Your IAM dashboard may not show who actually has access.

Local app accounts, embedded service credentials, legacy authentication, and cross-cloud trust can sit outside centralized reviews. Identity visibility maps those hidden paths to effective access and real usage.

Where IAM loses sight: https://thehackernews.com/2026/09/identity-visibility-in-2026-foundation.html

⚠️ North Korean Jade Sleet is linked to a breach of an Indian IT provider via a DevOps engineer’s Apple Silicon MacBook.

FLATROOF and ROOFDECK were found on the system, with capabilities for command execution, remote shell access, persistence, and data theft.

Inside the MacBook compromise: https://thehackernews.com/2026/09/jade-sleet-linked-to-indian-it-provider.html

⚠️ ChainScript RAT uses a Polygon smart contract to find its active C2 servers.

ClickFix lures deliver the Windows malware, which gives operators shell access, file control, screenshots, payload deployment, and remote JavaScript execution.

Inside the chain: https://thehackernews.com/2026/09/clickfix-lures-deploy-chainscript-rat.html

Election campaigns can’t firewall a cloned voice.

Fake profiles, spoofed domains, synthetic media, and voice impersonation have made a candidate’s digital identity part of the attack surface.

Josh Bartolomie, Doppel VP and Global Head of Threat Intelligence, says detection, takedowns, and proof of authentic content now belong alongside traditional campaign security.

What election security looks like in 2026 → https://thehackernews.com/expert-insights/2026/09/why-deepfake-legislation-wont-save-2026.html

Stolen session cookies let attackers access employee accounts — no login, 2FA prompt, or warning.

NordLayer Intelligence by NordStellar detects leaked session cookies on the dark web and alerts you in real time.

Session cookies keep users logged in. If stolen, often through infostealer malware, attackers can hijack active sessions without credentials or MFA.

The result: account takeover, data theft, financial loss, and reputational damage.

How NordStellar helps:

• 24/7 dark web monitoring — scans dark web sources and malware logs for stolen cookies tied to employees and customers

• Real-time alerts — flags exposed cookies with source, device, and affected data details

• Actionable intelligence — identifies compromised sessions and devices so teams can revoke access before attackers strike

Check if your organization’s data is exposed online for FREE ➡️ https://thn.news/playbook-response

TASK#STOMP steals business documents, Wi-Fi passwords, and clipboard data.

The PowerShell backdoor also watches for newly modified files, takes screenshots, runs remote commands, and keeps two C2 channels alive with mutual watchdogs.

How it stays persistent: https://thehackernews.com/2026/09/taskstomp-powershell-backdoor-steals.html

⚡ Cisco 0-Day
⚡ AI Agent RCE
⚡ 100K+ Sites Hit
⚡ ClickFix Supply Chain
⚡ Browser Banking Malware
⚡ Shai-Hulud Returns
⚡ Crypto Browser Theft
⚡ New Ransomware Crew
⚡ DDoS Domains Seized
⚡ AI Repo Access
⚡ VPN Server Exposure
⚡ AI Finding Scrutiny

Read the ThreatsDay recap: https://thehackernews.com/2026/09/weekly-recap-cisco-0-day-ai-agent-rce.html

⚡ Google has been fined €403 million over GDPR violations involving location data.

Ireland’s DPC found problems across Web & App Activity, Location History, and Android’s Location Accuracy, including transparency failures and excessive data retention.

Read: https://thehackernews.com/2026/09/google-fined-403-million-over-gdpr.html

🚨 North Korea’s Contagious Interview campaign compromised 30,000+ devices across 100+ countries and stole at least $10.71M in crypto.

Fake job offers and coding tests trigger malware infections; funds or credentials were siphoned from 7,000+ wallets.

Inside the chain: https://thehackernews.com/2026/09/contagious-interview-campaign.html

‼️ A fake LastPass download abuses a Microsoft-signed kernel driver to kill antivirus and EDR.

The same payload steals browser passwords, crypto wallet files, and Discord, Steam, and Telegram sessions.

How the signed driver gets trusted: https://thehackernews.com/2026/09/fake-lastpass-authenticator-installer.html

🚨 Attackers are exploiting flaws in Zyxel GS1900 switches and Veeam Agent for Windows.

Zyxel’s bug can run OS commands from the LAN without authentication. Veeam’s can give a local attacker SYSTEM control.

Inside both flaws: https://thehackernews.com/2026/09/zyxel-and-veeam-flaws-under-active.html

‼️ WordPress "Comment2Shell" vulnerability (CVE-2026-93485) can turn an anonymous comment into server code execution through a logged-in admin session.

The chain starts as stored XSS, fires when the page loads, and can use the admin’s session to upload a web shell.

Details → https://thehackernews.com/2026/09/wordpress-comment2shell-flaw-can-turn.html

‼️ One hidden Meta Muse setting can turn the AI assistant into a backdoor on an already-compromised Mac.

A researcher showed how attackers could redirect dictation, feed Muse trusted instructions, and steal its session token to control the assistant across devices.

Read → https://thehackernews.com/2026/09/one-hidden-meta-muse-setting-could-let.html

⚠️ SideCopy is expanding beyond Indian government targets to academia.

Its spear-phishing chain disguises an LNK as a DOCX, abuses mshta.exe, and loads ReverseRAT in memory for credential collection, command execution, persistence, and data exfiltration.

How the chain works: https://thehackernews.com/2026/09/sidecopy-broadens-india-targeting-to.html

⚠️ A malicious npm package logged millions of downloads while hiding its malware in runtime code.

indexed-btree skipped install hooks and used EtherHiding to fetch encrypted next-stage payloads from a Sepolia smart contract.

Look inside the chain: https://thehackernews.com/2026/09/malicious-npm-package-indexed-btree-hid.html

‼️ ALERT - Microsoft initially classified CVE-2026-65660 as a SharePoint spoofing flaw. It actually enables authenticated RCE.

No in-the-wild exploitation has been reported "yet," but the full exploit markup is now public.

Here's how it works → https://thehackernews.com/2026/09/sharepoint-flaw-initially-listed-as.html

AI incidents aren’t slowing most AI rollouts.

86% of organizations had at least one AI-related incident last year. Only 27% slowed or paused deployment, according to OneTrust research.

CISO Tim Mullen argues ISO 27001 should be the starting point, not proof that controls will keep working as AI systems change.

Why certification isn’t enough: https://thehackernews.com/expert-insights/2026/09/beyond-iso-27001-building-risk-program.html

🛑 New Linux KVM flaw CVE-2026-89775 can let an ARM64 guest escape to the host.

When nested virtualization is enabled, the bug can leave freed host kernel memory mapped and writable. No attacks have been reported.

How the escape works ↓ https://thehackernews.com/2026/09/new-linux-kernel-flaw-gives-arm64-kvm.html

DORA’s second year is about proving controls work.

EU regulators are focusing more closely on implementation, incident analysis, and ICT risk supervision. Network evidence can help SOC teams detect, scope, and report incidents faster.

What changes in year two: https://thehackernews.com/2026/09/dora-year-two-can-your-soc-actually-see.html

‼️ WARNING - Attackers are actively exploiting a new CVSS 10.0 VeloCloud Orchestrator vulnerability.

Only VCOs using certificate-based Edge authentication are exposed. Fixes for the 6.1 and 7.0 release trains are still pending.

Learn more about CVE-2026-93952 here → https://thehackernews.com/2026/09/new-cvss-100-velocloud-orchestrator.html