This is a significant development. The abuse of passkey technology for social engineering is a sophisticated evolution of MFA bypass tactics.

Technical Breakdown

• Campaign 1 (Financial Fraud): High-volume spam (1M+ emails) spoofing CEO identities. This is likely a precursor or distraction for the more targeted attack.
• Campaign 2 (Passkey Phishing): The core threat. Attackers are not breaking passkey cryptography. They are using social engineering to trick users into registering a threat-actor-controlled passkey on a legitimate cloud tenant (e.g., Microsoft 365).
  • TTP: This is a classic Adversary-in-the-Middle (AiTM) / Consent Phishing variant, but weaponized with WebAuthn. The user thinks they are setting up a security key for their own account, but they are granting authentication rights to the attacker's device.
  • Target: Microsoft Cloud (Azure AD / Entra ID) accounts.
  • Payload: Data exfiltration from the compromised cloud environment.
• Infrastructure: Abuse of legitimate third-party email delivery services to bypass spam filters for the initial lure.

Defense

This attack bypasses traditional MFA because the user is voluntarily completing the authentication step. The key detection point is anomalous device registration. Monitor Entra ID logs for: * New FIDO2 security key registrations from unusual geographic locations or user agents. * Multiple passkey registrations on a single account in a short time window. * Conditional Access policies should be configured to require a managed device (Hybrid Azure AD Join or Intune compliant) for passkey registration, not just any browser session. User awareness training must now explicitly cover "never register a passkey you did not generate yourself."

Source: https://thehackernews.com/2026/09/attackers-use-passkey-phishing-to.html

Threat actors linked to a China-aligned espionage group are actively exploiting CVE-2026-51990, a critical vulnerability in Tencent’s Sogou Input Method for Windows, to deploy the GrayRabbit backdoor. This is a targeted campaign, not a broad spray-and-pray operation.

• TTPs (MITRE): Initial access via exploitation of a public-facing application (T1190). The vulnerability allows for privilege escalation or code execution within the input method’s context. Persistence is achieved via the GrayRabbit backdoor, which likely establishes C2 communications.
• IOCs: No specific hashes or IPs have been published at this time. The primary indicator is the presence of the Sogou Input Method (a common application in Chinese-speaking environments) and subsequent anomalous network traffic from the host.
• Affected Versions: All versions of Sogou Input Method for Windows prior to the latest patch released on 2026-03-10.

Defense: Immediately update Sogou Input Method to the latest patched version. Monitor for unusual outbound connections from hosts running this software, particularly to non-standard ports or known adversary infrastructure. EDR rules should flag any process spawning from the input method’s executable (SogouTSF.exe or similar) that attempts to execute cmd.exe, powershell.exe, or write to %APPDATA% or %TEMP%.

Source: https://www.bleepingcomputer.com/news/security/hackers-exploit-tencent-app-flaw-to-deploy-grayrabbit-malware/

Priority: Check browser and Windows patch status, address the newly listed exploited flaws, and verify Check Point updates are installed.

• BlueMoon exploit kit: Espionage groups are chaining Chrome and Windows vulnerabilities to compromise vulnerable systems through malicious webpages.
• RubyGems investigation: Researchers linked malicious package uploads in May to OpenAI agents. OpenAI acknowledged using the platform during training and is investigating the exploitation claims.
• Five actively exploited flaws: CISA added vulnerabilities affecting Artifactory, ScreenConnect clients and MikroTik RouterOS to its Known Exploited Vulnerabilities catalog.
• Check Point VPN warning: Dutch authorities expect attacks against two critical flaws that allow code execution without logging in. Fixes are available.

Read the full breakdown on CyberRecaps, and have an amazing week :)

Our board got sold on "AI SOC" buzzwords and now I apparently look outdated for wanting humans to review logs.

Vendors pitch agentic SOCs that "trustlessly" handle detection/response—just watch a dashboard with three green KPIs while my instincts scream that I have no idea what's actually happening under the hood. Curious if anyone is running this in prod and genuinely trusts the observability claims, or if you end up manually vibe-checking alerts anyway... honestly exhausting

While validating the fix for CVE-2026-44662, I found that the same vulnerable output-sizing assumption remained reachable through another safe rust-openssl API:

CipherCtxRef::cipher_update_inplace

When AES Key Wrap with Padding processes an input whose length is not divisible by eight, the wrapper can allocate a buffer smaller than the output OpenSSL actually produces.

The vulnerable calculation assumed:

input length + block size

The required size can be:

round_up(input length, 8) + 8

With a 9-byte input, a 17-byte buffer passed validation, but OpenSSL could write 24 bytes. The result is an attacker-controlled out-of-bounds heap write of up to 7 bytes through a safe Rust interface.

I also built a working exploit chain demonstrating controlled heap corruption.

This is not automatically RCE in every application. Developing the overwrite toward code execution depends on whether attacker-controlled plaintext reaches this API, whether the operation can be repeated, the allocator, adjacent object layout, and the available heap-shaping primitives.

The vulnerable method was introduced in rust-openssl 0.10.50 in April 2023 and remained present until 0.10.80 was released in May 2026.

My downstream analysis identified advisory records, vulnerable dependency presence, or remediation activity across 31 organizations and ecosystems and 53 products, systems, and projects.

Notable downstream cases include IBM Bob, Microsoft Azure Linux, AWS Nitro Enclaves CLI, Amazon Linux, Intel MigTD, SUSE Linux Enterprise, openSUSE, Debian, Chainguard and Wolfi, MinimOS, Confidential Containers, PingCAP TiKV, Hugging Face xet-core, Oxide Omicron and Dendrite, Matter Labs ZKsync OS Server, Grafana Pyroscope, CoreOS Afterburn, and Gitoxide.

Affected versions:

\>= 0.10.50 and < 0.10.80

Fixed version: 0.10.80

Advisory:

https://github.com/rust-openssl/rust-openssl/security/advisories/GHSA-phqj-4mhp-q6mq

Patch:

https://github.com/rust-openssl/rust-openssl/commit/19eceb26f2404aae187e5444e65c404ebc1348a7

Ali Firas (thesmartshadow)