Major Cyber Attacks in September 2026: US and EU Face Session Theft, Remote Access, and Payment Fraud

Reporting by Any.run BlogRead the original at any.run

Executive Summary

Cyberattacks observed in September demonstrated increased difficulty in separating malicious activity from legitimate business workflows, as attackers leveraged trusted cloud services and legitimate authentication flows to obscure operations. This environment creates significant visibility problems for security teams, where a single alert often fails to reveal the full scope of an attack, potentially allowing risks like identity compromise or payment fraud to escalate undetected. Several specific campaigns were detailed: CSuite utilized multi-stage phishing involving Microsoft 365 session theft and remote access tools; N0va employed Device Code phishing to exploit legitimate authentication flows for token acquisition; IronToll stole card data across multiple countries using impersonation of financial services; Wazza used multi-stage routing to evade automated detection, while TerminalFix utilized trusted software and signed binaries for payload execution. The findings indicate that compromise often spans identity, endpoint, and network layers simultaneously, necessitating a holistic view beyond isolated alerts.

Facts Only

* Attackers used trusted cloud services, document-sharing platforms, and legitimate authentication flows to hide operations.
* Identity compromise involved targeting sessions, tokens, and Microsoft 365 access.
* Wazza used routing and anti-bot checks to hide the final phishing page destination.
* CSuite combined Microsoft 365 session theft with remote access through management tools.
* N0va targeted Microsoft 365 users using Device Code phishing to obtain tokens.
* IronToll impersonated government, postal, banking, and transport services across 12+ countries to steal card data and OTPs.
* TerminalFix used multi-stage delivery involving JavaScript encoding and signed Microsoft binaries for payload execution.
* Attacks targeted US and EU organizations and Microsoft 365 users.
* Attacks involved impersonation of Adobe, DocuSign, Zoom, Dropbox, SharePoint, OneDrive, etc.
* The observed activity extended across account access, endpoint interaction, payment fraud, and internal workflows within the same incidents.

Full Take

The narrative highlights a systemic failure in defensive posture where the blurring of boundaries between legitimate business operations and malicious infiltration creates profound challenges for detection and response. The reliance on trusted infrastructure as an attack vector—using Microsoft services or legitimate remote management tools—shifts the burden from detecting malicious code to discerning anomalous behavior within authorized activity, effectively weaponizing organizational trust against security measures. This points toward a structural vulnerability where siloed monitoring of identity, endpoint, and network data fails to connect into a cohesive threat narrative until deep, manual correlation occurs. The shift illustrated by these campaigns is that single indicators are insufficient; the critical risk lies in understanding the multi-stage dependency across disparate systems—from initial lure delivery through token exfiltration to final execution. This suggests an attacker's core strategy is not merely evasion but the creation of layered, context-rich activity within the noise of normal operations. The implication for defensive strategy is that resilience requires investing heavily in holistic visibility solutions that can stitch together identity sessions, endpoint states, and network flows across the entire kill chain, moving beyond static indicator matching to dynamic behavioral correlation.
Bridge Questions: If security teams focus solely on measuring Mean Time to Detect (MTTD) versus Mean Time to Contain (MTTC), where does the gap in context truly emerge? How can organizations operationalize the necessary cross-domain evidence required to connect a CSuite session theft with an endpoint execution without relying exclusively on manual investigation? What new governance models are needed to manage inherent trust when legitimate tools are weaponized for malicious ends?

From the original · Any.run Blog

Cyberattacks observed in September showed how difficult it has become to separate malicious activity from legitimate business workflows. Attackers used trusted cloud services, familiar document-sharing platforms, legitimate authentication flows, remote-management software, and rapidly changing infrastructure to hide different stages of their operations.

Read the full story at any.run

Sentinel — Human

Confidence

The text functions as a synthesis of specific threat intelligence findings, exhibiting a forensic style more characteristic of expert analysis than pure machine generation.

Signals Detected

Sentence length variance and structural variation suggest human drafting, though some uniformity exists in technical reporting.

The text flows logically from observed attacks to lessons learned, but the structure is highly formalized, typical of threat intelligence reports.

Use of specific campaign names (CSuite, N0va, IronToll) and defined subsections suggests synthesis from specific, perhaps proprietary, research, not generic AI generation.

The claims are grounded in named threat actor analysis (ANY.RUN researchers) and presented as observed patterns, which points toward aggregation of specific findings rather than pure fabrication.

Human Indicators

Specific integration of attributed research/researchers (e.g., ANY.RUN link) and detailed segmentation of multi-stage attack narratives suggests human compilation of expert intelligence.