🕵️ RESEARCH & DEEP DIVES
M365 token-replay campaign via AiTM relays compromises 97 accounts at 79 organizations
Huntress tracked a 10-week Microsoft 365 campaign that captured sign-in tokens via AiTM relays and replayed them to compromise email accounts at 79 organizations.- Affects Microsoft 365 tenants using phishable MFA methods (push, SMS, TOTP), unrestricted device-code flow, or incomplete Conditional Access coverage; finance, payroll, and executive mailboxes are prime targets.
- Between July 14 and September 22, 2026, attackers made over 200,000 login attempts, achieved 497 successful sign-ins, compromised 97 accounts, and registered 48 rogue Entra devices.
- Attack chain: AiTM relay pages proxy the real Microsoft sign-in to capture credentials, MFA codes, and session tokens; tokens are also sourced from device-code phishing and social engineering.
- Stolen tokens are replayed within minutes from IP range 193.26.115.0/24 (AS210558, 1337 Services GmbH, Hamburg), including 193.26.115[.]221, a Romanian IP linked to AsyncRAT; tooling includes scripted builds using Microsoft Office/Authentication Broker client IDs and browser-based replay via OfficeHome.
- Persistence includes adding attacker authenticator apps (in 19 orgs MFA methods were replaced within three hours), registering fake DESKTOP- devices, and hidden inbox rules with names like ".", "sss", and "iT" that delete or hide payroll, deposit, and bonus emails.
Gheist Campaign Uses Stolen GitHub Tokens to Exfiltrate Private Repo Secrets via Actions Logs
Wiz researchers report the Gheist campaign has used stolen GitHub tokens to plant secret-stealing workflows in over 850 compromised accounts since September 15.- Targets GitHub users with stolen write-access tokens, including private repositories and GitHub Enterprise Server environments; 13,500+ planted branches recovered from 850+ compromised accounts.
- Attackers push a branch named ci-sync- plus six random characters containing .github/workflows/sync-check.yml with commit message 'ci: sync config'.
- The workflow prints all readable secrets base32-encoded so GitHub's log masking fails, then the tool downloads the log via GitHub API and deletes the run seconds later.
- GitHub's malicious-workflow approval hold (since July 28) stopped every public-repo run Wiz checked, but does not cover private repositories or GitHub Enterprise Server, where successful runs were followed by AWS Secrets Manager enumeration.
- IOCs: user agent 'gheist', branch pattern ^ci-sync-[0-9a-z]{6}$, commit message 'ci: sync config', string 'toJS'; a newer variant targets self-hosted runners hunting 31 token types, with files .gdmp_pat, .gdmp_patg, .gdmp_sweep.
Rentable uCreator Android Spyware Steals Telegram 2FA Passwords, Clones WeChat Accounts
A rentable Android spyware kit called uCreator hides inside tampered Telegram and WeChat app copies to hijack user accounts.- Targets Android users of Telegram and WeChat, with infections concentrated in India (22.8%), Brazil (20.5%), Indonesia (9.6%), plus apparent victims in China and the US
- Steals Telegram 2FA passwords in plaintext before hashing, enabling attackers to reset sessions, change the linked phone number, or delete accounts, and hides attacker sessions from the device list
- Clones WeChat accounts by running the app in a virtualization container, copying the login identity and uploading zipped app data; code supports about 20 messaging and wallet apps including WeCom, QQ, WhatsApp, LINE, Zalo, KakaoTalk, GCash and MoMo
- Delivered via sideloaded tampered app copies, fake app store sites promoted through in-app ads (Portuguese and Indonesian banners), third-party stores APKPure, ApkSum and AndroidP, and the kit makers' own container app Onion Box; some fake Telegram X copies share the official package name
- Sold as a product with a leaked cloud console for merchants and resellers; its Telegram module matches Doctor Web's Baohuo backdoor (code namespace com.ucreator.tgjar, same C2 server), with roughly three dozen China-based developers, and its hooking engine fails on Android 17's changed internal function
Malicious AGENTS.md in Downloads Folder Tricks AI Coding Agents Into Installing Malware
A malicious instruction file planted in a developer's Downloads folder tried to trick their AI coding agent into installing a known-malicious npm package.- Affects developers running AI coding agents like OpenAI Codex and Claude Code, especially those started in the Downloads folder — Forever Security found about half its customers run agents there.
- The attack uses a planted AGENTS.md or CLAUDE.md instructions file, disguised as engineering notes, telling the agent to install the malicious npm package 'function-color', part of the MALFEX campaign analyzed by CloudSEK and Checkmarx.
- function-color pulls in a downloader called function-flag, which fetches and runs a Windows payload.
- Against Codex, the file registered a server in ~/.codex/config.toml, persisting across sessions; the attack succeeded in over 90% of attempts.
- Against Claude Code, a planted CLAUDE.md tried to write an attacker-controlled ANTHROPIC_BASE_URL into project settings, leaking the session login token; it succeeded about half the time.
- A web page can silently save a file to the Downloads folder without a click or permission prompt, and Forever Security built a proof-of-concept page demonstrating this delivery route.