# Daily Intelligence Briefing — Friday, September 18, 2026

> On 2026-09-18, Threadlinqs published 16 new threat reports and updated 3, 7 rated critical and 8 high, spanning 169 MITRE ATT&CK techniques and 6 named threat actors. Coverage that day added 171 new detection rules and 446 extracted indicators.

- **Edition:** 2026-09-18 (Friday)
- **Canonical:** https://intel.threadlinqs.com/debrief/2026-09-18
- **Last updated:** 2026-09-24
- **New threats:** 16 (3 updated)
- **Critical / high:** 7 critical, 8 high, 4 medium, 0 low
- **ATT&CK techniques:** 169
- **Threat actors:** 6
- **Indicators (count only):** 446
- **New detection rules (count only):** 171

## Summary & highlights

Fake myGov 'Secure Message' Phishing Scam Targets Australians with Multi-Step Identity Harvesting Flow. AI-Powered Polymorphic Malware Queries LLMs at Runtime to Evade Signature Detection: PROMPTFLUX and PROMPTSTEAL/LAMEHUG (APT28). Global Fake Parcel Delivery Phishing/Smishing Campaign Steals Card and Bank Details.

- [TL-2026-2558](https://intel.threadlinqs.com/threat/TL-2026-2558) — AI-Driven Exploit Chain Against OpenAI Community Forum via libheif Flaw (CVE-2026-32882)
- [TL-2026-2560](https://intel.threadlinqs.com/threat/TL-2026-2560) — MovieReaper Malware Spreads Through Pirated Movie Torrents and Uses Solana Blockchain for C2
- [TL-2026-2564](https://intel.threadlinqs.com/threat/TL-2026-2564) — France Dark Web Threat Landscape: Ransomware and Hacktivist Activity Surges 4x Over 24 Months
- [TL-2026-2566](https://intel.threadlinqs.com/threat/TL-2026-2566) — Gyazo Data Breach: Helpfeel Discloses 23.62M User Records and ~492M Image Metadata Records Exposed via Image Upload Server Exploit
- [TL-2026-2568](https://intel.threadlinqs.com/threat/TL-2026-2568) — AI-Built Exploit Chain Turns Unpatched libheif Flaw and OpenAI Forum Sign-In Bug into Internal Code Access

## Theme of the day

Activity centered on account-takeover, adversary-in-the-middle, apac.

social-engineering, privilege-escalation, credential-harvesting, openai, cisa-kev

## Threats published

- [TL-2026-2557](https://intel.threadlinqs.com/threat/TL-2026-2557) — CRITICAL — Critical Check Point Management Server Flaw (CVE-2026-91843) Lets Unauthenticated Attackers Run Code as Root
- [TL-2026-2561](https://intel.threadlinqs.com/threat/TL-2026-2561) — CRITICAL — Lazarus Exploits CVE-2026-68820 Zero-Day via Malicious PDF Viewer in Operation Dream Job Against Defense Industry
- [TL-2026-2563](https://intel.threadlinqs.com/threat/TL-2026-2563) — CRITICAL — Microsoft September 2026 Cloud Disclosure: 18 Elevation-of-Privilege, Information-Disclosure, and Spoofing Flaws Across Azure and Copilot AI Products, Plus a Windows Secure Kernel EoP (CVE-2026-85921)
- [TL-2026-2570](https://intel.threadlinqs.com/threat/TL-2026-2570) — CRITICAL — CVE-2025-39682 — Linux Kernel net/tls rx_list Zero-Length Record Use-After-Free Added to CISA KEV Catalog
- [TL-2026-2573](https://intel.threadlinqs.com/threat/TL-2026-2573) — CRITICAL — Brevo Supply-Chain Attack: Stolen Cloudflare API Key Deploys Malicious Edge Worker, Backdoors 100,000+ Websites via ClickFix and a Rogue WordPress Plugin
- [TL-2026-1083](https://intel.threadlinqs.com/threat/TL-2026-1083) — CRITICAL — JADEPUFFER: First End-to-End Agentic Ransomware Attack Exploiting Langflow (CVE-2025-3248) and Nacos (CVE-2021-29441) (update)
- [TL-2026-2542](https://intel.threadlinqs.com/threat/TL-2026-2542) — CRITICAL — CISA KEV Catalog Addition: Active Exploitation of Cisco ISE Authentication Bypass (CVE-2026-76460) and Acronis Backup Privilege Escalation (CVE-2026-87886) (update)
- [TL-2026-2558](https://intel.threadlinqs.com/threat/TL-2026-2558) — HIGH — AI-Driven Exploit Chain Against OpenAI Community Forum via libheif Flaw (CVE-2026-32882)
- [TL-2026-2560](https://intel.threadlinqs.com/threat/TL-2026-2560) — HIGH — MovieReaper Malware Spreads Through Pirated Movie Torrents and Uses Solana Blockchain for C2
- [TL-2026-2564](https://intel.threadlinqs.com/threat/TL-2026-2564) — HIGH — France Dark Web Threat Landscape: Ransomware and Hacktivist Activity Surges 4x Over 24 Months
- [TL-2026-2566](https://intel.threadlinqs.com/threat/TL-2026-2566) — HIGH — Gyazo Data Breach: Helpfeel Discloses 23.62M User Records and ~492M Image Metadata Records Exposed via Image Upload Server Exploit
- [TL-2026-2568](https://intel.threadlinqs.com/threat/TL-2026-2568) — HIGH — AI-Built Exploit Chain Turns Unpatched libheif Flaw and OpenAI Forum Sign-In Bug into Internal Code Access
- [TL-2026-2571](https://intel.threadlinqs.com/threat/TL-2026-2571) — HIGH — Ransomware Attack Disrupts IT Systems and Services in Ellis County, Kansas
- [TL-2026-2572](https://intel.threadlinqs.com/threat/TL-2026-2572) — HIGH — "LPE Quartet": Public Exploits Released for Four Linux Kernel Local-Root Flaws (DirtyAH6, TUNderflow, PPPoEject, DiagSpill)
- [TL-2026-0888](https://intel.threadlinqs.com/threat/TL-2026-0888) — HIGH — EvilTokens Phishing-as-a-Service: Microsoft OAuth 2.0 Device Authorization Grant (Device Code) Phishing Against Microsoft 365 (update)
- [TL-2026-2556](https://intel.threadlinqs.com/threat/TL-2026-2556) — MEDIUM — Fake myGov 'Secure Message' Phishing Scam Targets Australians with Multi-Step Identity Harvesting Flow
- [TL-2026-2559](https://intel.threadlinqs.com/threat/TL-2026-2559) — MEDIUM — AI-Powered Polymorphic Malware Queries LLMs at Runtime to Evade Signature Detection: PROMPTFLUX and PROMPTSTEAL/LAMEHUG (APT28)
- [TL-2026-2562](https://intel.threadlinqs.com/threat/TL-2026-2562) — MEDIUM — Global Fake Parcel Delivery Phishing/Smishing Campaign Steals Card and Bank Details
- [TL-2026-2567](https://intel.threadlinqs.com/threat/TL-2026-2567) — MEDIUM — Phishing Campaign Impersonates ChatGPT Subscription Billing Alerts to Steal OpenAI Credentials via Google API Open-Redirect and nxcli.io Infrastructure

## Techniques observed

[AML.T0054](https://intel.threadlinqs.com/technique/AML.T0054), T0814, [T1003](https://intel.threadlinqs.com/technique/T1003), [T1003.001](https://intel.threadlinqs.com/technique/T1003.001), [T1005](https://intel.threadlinqs.com/technique/T1005), [T1014](https://intel.threadlinqs.com/technique/T1014), [T1016](https://intel.threadlinqs.com/technique/T1016), [T1020](https://intel.threadlinqs.com/technique/T1020), [T1021](https://intel.threadlinqs.com/technique/T1021), [T1021.005](https://intel.threadlinqs.com/technique/T1021.005), [T1027](https://intel.threadlinqs.com/technique/T1027), [T1027.007](https://intel.threadlinqs.com/technique/T1027.007), [T1036](https://intel.threadlinqs.com/technique/T1036), [T1036.005](https://intel.threadlinqs.com/technique/T1036.005), [T1046](https://intel.threadlinqs.com/technique/T1046), [T1053](https://intel.threadlinqs.com/technique/T1053), [T1053.003](https://intel.threadlinqs.com/technique/T1053.003), [T1053.005](https://intel.threadlinqs.com/technique/T1053.005), [T1056.003](https://intel.threadlinqs.com/technique/T1056.003), [T1057](https://intel.threadlinqs.com/technique/T1057), [T1059](https://intel.threadlinqs.com/technique/T1059), [T1059.001](https://intel.threadlinqs.com/technique/T1059.001), [T1059.003](https://intel.threadlinqs.com/technique/T1059.003), [T1059.004](https://intel.threadlinqs.com/technique/T1059.004), [T1059.005](https://intel.threadlinqs.com/technique/T1059.005), [T1059.006](https://intel.threadlinqs.com/technique/T1059.006), [T1059.007](https://intel.threadlinqs.com/technique/T1059.007), [T1068](https://intel.threadlinqs.com/technique/T1068), [T1069](https://intel.threadlinqs.com/technique/T1069), [T1070](https://intel.threadlinqs.com/technique/T1070), [T1071](https://intel.threadlinqs.com/technique/T1071), [T1071.001](https://intel.threadlinqs.com/technique/T1071.001), [T1074.001](https://intel.threadlinqs.com/technique/T1074.001), [T1078](https://intel.threadlinqs.com/technique/T1078), [T1078.001](https://intel.threadlinqs.com/technique/T1078.001), [T1078.003](https://intel.threadlinqs.com/technique/T1078.003), [T1078.004](https://intel.threadlinqs.com/technique/T1078.004), [T1082](https://intel.threadlinqs.com/technique/T1082), [T1083](https://intel.threadlinqs.com/technique/T1083), [T1087](https://intel.threadlinqs.com/technique/T1087), [T1087.004](https://intel.threadlinqs.com/technique/T1087.004), [T1090](https://intel.threadlinqs.com/technique/T1090), [T1090.002](https://intel.threadlinqs.com/technique/T1090.002), [T1091](https://intel.threadlinqs.com/technique/T1091), [T1098](https://intel.threadlinqs.com/technique/T1098), [T1098.001](https://intel.threadlinqs.com/technique/T1098.001), [T1098.005](https://intel.threadlinqs.com/technique/T1098.005), [T1102](https://intel.threadlinqs.com/technique/T1102), [T1102.001](https://intel.threadlinqs.com/technique/T1102.001), [T1102.002](https://intel.threadlinqs.com/technique/T1102.002), [T1105](https://intel.threadlinqs.com/technique/T1105), [T1106](https://intel.threadlinqs.com/technique/T1106), [T1110](https://intel.threadlinqs.com/technique/T1110), [T1110.003](https://intel.threadlinqs.com/technique/T1110.003), [T1110.004](https://intel.threadlinqs.com/technique/T1110.004), [T1111](https://intel.threadlinqs.com/technique/T1111), [T1113](https://intel.threadlinqs.com/technique/T1113), [T1114.002](https://intel.threadlinqs.com/technique/T1114.002), [T1114.003](https://intel.threadlinqs.com/technique/T1114.003), [T1119](https://intel.threadlinqs.com/technique/T1119), [T1132.001](https://intel.threadlinqs.com/technique/T1132.001), [T1133](https://intel.threadlinqs.com/technique/T1133), [T1136](https://intel.threadlinqs.com/technique/T1136), [T1136.001](https://intel.threadlinqs.com/technique/T1136.001), [T1137](https://intel.threadlinqs.com/technique/T1137), [T1140](https://intel.threadlinqs.com/technique/T1140), [T1187](https://intel.threadlinqs.com/technique/T1187), [T1190](https://intel.threadlinqs.com/technique/T1190), [T1195](https://intel.threadlinqs.com/technique/T1195), [T1195.002](https://intel.threadlinqs.com/technique/T1195.002), [T1199](https://intel.threadlinqs.com/technique/T1199), [T1203](https://intel.threadlinqs.com/technique/T1203), [T1204](https://intel.threadlinqs.com/technique/T1204), [T1204.001](https://intel.threadlinqs.com/technique/T1204.001), [T1204.002](https://intel.threadlinqs.com/technique/T1204.002), [T1211](https://intel.threadlinqs.com/technique/T1211), [T1213](https://intel.threadlinqs.com/technique/T1213), [T1213.002](https://intel.threadlinqs.com/technique/T1213.002), [T1213.003](https://intel.threadlinqs.com/technique/T1213.003), [T1222.002](https://intel.threadlinqs.com/technique/T1222.002), [T1404](https://intel.threadlinqs.com/technique/T1404), [T1485](https://intel.threadlinqs.com/technique/T1485), [T1486](https://intel.threadlinqs.com/technique/T1486), [T1489](https://intel.threadlinqs.com/technique/T1489), [T1490](https://intel.threadlinqs.com/technique/T1490), [T1491.001](https://intel.threadlinqs.com/technique/T1491.001), [T1497](https://intel.threadlinqs.com/technique/T1497), [T1497.001](https://intel.threadlinqs.com/technique/T1497.001), [T1498.001](https://intel.threadlinqs.com/technique/T1498.001), [T1499.004](https://intel.threadlinqs.com/technique/T1499.004), [T1505](https://intel.threadlinqs.com/technique/T1505), [T1505.003](https://intel.threadlinqs.com/technique/T1505.003), [T1518](https://intel.threadlinqs.com/technique/T1518), [T1526](https://intel.threadlinqs.com/technique/T1526), [T1528](https://intel.threadlinqs.com/technique/T1528), [T1530](https://intel.threadlinqs.com/technique/T1530), [T1531](https://intel.threadlinqs.com/technique/T1531), [T1534](https://intel.threadlinqs.com/technique/T1534), [T1539](https://intel.threadlinqs.com/technique/T1539), [T1546](https://intel.threadlinqs.com/technique/T1546), [T1547.001](https://intel.threadlinqs.com/technique/T1547.001), [T1548.002](https://intel.threadlinqs.com/technique/T1548.002), [T1548.003](https://intel.threadlinqs.com/technique/T1548.003), [T1550](https://intel.threadlinqs.com/technique/T1550), [T1550.001](https://intel.threadlinqs.com/technique/T1550.001), [T1550.004](https://intel.threadlinqs.com/technique/T1550.004), [T1552](https://intel.threadlinqs.com/technique/T1552), [T1552.001](https://intel.threadlinqs.com/technique/T1552.001), [T1555](https://intel.threadlinqs.com/technique/T1555), [T1556](https://intel.threadlinqs.com/technique/T1556), T1556.003, [T1557](https://intel.threadlinqs.com/technique/T1557), [T1560.001](https://intel.threadlinqs.com/technique/T1560.001), T1562, [T1564](https://intel.threadlinqs.com/technique/T1564), [T1564.008](https://intel.threadlinqs.com/technique/T1564.008), [T1565](https://intel.threadlinqs.com/technique/T1565), [T1566](https://intel.threadlinqs.com/technique/T1566), [T1566.001](https://intel.threadlinqs.com/technique/T1566.001), [T1566.002](https://intel.threadlinqs.com/technique/T1566.002), [T1566.003](https://intel.threadlinqs.com/technique/T1566.003), [T1567](https://intel.threadlinqs.com/technique/T1567), [T1567.002](https://intel.threadlinqs.com/technique/T1567.002), [T1570](https://intel.threadlinqs.com/technique/T1570), [T1573.002](https://intel.threadlinqs.com/technique/T1573.002), [T1574.001](https://intel.threadlinqs.com/technique/T1574.001), [T1580](https://intel.threadlinqs.com/technique/T1580), [T1583](https://intel.threadlinqs.com/technique/T1583), [T1583.001](https://intel.threadlinqs.com/technique/T1583.001), [T1583.003](https://intel.threadlinqs.com/technique/T1583.003), [T1583.006](https://intel.threadlinqs.com/technique/T1583.006), T1583.007, [T1584](https://intel.threadlinqs.com/technique/T1584), [T1584.004](https://intel.threadlinqs.com/technique/T1584.004), [T1584.006](https://intel.threadlinqs.com/technique/T1584.006), [T1585.001](https://intel.threadlinqs.com/technique/T1585.001), [T1585.002](https://intel.threadlinqs.com/technique/T1585.002), [T1587](https://intel.threadlinqs.com/technique/T1587), [T1587.004](https://intel.threadlinqs.com/technique/T1587.004), [T1588](https://intel.threadlinqs.com/technique/T1588), [T1588.002](https://intel.threadlinqs.com/technique/T1588.002), [T1588.005](https://intel.threadlinqs.com/technique/T1588.005), [T1588.006](https://intel.threadlinqs.com/technique/T1588.006), [T1589.001](https://intel.threadlinqs.com/technique/T1589.001), [T1589.002](https://intel.threadlinqs.com/technique/T1589.002), [T1591](https://intel.threadlinqs.com/technique/T1591), [T1592.002](https://intel.threadlinqs.com/technique/T1592.002), [T1595](https://intel.threadlinqs.com/technique/T1595), [T1595.002](https://intel.threadlinqs.com/technique/T1595.002), [T1598](https://intel.threadlinqs.com/technique/T1598), [T1598.003](https://intel.threadlinqs.com/technique/T1598.003), [T1606](https://intel.threadlinqs.com/technique/T1606), [T1608](https://intel.threadlinqs.com/technique/T1608), [T1608.001](https://intel.threadlinqs.com/technique/T1608.001), [T1608.005](https://intel.threadlinqs.com/technique/T1608.005), [T1608.006](https://intel.threadlinqs.com/technique/T1608.006), [T1609](https://intel.threadlinqs.com/technique/T1609), [T1610](https://intel.threadlinqs.com/technique/T1610), [T1611](https://intel.threadlinqs.com/technique/T1611), [T1613](https://intel.threadlinqs.com/technique/T1613), [T1620](https://intel.threadlinqs.com/technique/T1620), [T1621](https://intel.threadlinqs.com/technique/T1621), T1656, [T1657](https://intel.threadlinqs.com/technique/T1657), [T1684.001](https://intel.threadlinqs.com/technique/T1684.001), [T1685](https://intel.threadlinqs.com/technique/T1685), [T1685.006](https://intel.threadlinqs.com/technique/T1685.006), [T1686](https://intel.threadlinqs.com/technique/T1686), [T1688](https://intel.threadlinqs.com/technique/T1688)

## Threat actors

[APT28](https://intel.threadlinqs.com/actor/APT28), [Hacktron AI](https://intel.threadlinqs.com/actor/Hacktron%20AI), [Qilin](https://intel.threadlinqs.com/actor/Qilin), [Lazarus Group](https://intel.threadlinqs.com/actor/Lazarus%20Group), [EvilTokens PhaaS operator](https://intel.threadlinqs.com/actor/EvilTokens%20PhaaS%20operator), [JADEPUFFER](https://intel.threadlinqs.com/actor/JADEPUFFER)

Nation-state attribution: Russia, Russia (NoName057(16) hacktivist track only; Qilin/MedusaLocker/LockBit are financially motivated, non-state RaaS operations), North Korea (DPRK)

Threat categories: PHISHING, MALWARE, VULNERABILITY, THREAT_INTEL, DATA_BREACH, RANSOMWARE, ZERO_DAY, SUPPLY_CHAIN

## Severity breakdown

- critical: 7
- high: 8
- medium: 4
- low: 0

## Indicator & detection coverage

Counts only; indicator values require Red and above, detection rule text requires Blue and above.

- Indicators of compromise: 446 (network 123, file 88, infrastructure 66, entity 61, behavioral 36, tool 30, package 21, malware 19, technique 2)
- New detection rules: 171 (100% of the day’s threats covered)

## More editions

- Previous: [2026-09-15](https://intel.threadlinqs.com/debrief/2026-09-15)
- Next: [2026-09-21](https://intel.threadlinqs.com/debrief/2026-09-21)
- [Archive of daily debriefs](https://intel.threadlinqs.com/debrief/archive)
- [Latest debrief](https://intel.threadlinqs.com/debrief)

Canonical: https://intel.threadlinqs.com/debrief/2026-09-18