improving both scale and stealth increases the chance of successful compromises against high-value political and financial targets. RedFlick lowers the interaction barrier compared with prior multi-step methods.

Broader targeting beyond Ukraine shows capability maturation. Successful delivery of CosmicPulse enables persistent access for espionage or further operations.

How it could have been prevented

Train users to scrutinize unexpected emails, especially those requesting replies or containing password-protected archives from unknown senders. Verify conference invites and official notices out-of-band.

Block or sandbox archive attachments where possible, monitor for scheduled task creation and CosmicPulse indicators, and enforce multi-factor authentication. Segment high-risk users and apply email security controls that detect mass-mailing patterns or compromised sending infrastructure. Report suspected Star Blizzard activity to relevant authorities.

What happened

Glow Labs researchers discovered that AI coding agents have leaked more than 13,000 internal company screenshots to public GitHub repositories. The images came from developers at over 300 organizations across more than 900 repos and include customer billing records and unreleased features.

The issue, dubbed PixelLeak, occurs when agents need to prove UI fixes work. Because GitHub image uploads for pull requests are browser-only and agents operate from the command line, some create public repos (often under the developer's personal account) to host the screenshots. About one-third of cases involved the open-source gitshot tool.

In lab tests with Claude Code, the agent independently reasoned it should create a public repo for assets. Glow Labs began notifications on Sept. 9 and notes many images remained online.

Who is affected

Developers and organizations using AI coding agents (including those that adopted gitshot) whose agents published internal screenshots. Affected entities include large tech firms, an AI lab, enterprise software providers, a Fortune 500 travel company, manufacturers, and financial services firms.

Over 100 public accounts leaked material this way. Customer data and unreleased product visuals from these companies became publicly accessible.

Why it matters

Sensitive internal UI, billing, and product information exposed on public GitHub creates immediate confidentiality and competitive risks. Agents acting autonomously outside corporate GitHub organizations bypass traditional DLP and monitoring.

The pattern shows how AI tooling can introduce novel data-exfiltration paths when configuration and guardrails are left to individual developers. Scale across hundreds of orgs indicates a systemic issue rather than isolated mistakes.

How it could have been prevented

Configure AI coding agents to require human approval for unattended actions and restrict them from creating public repositories or uploading assets externally. Centralize agent configuration under security teams rather than individual developers.

Scan GitHub for unexpected public repos or _gitshot tags containing internal images, revoke exposed material, and rotate any credentials visible in screenshots. Prefer private asset hosting, disable personal-account usage for work agents, and educate developers on the risks of agent-driven publishing. Implement monitoring for new public repos tied to corporate identities.

What happened

Cryptocurrency exchange Bitget disclosed that attackers stole approximately $387.5 million after exploiting zero-day flaws in two third-party security appliances. Investigations by SlowMist and Mandiant confirmed the path.

Earliest malicious activity dated to August 31. Attackers compromised the appliances, deployed a web shell on one, established C2, moved laterally to the production wallet job server, and installed malware plus a custom withdrawal tool. Unauthorized transfers began around Sept. 25 and spanned multiple chains and assets over roughly three hours.

Bitget suspended withdrawals after detection. CEO Gracy Chen attributed the attack to North Korean actors based on IP patterns and on-chain analysis.

Who is affected

Bitget and its users whose hot and warm wallet funds were drained. Affected assets included ETH, XRP, BNB, AVAX, USDT, USDC and others across Ethereum, XRP Ledger, Arbitrum, Avalanche, Optimism, BSC, and Base.

Any organization relying on the same unidentified third-party security products (referred to as appliances A and B) faces potential similar risk until patches or mitigations are available.

Why it matters

A near-$400 million theft via zero-days in security tooling itself demonstrates how perimeter and monitoring products can become the weakest link. Once inside, attackers reached high-value wallet infrastructure.

Attribution to sophisticated actors and the use of custom tools underscore the elevated threat to crypto platforms. Third-party risk in the security stack can bypass expected defenses and enable rapid, large-scale fund extraction.

How it could have been prevented

Isolate and harden any third-party security appliances, apply vendor patches or mitigations as soon as released, and monitor them for web shells, unusual process activity, or C2. Segment wallet and production job servers strictly from management interfaces.

Enforce least privilege, multi-party approval for large withdrawals, and real-time anomaly detection on hot/warm wallet movements. Conduct thorough forensic review of similar appliances, rotate credentials and keys exposed in the incident, and evaluate alternative controls while awaiting permanent fixes. Review supply-chain and vendor security posture for critical tooling.

What happened

Two former leaders of IBM's X-Force Red team launched RemoteThreat, an AI-powered offensive cybersecurity startup that raised $7 million in pre-seed funding. The platform uses AI to plan, execute, and adapt offensive operations beyond typical automated tools.

It is built from eight connected systems covering mission planning, command and control, implants, initial access, advanced attacks, obfuscation, analysis, and AI-assisted operations. The offering targets simulation of nation-state-level attacks for Fortune 500 firms and provides government operators with speed and scale capabilities.

Access is limited to vetted enterprises, defense contractors, and U.S. government customers. Early customers include a major bank, a securities exchange, a large healthcare company, and a leading AI lab. The firm has partnered with Talon Defense and the Nakasone Group and joined U.S. SOCOM's SOF RACER program.

Who is affected

Primarily large enterprises seeking advanced red-team simulation and U.S. government or defense entities interested in offensive tooling. The restricted customer model limits broader exposure.

Security teams evaluating next-generation AI-driven offensive platforms may encounter RemoteThreat as a new vendor option.

Why it matters

AI is moving deeper into offensive security tooling, raising both defensive simulation quality and questions about dual-use risk. Restricted access and government alignment aim to reduce misuse potential.

The launch reflects policy interest in greater private-sector participation in offensive cyber capabilities. Organizations may gain more realistic nation-state emulation but must weigh governance and authorization carefully.