Daily Security Intelligence Briefing — September 13, 2026
Tier 2 — Essential Intelligence (Summaries & Analysis)
1. Attackers Use Passkey Phishing to Hijack Microsoft Cloud Accounts and Exfiltrate Data
Domain: Cloud Security / Identity
Subject / Topic Summary: Microsoft disclosed two threat campaigns where actors abused legitimate third-party email delivery infrastructure to distribute over a million scam messages. The attackers leveraged passkey-themed social engineering lures to deceive users, gain unauthorized access to Microsoft cloud environments, and exfiltrate corporate data.
Key Technical & Strategic Takeaways: Threat actors leverage trusted third-party email delivery services to bypass traditional email gateway filters.; Social engineering lures are increasingly adopting passkey themes to trick users accustomed to modern authentication workflows.
Essential Direct Quote: The first campaign involved sending over a million scam emails... using passkey-themed social engineering to breach cloud environments.
Source: The Hacker News
2. Dutch NCSC: Critical Check Point VPN Flaws Exploitation Is Imminent
Domain: Vulnerability Management / Edge Security
Subject / Topic Summary: The Dutch National Cyber Security Centrum (NCSC) has issued an urgent alert warning that active exploitation of two critical Check Point VPN vulnerabilities is expected imminently. The flaws, tracked as CVE-2026-85102 and CVE-2026-85103, pose significant risk to enterprise remote access infrastructure.
Key Technical & Strategic Takeaways: CVE-2026-85102 and CVE-2026-85103 impact Check Point enterprise VPN gateways.; Security teams are advised to prioritize patching immediately before broad public exploitation begins.
Essential Direct Quote: The Dutch Nationaal Cyber Security Centrum (NCSC) is warning of imminent exploitation of two critical flaws in Check Point VPN...
Source: BleepingComputer
3. CISA Adds 5 Actively Exploited Artifactory, ScreenConnect, and RouterOS Flaws to KEV
Domain: Vulnerability Management
Subject / Topic Summary: CISA added five vulnerabilities to its Known Exploited Vulnerabilities catalog following active in-the-wild exploitation reports. The additions impact developer software, remote access tools, and network hardware, including JFrog Artifactory, ConnectWise ScreenConnect, and MikroTik RouterOS.
Key Technical & Strategic Takeaways: Includes CVE-2026-42016, an incorrect authorization vulnerability in Artifactory with an 8.1 CVSS score.; Federal agencies and enterprise security teams face mandatory remediation timelines for these exposed components.
Essential Direct Quote: The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added five security flaws impacting JFrog Artifactory, ConnectWise ScreenConnect, and MikroTik RouterOS to its Known Exploited Vulnerabilities catalog...
Source: The Hacker News
4. Linux Rootkit Deployed on F5 BIG-IP APM Devices, Cisco FMC Bugs Exploited
Domain: Threat Intelligence / Infrastructure Security
Subject / Topic Summary: Security investigations revealed sophisticated campaigns deploying custom Linux rootkits onto compromised F5 BIG-IP APM gateway appliances for persistent access. Concurrently, attackers continue actively targeting unpatched vulnerabilities in Cisco Firepower Management Center (FMC) installations.
Key Technical & Strategic Takeaways: Network perimeter appliances like F5 APM remain top targets for persistent stealth rootkits.; Cisco FMC management interfaces require strict access controls and immediate patch verification.
Essential Direct Quote: Linux rootkit deployed on F5 BIG-IP APM devices, Cisco FMC bugs exploited.
Source: Help Net Security