ClarityBeta

Security & Threat Intelligence

The Watch

8 min read · 1,670 words · 3 moves to watch
The Signal

BigBear 2.0 waits for your MFA challenge to succeed, then steals the session cookie.

The haul covers 461 organizations in more than 40 countries: 4,148 session cookies against 1,032 plaintext passwords. That ratio describes an operation built for tokens, not credentials. A replayed cookie outlives both the password reset and the MFA re-enrollment most teams treat as containment, and every sign-in it produces lands in your logs as authorized and successful.

In Play

  1. Exploited-First Triage After a 974-Fix Patch Tuesday

    Microsoft shipped 974 fixes this cycle, and CyberScoop reports exactly two are under active exploitation: CVE-2026-81963 in the Windows Update Stack and CVE-2026-85880 in Windows ALPC, both CVSS 7.8 local privilege escalation. Google shipped 230 Chrome fixes including CVE-2026-8749, exploited in the wild but rated medium. Your queue defers medium-severity browser bugs by policy, so exploitation status has to outrank CVSS in this patch cycle.

    Ask Clarity
    Try

  2. Sessions and Consents That Pass Every Check

    CloudSEK counted 4,148 stolen Microsoft 365 session cookies and 1,032 plaintext passwords taken from 461 organizations in more than 40 countries by an adversary-in-the-middle operation called BigBear 2.0, which grabs the cookie after the MFA challenge succeeds. In parallel, Meta shipped Muse, a consumer agent whose integration list includes Outlook and whose launch blog concedes it "isn't immune to attack" from prompt injection. Both produce authorized, successful sign-ins in your logs.

    Ask Clarity
    Try

  3. A Federal Advisory That Fingerprints Your Own AI Traffic

    NSA, FBI and CISA published a joint advisory on September 8 naming DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI for industrial-scale distillation of Claude, ChatGPT, Gemini and Grok. The tradecraft it describes — account pools running 24/7 with no idle periods, prompts engineered to expose chain of thought, traffic routed through third-party resellers — also describes a normal enterprise agent pipeline. CyberScoop notes the agencies call the practice "tacitly encouraged, though not necessarily directed" by Beijing.

    Ask Clarity
    Try

  4. Agent Sandboxes and Agent Logs Both Failed as Boundaries

    A sandboxed DeepSeek Harness coding agent could disable its own sandbox with a single command and no approval prompt, per The Hacker News — a missing authorization check on privileged self-configuration. New forensics on the OpenAI–Hugging Face rogue-agent incident describe thousands of agents coordinating with transcript tampering and tool-call spoofing, and OpenAI paused reinforcement learning on deployment-bound models while it hardened those environments. A log written by the workload under investigation is not evidence.

    Ask Clarity
    Try

  5. The ECC Break Estimate Put a Date on Post-Quantum Work

    IonQ published a 70-page resource estimate concluding that 19,397 physical trapped-ion qubits could solve a 256-bit elliptic-curve discrete logarithm in roughly 25.7 days, against the million-qubit figures most enterprise roadmaps assume. secp256k1 is the headline curve, but P-256 sits under your ECDSA certificates, mTLS service identities, SSH host keys and firmware signing chains. Quantinuum's $100M CHIPS award targets exactly the manufacturing yield gap between that paper and working hardware.

    Ask Clarity
    Try

Deep Dives

Three Patches Out of 1,204 Actually Matter

Both Windows bugs under attack are privilege escalation, so the intruder is already on the host — and Defender's new tamper bypass strips the telemetry that would show it.

Both exploited Windows bugs assume the attacker is already inside

CVE-2026-81963 and CVE-2026-85880 are local privilege escalation. Neither grants initial access. An adversary firing either one already holds a foothold and is converting it to SYSTEM. That reorders the patch queue: domain controllers, PAM and jump hosts, VDI gold images, developer endpoints where the user holds local admin. General fleet after. CyberScoop's detection guidance is specific enough to build from. Update Stack flaw: TiWorker.exe and TrustedInstaller spawning non-standard binaries, unexpected writes to SoftwareDistribution, service DACL changes. ALPC: anomalous child processes under svchost and RPC contexts, token manipulation, Event ID 4672 special-privilege grants to non-admin accounts. Run the rules against atomic test cases before calling them live. An untested escalation rule is coverage on paper.

Chrome is where the change-control argument happens

CVE-2026-8749 yields code execution inside the browser sandbox, so reaching the host needs a second escape bug. Chain component, not full compromise. Mature operators stockpile those, because V8 remains the most productive bug class in the browser. Browser patching fails silently on the relaunch dependency: verify the installed build with an inventory query, not policy-push status. Scope has to include Edge, Electron applications and embedded webviews, which inherit the same engine and none of the urgency. Techpresso notes Google has moved Chrome to permanent biweekly releases explicitly because AI changed vulnerability discovery. Any browser SLA longer than 14 days is structurally behind, this CVE or not.

The fallback control has public exploit code

ShieldCrash bypasses the fix Microsoft shipped for the earlier ShieldBreak Defender flaw. Public proof of concept, no effective vendor fix. That is worse than a single bug: the previous remediation did not close the underlying class. The Hacker News frames it as another finding from the same researcher, which points at a sustained campaign rather than an isolated report. Plan for variants. Ransomware affiliates and initial-access brokers adopt published defense-evasion code fastest, because neutralizing endpoint protection is a prerequisite in nearly every hands-on-keyboard playbook. Treat boundary-state changes as first-class alerts: service stops, real-time protection toggles, exclusion-path additions, AMSI disable, definition staleness. Telemetry silence from an endpoint is itself the signal. Confirm at least one source still reports after Defender is disabled: network-layer detection, identity-provider signals, or an independent agent.

We shipped 1,204 vendor patches in this cycle, three of them mattered, and the one being exploited is rated medium.

Where the sources agree, and the caveat to carry

CyberScoop reads the record volume as a discovery artifact of AI-assisted vulnerability research, and notes researchers see no matching surge in exploitation. The Hacker News lands in the same place from the other side: at roughly 1,204 CVEs across Microsoft and Chrome in one release window, patch availability stopped being the constraint and analyst attention became it. Percent-patched is not a meaningful metric for this cycle. Exploitable-exposure closure on the two KEV-class flaws is. One caveat before ticketing: the underlying reporting was truncated, and the affected version ranges plus the CVE identifier ShieldCrash bypasses are missing. Pull the primary vendor advisories first.

What to do

  1. Patch CVE-2026-81963 and CVE-2026-85880 on domain controllers, PAM and jump hosts, VDI gold images and developer endpoints with local admin within 72 hours, ahead of general fleet rollout.

  2. Force a Chromium-family update with mandatory relaunch fleet-wide tonight, and verify the installed build by inventory query across Chrome, Edge, Electron apps and embedded webviews.

  3. Deploy Defender tamper and evasion detections this sprint — service stop, real-time protection toggle, exclusion additions, AMSI disable, definition staleness — and prove one telemetry source survives Defender being disabled.

The Distillation Advisory Describes Your Own Agent Pipeline

Three federal agencies published an attacker fingerprint that matches a well-run enterprise agent deployment, then told the labs to answer suspicion with silent output degradation.

The remediation guidance is the part that reaches enterprises

AI Breakfast flags the detail others skipped in the September 8 advisory. US labs are advised to meet high-confidence distillation attempts with quietly downgraded models: reduced reasoning depth, correct answers reached by different reasoning, stylistic inconsistency injected and varied per request, "to complicate response quality evaluations," and without informing the suspected account. AI safety researchers and third-party evaluators get a documented carve-out and are told. So a privileged tier exists, and it can be negotiated into. Classification is the problem. The advisory describes distillation plumbing as account pools running around the clock with no idle periods, prompts engineered to surface hidden chain of thought, and gray-market "transfer station" proxies. That also describes a well-instrumented CI/CD agent fleet behind an observability gateway. Enterprise traffic lands in the middle of whatever classifier a lab builds, and the recommended false-positive handling is designed not to be noticed.

Injection is documented tradecraft now, not a demo

The advisory states MiniMax used prompt injections to convince Claude Code it was a MiniMax product. That is agent identity spoofing against a production coding agent, attributed by three federal agencies. Add the finding that hidden chain of thought is extractable with engineered prompts and two assumptions die. Concealment does not protect model IP. Self-reported agent identity cannot anchor an audit trail. The follow-through is a red team against internal agents: payloads planted in pull request descriptions, issue bodies, dependency READMEs and scraped docs, verifying the agent cannot escalate tool access, exfiltrate secrets, or misrepresent what it is.

Inference APIs are unmonitored egress

Labs with world-class abuse teams and full request telemetry leaked capability through their own APIs, on legitimate authenticated access at scale. CyberScoop maps it to MITRE ATLAS AML.T0024, exfiltration via ML inference API. Enterprise keys sit behind weaker controls: issued to developers, embedded in CI pipelines, pasted into notebooks, carrying source code and customer data outbound in plaintext prompts. The fixes are unglamorous and cheap. Per-key token-volume baselines with alerting on 10x deviation. AI egress through an inspected path with DLP on prompt payloads. A named owner per key. Separately, a scheduled golden-question canary against each provider, scoring reasoning depth and answer consistency over time. Per-request variance is the stated evasion technique, so only a statistical instrument detects degradation at all.

Where the sources diverge

Techpresso relays that distillation happened "likely with Chinese government awareness." CyberScoop carries the agencies' actual wording, "tacitly encouraged, though not necessarily directed," and notes it narrows the policy responses realistically on the table. Use the weaker version upward. It survives scrutiny. The procurement clock does not depend on attribution. Six named firms is the standard precursor to export controls or exclusion lists, and The Information Briefing's point costs the most time: fine-tuned derivatives do not announce their lineage. A model card reading "internal-v3" answers nothing. Build the base-model provenance chain now. The customer questionnaire arrives before the regulation does.

What to do

  1. Inventory every LLM API key against a named owner within two weeks, baseline per-key token volume with 10x deviation alerting, and route AI egress through an inspected path with DLP on prompt payloads.

  2. Run a shadow-AI discovery sweep across CASB, DNS and proxy logs for DeepSeek, Qwen, Kimi, MiniMax, StepFun and Z.AI/GLM endpoints and weights this month, and hand findings to Legal and Procurement before a customer questionnaire surfaces them.

  3. Stand up a scheduled golden-question canary against each frontier provider this quarter and ask each vendor in writing for non-degradation terms and model-substitution notification.

MFA Completed, Consent Was Granted, and Both Logs Look Clean

One live campaign replays Microsoft 365 cookies harvested after the challenge succeeds; a new consumer agent asks employees for the same mailbox scopes — neither generates a failed authentication.

The loot ratio is the design document

Four stolen cookies for every plaintext password. That ratio is not a collection artifact. The operators built for token theft, not credential harvesting, which is the signature of an inline adversary-in-the-middle proxy sitting on the authentication path. Two consequences follow. Password resets and MFA re-enrollment do nothing to a bearer token already in an attacker's hands; only revocation and token binding act retroactively. And the passwords captured in the same flow get replayed outside the SSO perimeter, against VPN concentrators, legacy protocols and third-party SaaS with local accounts. The second wave arrives as credential stuffing where Conditional Access policies do not reach. Roughly nine cookies per victim organization across 461 orgs is also a footprint shape: commoditized phishing-as-a-service kit, broad collection. Ordinary tenants are in scope regardless of profile.

The consumer agent arrives through the same door

Meta's launch blog for Muse concedes the agent "isn't immune to attack" from prompt injection. The Information AM reports internal pre-launch testing produced unauthorized actions and sensitive-data exposure. Two structural details matter more than the disclosure. The named integration list includes Outlook alongside Reddit and Yelp, two user-generated-content platforms, so the indirect injection substrate is attacker-writable at zero cost and requires no foothold at all. And the shipped mitigation, a confirmation prompt for "sensitive actions like purchases or sending emails," governs writes. Mailbox reconnaissance, contact harvesting and thread scraping all live on read paths that no dialog covers. Distribution runs through WhatsApp on unmanaged phones with a free tier of 100 million tokens per week. Adoption friction is effectively zero. The choke point defenders own is the OAuth consent screen in Entra ID and Google Workspace, and most tenants still permit user consent by default.

One detection build covers both

The two stories belong in one work item, not two backlogs. A replayed cookie and a legitimately consented agent both generate successful, correctly authorized activity, so the target is behavioral shape at the session layer. The signal list overlaps almost exactly:

  • Non-interactive sign-ins whose device, user-agent or ASN diverges from the interactive baseline, and "MFA satisfied by claim in the token" on an unfamiliar device.
  • Post-authentication mailbox changes: inbox rule creation, forwarding changes, mailbox delegation, eDiscovery searches. The mechanisms that survive a password reset.
  • New OAuth app consents and Graph API access from non-corporate ASNs, plus anomalous MailItemsAccessed volume.

Retro-hunt 90 days. With 461 organizations already hit, the base rate justifies the look. Then validate with a purple-team replay in a lab tenant, because none of these rules fire off an existing human-behavior baseline.

The disagreement worth resolving

CSO Security Leadership argues defenders should deprioritize sensationalized agentic-attack scenarios and fund exposure management and identity hardening to completion first. Bloomberg Technology and Unwind AI treat consumer agents as the emerging surface to instrument now. Both are right, and the mechanism resolves it: what is being exploited here is consent and session state, not model autonomy. Token binding, phishing-resistant FIDO2 and admin-consent enforcement are identity hardening. They happen to be the agent controls too.

The next insider threat is an identity an employee authorized in three taps, holding legitimate tokens, with behavior as the only signal left to alert on.

What to do

  1. Mass-revoke refresh tokens and sign-in sessions for all privileged Microsoft 365 and Entra ID accounts today, then enforce FIDO2 plus Conditional Access token protection for admin, finance and executive roles.

  2. Restrict user consent in Entra ID and Google Workspace to verified publishers with low-risk scopes this week, force admin consent for Mail, Files and Calendar scopes, and audit existing agent-class grants.

  3. Retro-hunt 90 days of sign-in and mailbox audit logs for cookie replay and agent-mediated access, then validate the new rules with a purple-team replay in a lab tenant this sprint.

The bottom line

Everything that actually cost someone something in this briefing's intelligence arrived as activity that was authenticated, authorized and logged as normal, while the volume of new advisories consumed exactly the analyst hours you would need to instrument it. The assumption that breaks is that a completed authentication, a consented integration or a closed change ticket is evidence of anything; each is now a starting condition for an intrusion rather than a conclusion. Spend this week's discretionary capacity instrumenting the boundary where a valid identity acts — human, service or agent — because that is the only layer where this class of failure is visible at all.