This week, for Cybersecurity Awareness Month (Part 2), we briefed our clients on the most common threats their end users will face today.
KEY TAKEAWAYS
Cybersecurity Awareness Month Part 2 – Common Threats. Review of ClickFix, device code phishing, fake software downloads, infostealers, CVEs, and AI risks.
Critical and high-severity vulnerabilities Microsoft, BeyondTrust, Palo Alto, Cisco, SAP, SonicWall, Citrix, Linux, NGINX, and GitLab, plus updates to CISA KEV, patch now!
In Cybersecurity Awareness Month Part 1, the article went back to basics, covering passwords and MFA, patching, logging, auditing, backups, and (mis)configurations. This week, we will take a look at some of the most common threats facing every organization today. These threats tend to target the end user, and oftentimes lead to devastating impact such as ransomware or data exfiltration if not remediated appropriately.
ClickFix/Fake CAPTCHA/FileFix
This style of attack has been around for a couple of years now, but its usage by threat actors continues to increase, and is a popular way for threat actors to either gain initial access into an environment or deploy infostealer malware. The attack occurs when a user visits either a compromised site (drive-by attack) or is tricked into visiting an attacker-controlled site via phishing or SEO abuse. The victim is then presented with a prompt similar to this:
Figure 1: Fake CAPTCHA Example | Source: Elastic Security
If the victim follows the steps shown, this results in them opening the Run dialog box (oftentimes it will prompt to open PowerShell or CMD), pasting in malicious code, and then executing the malicious code. This sequence literally gets the target victim to run the malicious code on the threat actor's behalf. In most cases, this initial set of malicious code will download and execute a malicious file, establishing a foothold on that endpoint.
User awareness training is the most effective defense of these threats. Additionally, user's ability to use the Windows Run command, as well as access to PowerShell or the Command terminal can be restricted via GPO.
Device Code Phishing
Device code authentication flow is a numeric or alphanumeric code used to authenticate an account, typically meant for an input-constrained device that does not have the ability to perform an interactive authentication, (think Netflix sign-in on a smart TV). In these attacks, the threat actor generates a legitimate device code request and creates a phishing lure to trick the victim into entering it into a legitimate sign-in page. This process allows the attacker to capture "access" and "refresh" tokens, which can then be used to access the victim's accounts and data. According to Microsoft, these tokens can also be leveraged to access other services where the user has permissions, such as email or cloud storage, without needing a password.
Below is a screenshot of one of these phishing lures that PacketWatch has observed:
Figure 2: Device Code Phishing Attempt
The phishing lures themselves can be a variety of themes, such as invoices, RFPs, or shared documents/files. The document payloads can also have a wide range including direct URLs, PDF attachments, or HTML files.
The simplest way to combat this threat is to disable device code flow wherever possible. This can be accomplished via a Conditional Access policy, and the steps for implementation can be found here. Even Microsoft's own documentation states "We recommend organizations get as close as possible to a unilateral block on device code flow." Why Microsoft has this feature enabled by default if it so insecure is a mystery, but organizations should make every step necessary to disable this feature in their environment.
If there are reasons why disabling this feature cannot be achieved, then user awareness training is an absolute must. This particular phishing campaign is extremely effective at convincing users to enter these device codes. Users must be aware that there is effectively never a legitimate reason they should enter these codes on their workstations.
Fake Software Downloads
Fake software downloads continue to be one of the most effective methods for threat actors to gain an initial foothold in an environment.
One of the most notorious "Fake Update" malware campaigns is known as SocGholish. This "loader" malware has been observed since at least 2017. It is still one of the top initial infection methods today. Threat actors will compromise legitimate websites with malicious code that prompts the user to download updates to their web browser. These updates are bundled with malicious JavaScript code that facilitates the download and execution of further malicious payloads. Historically, SocGholish was known to download Cobalt Strike beacons to facilitate persistence after initial access, however, it has been observed leading directly to ransomware infections.
Another very popular type of fake software abused by threat actors is free PDF editors. PacketWatch has observed multiple campaigns leveraging this method, including EvilAI, TamperedChef, and CrystalPDF. These malicious PDF editors typically result in the installation of infostealer malware, which is designed to harvest all of the end user's credentials.
To combat this type of threat:
Credential Attacks (InfoStealers)
Credential attacks via infostealers continue to rise. Last year, we reported that these attacks rose over 800% compared to the previous year. Research from Flashpoint shows that from January 1, 2026 to June 30, 2026, over 7.4 million endpoints were infected with infostealer malware, resulting in over 1.7 billion stolen credentials. These stolen credentials are then trafficked on hacker forums and the darkweb, where they are then purchased and leveraged by threat actors to gain initial access.
Having fully up-to-date EDR solutions applied to every possible endpoint will help prevent execution of infostealers. Implementing MFA on every account that has remote authentication capabilities is the most effective control against credential attacks. Additionally, darkweb monitoring services can help identify compromised accounts so their credentials can be changed proactively.
Even More CVEs (Vulnerabilities)
According to recent research from BlackTree CVE Intelligence, a total of 81,780 CVE records have been published in 2026 (as of October 18). This is a 106% increase in reported CVEs versus the same time in 2025. The report also shows a total of 308 vulnerabilities added to the CISA KEV in the last 12 months. The recent capabilities of publicly released AI models have led to an explosion of vulnerability discoveries. This will lead to an even higher growth of vulnerability disclosures in the coming months.
Patching has always been an important aspect of cybersecurity, but in 2026 it is absolutely crucial to implement security patches as soon as possible, as threat actors are quickly weaponizing exploits for these vulnerabilities. In addition to patching, organizations can reduce their attack surface by closing unused/unnecessary ports and services and removing management interfaces from the open internet.
AI Risks
2026 has been a pivotal year in AI technology with regards to cybersecurity. Recent frontier models such as Claude Mythos have made bleeding-edge vulnerability discovery accessible to the masses. This has led to the explosion of vulnerability disclosures in recent months.
AI is also being heavily leveraged by threat actors for offensive purposes. Phishing, vishing, and other social engineering methods are far more convincing, as AI tools can craft hyper-realistic emails, fake invoices, and deepfake voice and video is good enough to fool most people. AI tools also allow threat actors to write exploit code and malware at an incredibly fast rate, and also lowers the barrier to entry for lower-skilled attackers.
AI usage in the corporate environment also poses a wide range of risks. AI tools expose companies to potential data privacy violations. Agentic AI tools pose a variety of risks, as they require credentialed, privileged access to a variety of tools and applications. If threat actors compromise these agents, they often get "keys to the kingdom". There is also the risk of a "misaligned" AI agent performing and unwanted or undesired task, such as completely deleting a database.
Conclusion
The cybersecurity threat landscape in 2026 presents a wide range of challenges for security analysts and administrators. The volume of threats, and the speed at which attackers can achieve their goals has never been higher. Security teams must apply and enforce security basics across the enterprise without exception. Cybersecurity is a process, not a one-time venture. It takes continuous effort every single day across the entire enterprise. Everyone has a stake.
Resources
https://learn.microsoft.com/en-us/entra/identity/conditional-access/policy-block-authentication-flows
https://packetwatch.com/resources/threat-profile/evilai-and-vibe-coded-malware
https://packetwatch.com/resources/threat-intel/cyber-threat-intelligence-09-08-2025
https://packetwatch.com/resources/threat-intel/cyber-threat-intelligence-report-10-20-2025
https://flashpoint.io/resources/report/flashpoint-global-threat-intelligence-report-midyear-2026/information-stealing-malware-threats/#GTIR-midyear
Vulnerability Roundup
Another record was smashed this month, with Microsoft's Patch Tuesday addressing 1,411 new security flaws. The vulnerability list includes 3 zero-days, and 70 "critical" vulnerabilities, 57 of which are remote code execution. Applying these monthly security updates from Microsoft are always important, but with each month seeing record-breaking volumes of vulnerabilities, it is critically important for administrators to apply these fixes in a timely manner.
BeyondTrust recently disclosed details of a critical authentication bypass vulnerability in its Remote Support product that has been under active exploitation since late August. Tracked as CVE-2026-102764, successful exploitation lets unprivileged remote attackers perform file operations on vulnerable devices. The flaw impacts Remote Support versions 26.2.3 or earlier. The SaaS versions of the product received the update automatically, but self-hosted installations must apply the patch manually.
Further research into the active exploitation was provided by Mandiant and the Google Threat Intelligence Group. Their research shows this flaw was exploited by a China-nexus espionage group tracked as "ARMORY CASTLE" (aka Warp Panda). In the observed attacks, this vulnerability was used for gaining initial access, followed by the deployment of a webshell, elevation of privileges, persistence, credential dumping, and lateral movement further into the target network.
Administrators are urged to apply the updates as soon as possible. Additionally, administrators are urged to check for indicators of compromise. Details of this campaign's IOCs can be found in the Google Mandiant article here. This article also provides detailed guidance on other mitigations and compensating controls that can be applied to the device.
https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust
https://www.bleepingcomputer.com/news/security/beyondtrust-patches-zero-day-exploited-in-attacks-since-august/
Palo Alto recently released a security advisory for a high-severity remote code execution (RCE) vulnerability affecting the management interface of PAN-OS that is under active exploitation. Tracked as CVE-2026-0322, the flaw allows an authenticated attacker with network access to run arbitrary code with root privileges on the affected device. There are no workarounds for this vulnerability; the software patch must be applied. However, risk can be mitigated by restricting access to the management interface (which is the recommended best practice). The table below shows affected versions and their corresponding fix:
Figure 4: PAN-OS vulnerable versions and corresponding fixed version | Source: Palo Alto
Administrators are strongly urged to apply the update as soon as possible, as this vulnerability is under active exploitation.
On October 14, Cisco released details of a critical vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway that is under active exploitation. Tracked as CVE-2026-76519, the flaw is due to improper handling of email attachments when the file reputation service is enabled. This vulnerability can be exploited by an attacker by sending an email that contains a crafted attachment to an affected device, allowing the attacker to write arbitrary files and execute commands with root privileges on the underlying operating system.
The table below shows vulnerable AsyncOS Software for Cisco Secure Email Gateway and their corresponding fixed release:
In addition to running a vulnerable version, the device must meet the following conditions:
Details of how to check for these conditions can be found in the Cisco advisory here. Additional details for checking for indicators of compromise can also be found in the advisory. Administrators are urged to apply the updates and follow the vendor recommendations as soon as possible.
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-afw-zqYJkjxp
Cisco recently addressed a critical vulnerability affecting Cisco NX-Os Software for Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches. Tracked as CVE-2026-76465, successful exploitation could allow an unauthenticated remote attacker to execute arbitrary code with root privileges or cause a denial of service condition by sending a specially crafted multi-protocol label switching (MPLS) echo-request packet to the affected device. In addition to running a vulnerable version, devices must have the MPLS OAM feature enabled (which is disabled by default). To check the status of this feature, run the following command in the Cisco NX-OS CLI: sho show feature | include mpls_oam. Administrators are urged to apply the update as soon as possible.
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-moam-rce-uBTzYV7
SAP published their "SAP Security Patch Day" on October 13, and it includes fixes for 16 security vulnerabilities. The list includes a maximum-severity OAuth2 SSRF vulnerability in SAP Cloud SDK for Python (CVE-2026-89111), a critical Broken Access Control vulnerability in SAP NetWeaver Visual Composer (CVE-2026-89110), and a critical Code Injection vulnerability in SAP S/4HANA (CVE-2026-89107). Administrators are urged to apply the updates as soon as possible.
https://support.sap.com/en/my-support/knowledge-base/security-notes-news/october-2026.html?isu_page=1
Earlier this month, SonicWall addressed multiple vulnerabilities in their SMA-1000 series appliances, including a maximum-severity server-side request forgery (SSRF) vulnerability. Tracked as CVE-2026-102255, successful exploitation allows a remote unauthenticated attacker to direct the appliance to issue requests on their behalf and reach internal functionality and perform unauthorized requests. The flaws affect SMA1000 models 6210, 7210, and 8200v running versions 12.4.3-03526 and 12.5.0-02952 or older. Administrators are urged to apply the update as soon as possible.
On October 8, Citrix published another security advisory for their NetScaler ADC and NetScaler Gateway devices. The advisory highlights CVE-2026-107406, a memory overflow vulnerability that can lead to remote code execution or denial of service. The vulnerability impacts NetScaler ADC and NetScaler Gateway devices with vulnerable firmware versions that are also configured as a SAML SP or SAML IdP:
For the following versions: Applicable only when configured as a SAML IdP:
For the following versions: Applicable only when configured as a SAML SP or SAML IdP:
Administrators are urged to apply the update as soon as possible.
https://community.citrix.com/techzone-blogs/110_security-updates/protecting-customers-immediate-guidance-for-cve-2026-107406-in-netscaler-adc-and-netscaler-gateway-r1631/
Security researchers from pwn.ai recently released details on PwnEscape, a critical flaw in the Linux kernel that allows code inside a virtual machine to read memory on the host computer it runs on. Tracked as CVE-2026-99999, successful exploitation of this vulnerability via specially crafted network packets can allow for 3 potential outcomes: read the host's memory, crash the host, or run code on the host (VM escape). The table below shows the fixed versions of the Linux kernel:
Figure 6: Fixed Linux Kernel versions | Source: TheHackerNews
Administrators are strongly encouraged to apply the kernel update to their Linux environments.
On October 14, F5 released security patches to address a range of critical and medium-severity flaws in NGINX. The most critical vulnerabilities in this set are CVE-2026-15176 and CVE-2026-97205 which affect the ngx_http_v3_module and CVE-2026-93479 which affects the NGINX map directive. Successful exploitation can allow remote attackers without privileges to launch denial-of-service (DoS) attacks or gain code execution on systems with non-default configurations where Address Space Layout Randomization (ASLR) is disabled. The flaws impact a range of NGINX software, including NGINX Plus, NGINX Open Source, NGINX Ingress Controller, NGINX Gateway Fabric, and NGINX Instance Manager. Administrators are urged to apply the patches as soon as possible. If patching is not possible, review the F5 KB articles for mitigation guidance.
GitLab recently addressed a maximum-severity vulnerability in its Community Edition (CE) and Enterprise Edition (EE) software. Tracked as CVE-2026-97229, successful exploitation allows and unauthenticated attacker to execute arbitrary code on the GitLab server. The vulnerability affects the following versions:
Fixed versions are 19.4.2, 19.3.5, and 19.2.8. Three additional high-severity flaws were also addressed in this update. Administrators are urged to apply the patch as soon as possible.
https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/
https://thehackernews.com/2026/10/gitlab-patches-cvss-100-flaw-that-could.html
The following vulnerabilities were added to CISA's Known Exploited Vulnerabilities Catalog in the last 2 weeks:
CVE-2025-61624 - Fortinet Multiple Products Path Traversal Vulnerability
CVE-2026-102764 - BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability
CVE-2026-21589 - Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability
CVE-2026-0322 - Palo Alto Networks PAN-OS Code Injection Vulnerability
CVE-2026-105133 - Ahsay AhsayCBS Improper Authentication Vulnerability
CVE-2026-76519 - Cisco Secure Email Gateway Relative Path Traversal Vulnerability
CVE-2026-105134 - Ahsay AhsayCBS Command Injection Vulnerability
CVE-2026-96951 - Microsoft Windows Command Injection Vulnerability
CVE-2026-104935 - Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability
CVE-2015-3306 - ProFTPD Improper Access Control Vulnerability
CVE-2021-3199 - ONLYOFFICE Docs Server Path Traversal Vulnerability
CVE-2023-22894 - Strapi Cleartext Storage of Sensitive Information Vulnerability
CVE-2016-3081 - Apache Struts Command Injection Vulnerability
CVE-2015-5477 - ISC BIND Data Processing Errors Vulnerability
CVE-2026-88779 - Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
This report is provided FREE to the cybersecurity community.
Visit our Cyber Threat Intelligence Blog for additional reports.
Visit our Cyber Threat Profile Blog for detailed intelligence profiles.
Visit our Beyond the Threat Feed Blog for more articles.
Subscribe to be notified of future Reports:
NOTE
We have enhanced our report with data from SOCRadar. You may need to register to view their threat intelligence content.