Threat View from the Lens of Huntress Adversary Tactics: September 2026

Huntress SOC analysts investigated two phishing attacks that used browser-in-the-browser pages to impersonate Adobe Reader. In one case, a fake CAPTCHA led to a page showing blurred documents and a prompt to install an “update.” In another, a malicious message delivered through a legitimate communications platform used the same template. Instead of Adobe Reader, victims downloaded rogue ScreenConnect clients. Each attack installed two clients, creating redundant, service-based persistence, before using HideCursor or HideUL to conceal on-screen activity. Huntress stopped both attacks before they progressed further, but the campaigns show how familiar branding and legitimate-looking browser elements can turn a phishing click into persistent remote access. Huntress SOC analyst Sarah Reddish outlined the attack in this blog post.

A phishing campaign with an Adobe lure

Huntress observed a phishing campaign that abused Microsoft Power BI to make its lure look legitimate and slip past controls that trust the service. Victims received an email linking to a public Power BI page that displayed a fake “Download Reference” button. Clicking it opened an attacker-controlled site that fingerprinted the browser and host before triggering a rogue ScreenConnect download. The initial client installed a second remote-access client, giving the attackers redundant access. In one incident, the attackers also used a PowerShell script, a scheduled task set to run every two minutes, and HideUL_x64.exe to evade defenses. The SOC stopped the activity before it could advance.

An outline of the phishing campaign

Huntress investigated a September ransomware incident involving Settra, a newer ransomware variant first publicly reported in June. The Huntress agent was installed while the intrusion was already underway, but telemetry still showed the attacker’s post-compromise playbook. The actor installed MeshAgent for remote access and used a Bring Your Own Vulnerable Driver technique, likely to interfere with security tools. They then launched ransomware from the compromised user’s Documents folder, encrypted files with the .locked_wip extension, created RESTORE_FILES.txt ransom notes, cleared numerous Windows event logs, and disabled Windows recovery options. A misspelled Defender log name left one valuable source of evidence intact. Check out our analysis of Settra for more information.

Signals indicating the attacker's use of BYOVD and the MeshAgent RMM

Huntress researchers found a modular RAT hidden inside a tampered Exodus crypto wallet installer. Victims opened fake PDFs or software-update ZIP files that launched JavaScript, displayed a legitimate decoy document, and silently installed the wallet. The package was nearly indistinguishable from the real application: just three of 1,973 files were modified, and it had no VirusTotal detections. Those changes prevented a window from appearing and loaded a memory-resident payload with hidden VNC, a SOCKS proxy, browser credential theft, file management, and remote commands. An hourly scheduled task relaunched the invisible application, while command-and-control traffic used Azure Table Storage rather than an attacker-owned domain. Learn more about the attack in this blog post by Jonathan Semon and Jose Oregon.

How an unopenable crypto wallet ends up installing a modular RAT to steal browser credentials

Huntress researchers uncovered Knight Office, an operator console behind an adversary-in-the-middle phishing campaign targeting Microsoft 365 accounts. A DocuSign-style lure used Monday redirects and a compromised Joomla website to hide the final phishing page. After a victim completed MFA, the kit captured a valid session token and replayed it from attacker infrastructure, bypassing password-based controls. The actor then registered an unauthorized Microsoft Entra device and bound a Windows Hello for Business key credential to the account. That created durable passwordless access that could survive session revocation. Huntress linked at least nine token-replay attacks to the kit and found hundreds of related lures reported through its telemetry.

The lure email behind the AiTM attack

Microsoft’s September Patch Tuesday was its biggest yet, addressing 974 vulnerabilities across Windows, Office, SQL Server, Exchange, SharePoint, Azure, and developer tools. Two Windows privilege-escalation vulnerabilities were already being exploited in the wild, while the release also included 20 potentially wormable flaws. The scale alone makes this update cycle noteworthy, but the active exploitation raises the stakes.

Cisco issued emergency fixes for CVE-2026-76460, a maximum-severity authentication bypass in Identity Services Engine and ISE Passive Identity Connector. The flaw lets an unauthenticated, remote attacker send crafted requests to a vulnerable API endpoint, bypass the web management interface, and gain root-level command execution.

Brevo disclosed a supply-chain attack in which attackers used a compromised Cloudflare API key to deploy a Worker at the CDN edge. For roughly five hours, the Worker rewrote Brevo-hosted scripts embedded on sites. Visitors were shown a fake Cloudflare verification page that pushed ClickFix malware, while logged-in WordPress administrators faced an attempted backdoor installation.

In August, Huntress supported its customers when N-able disclosed actively exploited N-central flaws. Then September brought a new series of discoveries. On September 5, Huntress reproduced a separate exploit chain affecting fully patched environments, involving CVE-2026-86206 and CVE-2026-86207, that could bypass access controls and create unauthorized administrative accounts. The team shared its findings with N-able, which released Hotfix 3. The next day, N-able disclosed CVE-2026-86218, an actively exploited pre-authentication RCE rated 10.0, and released Hotfix 4, which supersedes prior fixes. Huntress also worked with Cloudflare to disable adversary tunnels and published hunting guidance for API anomalies and suspicious .invalid account changes in N-central environments worldwide.

Huntress investigated three incidents in which social engineering led victims to install rogue ScreenConnect clients. On unrelated endpoints, those clients repeatedly spawned wscript.exe to run four staged VBScript files, then created WindowsServiceHost persistence in AppData. The modified ScreenConnect clients did more than provide remote access: they watched for new Host connections, transferred the same scripts through ScreenConnect’s virtual file-transfer feature, and executed them on connected systems. That gave the campaign a potentially worm-like propagation path. The campaign also used Quick Assist and UltraViewer. ConnectWise released version 26.6.5 to address an authorization flaw in Client Support and Access session file transfers.

Huntress detected ScreenConnect.WindowsClient.exe spawning the child process wscript.exe

• Unsecured Credentials - New Credential Files Dashboard and Allowlisting: We've given Unsecured Credentials a complete overhaul, with a new dashboard, full visibility into flagged files, and the ability to allowlist files you don't want reported. What's new?
  • Credential Files page. A new home for Unsecured Credentials, available from the Process Insights dashboard in Managed EDR. View and manage every file triggering an Unsecured Credentials report in one place.
  • See before you enable. You can now preview which Credential Files would generate an Incident Report, without turning reporting on!
  • Allowlisting. Exclude the files you've reviewed and accepted, so reports stay focused on what actually needs attention.

Have you turned these off before? Give them another look.

• New ITDR dashboard is now live: The redesigned Managed ITDR dashboard is now generally available to all partners and customers! Built to help you investigate identity threats faster and get the context you need in one place, the new dashboard brings powerful investigation capabilities directly into your ITDR workflow, including Rapid Identity Triage, Failed Login Characterization, and Quick SIEM Search. Starting now, the redesigned dashboard will be the default dashboard when you access Managed ITDR. Get more ITDR dashboard details in our new blog.

• Managed ISPM now offers two ways to deploy security controls: Managed Deployments, the recommended default, is when Huntress picks the controls and rolls them out for you automatically. It’s built for teams that want hardening handled without hands-on review. Brand new: Modified Deployments allow you to build your own set of controls from the full Huntress policy library and set your own rollout schedule. New controls aren’t rolled out until you’ve first approved them. This method is built for change-control and compliance-heavy environments like CMMC or ISO 27001.
• New security controls in Managed ISPM: As we continue to build out depth of controls to harden Microsoft 365 environments, we have added new controls in Microsoft Exchange Online and Microsoft Defender for Office 365 to protect against Shadow Workflows.

• New log sources in the Huntress SIEM: We are happy to announce that we officially support powerful new log sources, including IT Glue, Cato, Checkpoint, N-Able, and Scout DNS. By normalizing this data, we are unlocking deeper, more actionable insights into your IT infrastructure than ever before!

• New Learner Onboarding Video: This new assignable video gives learners the complete run down of what to expect from their new Security Awareness Training program, from episodes, to phishing scenarios, Phishing Defense Coaching, Threat Simulators, and more.

September’s Tradecraft Tuesday, “Borrowed Faces, Borrowed Certs,” unpacked a post-DEFCON campaign that impersonated a CoinDesk executive and used a Google Doc as lure and reconnaissance tool. A container-bound Apps Script collected a viewer’s IP address, location, browser details, and crypto-wallet extensions, then sent the data to Telegram. Victims were steered toward macOS or Windows payloads through decryption errors, ClickFix prompts, and downloads signed with stolen certificates. The macOS path delivered an AMOS-like stealer, while the Windows chain recovered a NetSupport RAT, a rogue certificate authority, and a crypto-wallet implant. Researchers also showed how they recovered stages after C2 went offline. Check out the full recap here—and make sure to sign up for our October Tradecraft Tuesday!

The September Tradecraft Tuesday episode was focused on a post-DEFCON malware campaign