This Quarter, the Breach Came Through Something You Trusted

Say you have spent the last three months buried in one long engagement and just resurfaced. Here is your catch-up briefing for July to September 2026: what got breached, what the attackers actually used, the vulnerabilities doing the real damage, and the handful of genuinely new techniques worth knowing about.

Start with the single most uncomfortable number of the quarter.

In 47% of the attacks Microsoft's incident team responded to, the victim ran the malware themselves. No exploit. No attachment. A web page showed a fake "verify you are human" box, told them to press Win+R and paste a command, and they did. The command pulled down an infostealer.

There is nothing to patch there. There is nothing to scan. The technique is called ClickFix, and in Q3 2026 it was the most common way in, full stop.

That is the theme of the whole quarter. The breach did not come through the hardened front door. It came through something people trust by default: a CAPTCHA, a signed driver, a vendor integration, a line of code that looked normal in review.

Here is the quarter, ranked and sourced.

1. What they actually used to get in

ClickFix is number one and it is not close. It bypasses everything by design, because the human is the exploit. Paste-and-run installs LummaStealer, AsyncRAT, or on Mac, Atomic Stealer. Over the quarter it grew DNS-based variants, a macOS version, and AI-generated lure pages that make convincing fake-CAPTCHA infrastructure cheap to spin up.

ClickFix is here to stay. The pattern shifts every time defenders catch up: from Win+R to Windows Terminal, from pasted text to API-driven servers that hand every visitor the same malware in a different disguise.

Bert-Jan Pals, who analyzed roughly 3,000 live ClickFix payloads

State-backed crews are on it too. APT28, MuddyWater and Kimsuky have all run ClickFix campaigns, and a North Korean group built a "ClickFake Interview" variant aimed at cryptocurrency workers.

Vulnerability exploitation is number two, and this is the structural shift of the year. Per the Verizon 2026 DBIR, exploiting a vulnerability is now the #1 initial-access vector overall - 31% of breaches, up from 20%, a 55% year-over-year jump. It is the first time in the report's history that it outranks stolen credentials, which fell to 13%. The targets are the edge: Citrix NetScaler, SonicWall and Fortinet VPNs, Cisco.

BYOVD and EDR killers are number three, and they moved from "advanced" to "standard playbook item." Load a Microsoft-signed but vulnerable kernel driver, get kernel execution, kill the endpoint agent, then run the ransomware. One tracked set: 54 EDR-killer tools abusing 35 different signed drivers. Two active groups have a routine that disables 300+ security products before a single file is encrypted.

BYOVD is no longer nation-state exclusive. RansomHub, BlackByte, Akira and Scattered Spider all use it now.

Hive Security, Windows attack techniques 2026

Stolen OAuth tokens and session cookies are number four, and they are the cleanest of the lot because authentication simply never happens. A valid token is proof you already logged in. It walks past the password and the MFA prompt.

2. The CVEs that mattered

August's Patch Tuesday shipped 421 CVEs in one day, including an actively exploited zero-day in the WinSock driver (afd.sys, CVE-2026-68820) tied to North Korean actors. But volume is not the story. Speed is.

• CVE-2026-55040, SharePoint, CVSS 9.1: an attacker forges a JSON Web Token that SharePoint accepts, then impersonates any user. Public PoC on August 13. Exploitation followed within hours.
• CVE-2026-8451, Citrix NetScaler configured as a SAML identity provider: leaks memory contents. Exploited roughly 24 hours after disclosure.
• Cisco Catalyst SD-WAN: a CVSS 10.0 peering authentication bypass.
• CVE-2026-20316, Cisco Secure Firewall Management Center: unauthenticated access to a built-in account. Note the word management. They are going after the console that runs your security, not the appliance in front of it.
• Gitea RCE, Metabase zero-day (exploited before a patch existed), ownCloud, Microsoft SQL Server - all added to CISA's Known Exploited Vulnerabilities catalog during the quarter.

And the unexpected one: CISA also added flaws from 2015 and 2022 to KEV, after Cisco Talos caught a Chinese cybercrime group (UAT-10147) mass-exploiting decade-old bugs on web servers that were simply never patched. New zero-days and ancient n-days are being worked at the same time, by the same economy.

Sophisticated intrusion sets are living on unmonitored edge devices and using native network functionality to stay invisible.

Mandiant M-Trends 2026

Meanwhile the defensive side slipped. The DBIR puts median time-to-patch at 43 days, up from 32, and finds only 26% of KEV entries fully remediated, down from 38% the year before. On the other hand, VulnCheck measured the median time from CVE publication to CISA KEV listing dropping from 120 days to 80, so the tracking is at least getting faster.

3. The 20 vulnerabilities doing the damage

Most breaches are not caused by zero-days. They are caused by known issues that were documented, scored, and patched months or even years ago.

VulnCheck, State of Exploitation 1H-2026

Two lists. First, the 2026 flaws that were weaponized fast and hit hard. Second, the old ones that are still, somehow, a reliable way in.

2026: exploited fast, high impact

Also actively exploited and added to CISA KEV during the quarter: Gitea RCE, a Metabase zero-day (exploited before any patch existed), ownCloud, and Microsoft SQL Server.

Old, patched, and still working

Content management systems were the single most targeted category this year, about a third of all KEV entries, WordPress plugins in the lead. Edge devices (Cisco, Palo Alto, Check Point, F5, Juniper, Fortinet) were second, and security tools, developer tools and device-management platforms had the fastest exploitation rates.

If you only do one thing after reading this: pull your external attack surface and cross it against these two tables. The 2018-2021 rows are the ones that quietly own companies.

4. The leaks

ShinyHunters and Salesforce was the quarter's defining data story. Across a campaign hitting 1,000+ organizations, the group claimed on the order of 1.5 billion stolen Salesforce records. Named victims include Google, Qantas, Allianz Life, M&S, SK Telecom, and Santander Mexico. Many more were never named. The stolen records were then combed for plaintext AWS keys, VPN credentials and Snowflake tokens to reach further.

Salesloft / Drift was the same idea one layer up the trust chain. Attackers stole the OAuth tokens for a Drift chat integration and used them to pull data from the Salesforce, Google Workspace and, in some cases, Slack of 700+ organizations - Cloudflare, Palo Alto Networks, Zscaler, Proofpoint, SpyCloud, Tanium, PagerDuty among them. Over roughly ten days, at machine speed.

Read that vendor list again. Cloudflare. Zscaler. Proofpoint. SpyCloud. The companies that sell this protection got hit through the same soft spot as everyone else.

The rest of the quarter:

• Jaguar Land Rover - roughly 3TB taken (documents, source code, a database), production lines halted for weeks.
• DentaQuest - 15 million+ people notified, the largest US healthcare breach of 2026, from an intrusion that began back in May.
• Kido, a nursery-school chain - attackers threatened to publish photos and details of the children.
• Coca-Cola's Fairlife lost operations. So did water utilities and Japan's KDDI.

"We are not interesting enough to be a target" stopped being a sentence you could say with a straight face this quarter.

5. What was genuinely new

• Reynolds ransomware embeds the vulnerable driver inside the payload. No separate driver file dropped to disk means no detection window between "EDR is now dead" and "your files are now encrypted."
• Shai-Hulud, the self-replicating npm worm from 2025, came back. It steals a maintainer's token, publishes poisoned versions of their packages, harvests cloud credentials with TruffleHog, backdoors GitHub Actions for persistence, and spreads to the next maintainer automatically.
• AI-config poisoning. Malicious packages ship .cursorrules and CLAUDE.md files with instructions hidden in zero-width Unicode. Invisible in code review. PyPI's signature check does not catch it, because that only covers Python code, not the config files your AI assistant reads.
• Mid-build CI hijack. One group chained GitHub Actions flaws to take over a popular library's build runner during a workflow and publish a trojanized release from inside the trusted CI environment (CVE-2026-45321, CVSS 9.6).
• Prompt injection against coding assistants. Campaigns targeting GitHub Copilot and Claude Code by planting hidden CSS, zero-sized fonts and concealed HTML attributes in web pages the assistant reads.
• Rogue MCP servers dropped into developers' local workspaces by a worm, so the model's tool layer becomes the attacker's tool layer.

Different entry points, same move: get inside something the developer already trusts, and let the trust do the work.

6. What was surprising

1. Vulnerability exploitation overtook stolen credentials as the #1 way in. That had never happened in the DBIR before.
2. The user is now the most common exploit. ClickFix, 47%, uses no vulnerability at all.
3. Security vendors were in the blast radius of the Salesloft breach, through the exact class of integration they warn customers about.
4. RansomHub went from 736 victims to zero in twelve months. A number-one ransomware brand can evaporate overnight when affiliates defect. This quarter The Gentlemen passed Qilin, and a brand-new group, DeadLock, walked straight onto the leaderboard.
5. The target moved to the control plane. Not the firewall - the thing that manages the firewall.
6. Industrialization, not innovation. The mid-September consensus: attackers are optimizing for repeatable playbooks, not novel exploits.

Threat actors don't want better attacks. They want repeatable ones.

The Hacker News, September 2026

The through-line

Every item on this page is a trusted thing that nobody tested.

The CAPTCHA is trusted. The signed kernel driver is trusted. The vendor's OAuth grant is trusted. The dependency is trusted. The AI assistant's config file is trusted. They sit inside the perimeter, or they are the perimeter, and the annual pentest walks straight past all of them because no single team owns them.

The reassurances that stopped working this quarter:

• "The vendor is SOC 2, so the integration is fine."
• "It is an internal dev tool, so it is out of scope."
• "The driver is Microsoft-signed, so it is safe."
• "We will get to the patch list next sprint."

Q3 2026 keeps asking one question: what do you trust that you have never actually tested, and what does an attacker get if that one thing is wrong.

Answer it on purpose. Someone is going to answer it for you otherwise, and this quarter they were fast about it.

---

Sources: Verizon DBIR 2026: vulnerability exploitation is the #1 initial-access vector (watchTowr) · ClickFix Attacks in 2026: variants and data (Revel8) · 54 EDR killers use BYOVD to abuse 35 signed drivers (The Hacker News) · Reynolds ransomware: driver embedded in payload (Raxis) · CISA adds NetScaler, Linux, SQL Server and legacy flaws to KEV (The Hacker News) · SharePoint CVE-2026-55040 and Q3 exploitation clusters (Safe Security) · Citrix, Cisco and Microsoft August release (CSC Isle of Man) · Akira's aggressive SonicWall VPN campaign (Arctic Wolf) · ShinyHunters, the Salesforce megahack, and 700+ companies (databreach.com) · Salesloft Drift OAuth token breach, UNC6395 "Icarus" (Rescana) · Jaguar Land Rover data breach (Gurucul) · DentaQuest: largest US healthcare breach of 2026 (tech.co) · Shai-Hulud 2.0 npm worm analysis (Datadog Security Labs) · AI supply-chain attacks and Unicode config poisoning (Phoenix Security) · The top 10 ransomware groups of 2026, ranked (netguardia) · Threat actors don't want better attacks, they want repeatable ones (The Hacker News) · Q3 2026 monthly incident recap (CM-Alliance) · Top 10 exploited vulnerabilities of 2026 (ThreatMon) · State of Exploitation 1H-2026 (VulnCheck) · M-Trends 2026 (Mandiant / Google) · Researcher analyzes 3,000 live ClickFix payloads (The Hacker News) · Windows attack techniques 2026: BYOVD, ClickFix, C2 over cloud (Hive Security)