Major Cyber Attacks in September 2026: US and EU Face Session Theft, Remote Access, and Payment Fraud

Immediate Actions

Key Takeaways

• CSuite linked to 351 sandbox analyses; 51% of submissions from the United States.
• N0va abuses Microsoft Device Code flow to obtain access and refresh tokens.
• IronToll connected to 114 malicious domains across 71 non-Cloudflare origins.
• TerminalFix retrieves lure domains from Polygon smart contract via 8 public RPCs.
• Wazza hides final phishing page behind anti-bot checks and staged redirects.

Attack Chain

1. Initial Access: Compromised WordPress sites redirect to Polygon smart contract-resolved lure domains
2. Execution: JavaScript encodes binary as English words; Node.js decodes and executes dropper
3. Persistence: .bat script registers Windows Run key for survival across reboots
4. Defense Evasion: Signed applaunch.exe sideloads trojanized mscoree.dll from %PROGRAMDATA%
5. C2: WinHTTP stager beacons to documentsphotos.com and getimageinformation.com endpoints

Affected Systems

• Microsoft 365 users and Azure AD authenticated environments
• US and EU enterprise organizations across multiple sectors
• WordPress sites compromised for phishing delivery
• Windows endpoints targeted by TerminalFix DLL sideloading
• Banking, manufacturing, government, healthcare, and consulting sectors

Detection Availability

No detection rules or queries are published in the source article.

Detection Engineering Assessment

Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.

Hunting Hypotheses

Required Log Sources

• Microsoft 365 audit logs
• Azure AD sign-in and device registration logs
• EDR process creation and file write telemetry
• Web proxy and DNS resolution logs
• PowerShell script block logging (Event ID 4104)
• Sysmon Event ID 7 (image load)

Key Behavioral Indicators

• Device code authentication requests from non-corporate IPs or unknown devices
• Multiple RMM tools installed within short timeframe on same host
• Signed binaries loading DLLs from %PROGRAMDATA% with randomized names
• PowerShell execution with -EP Bypass and -WindowStyle Hidden flags
• Node.js runtime downloading and executing scripts from external URLs
• WebSocket connections to unknown domains following phishing page visits

Control Gaps

• URL filtering based on first-hop only misses redirected phishing pages
• Single IOC blocking fails against rotating disposable infrastructure
• Credential-only monitoring misses token and session theft
• Signature-based AV misses legitimate tool abuse and signed binary sideloading
• Device code authentication flows may not trigger conditional access alerts

False Positive Assessment

Recommendations

Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.

Infrastructure Hardening

• Implement conditional access policies restricting device code authentication
• Block outbound connections to known C2 endpoints and phishing infrastructure
• Enable advanced phishing protection in email gateways and Microsoft 365
• Monitor DNS queries to newly registered domains matching phishing patterns

User Protection

• Deploy EDR rules detecting DLL sideloading via signed Microsoft binaries
• Block script execution from %PROGRAMDATA% with randomized directory names
• Alert on PowerShell execution with execution-policy bypass and hidden flags
• Restrict Node.js runtime execution in standard user contexts

Security Awareness

• Train users to verify sender domains for document-sharing and authentication requests
• Warn about device code authentication prompts received outside expected workflows

MITRE ATT&CK Mapping

Plain-Language Summary

Attackers in September 2026 used trusted cloud services and legitimate software to steal login sessions, install remote access tools, and commit payment fraud against organizations in the US and Europe. Five campaigns targeted Microsoft 365 users, banking customers, and government employees through fake document pages and authentication prompts. Organizations should revoke active sessions, check for unauthorized remote management tools, block known malicious domains, and train employees to verify unexpected authentication requests.

Additional IOCs

• Ips:
  • 103[.]65[.]237[.]122 - Phishing infrastructure IP from utils.js campaign
  • 188[.]114[.]97[.]3 - Phishing infrastructure IP from utils.js campaign
  • 188[.]114[.]96[.]3 - Phishing infrastructure IP from utils.js campaign
  • 172[.]93[.]106[.]214 - Phishing infrastructure IP from utils.js campaign
  • 65[.]98[.]19[.]2 - Phishing infrastructure IP from utils.js campaign
  • 212[.]227[.]90[.]29 - Phishing infrastructure IP from utils.js campaign
  • 172[.]67[.]201[.]233 - Phishing infrastructure IP from utils.js campaign
  • 104[.]21[.]76[.]224 - Phishing infrastructure IP from utils.js campaign
  • 189[.]127[.]165[.]218 - Phishing infrastructure IP from utils.js campaign
• Domains:
  • check[.]xzovy[.]vu - Phishing domain from utils.js campaign
  • bcvipconcierge[.]com[.]br - Phishing domain from utils.js campaign
  • govlodgementhub[.]com - Phishing domain impersonating government lodgement
  • acrobatdocfiles[.]es - Phishing domain impersonating Adobe Acrobat
  • securedocu[.]icu - Phishing domain impersonating DocuSign
  • peputragroup[.]com - Phishing domain from utils.js campaign
  • wel[.]poluytyno[.]site - Phishing subdomain from utils.js campaign
  • ashland-energy[.]com - Phishing domain from utils.js campaign
  • pedartgallery[.]com - Phishing domain from utils.js campaign
  • mk[.]parymg[.]com - Phishing subdomain from utils.js campaign
• Urls:
  • hxxps://documentsphotos[.]com/api/init - TerminalFix C2 initialization endpoint
  • hxxps://getimageinformation[.]com/api/ci - TerminalFix C2 beacon endpoint
  • hxxps://updatemsnow[.]com/get_script - TerminalFix dropper script retrieval URL
  • hxxps://updatemsnow[.]com/get_update - TerminalFix Update.zip download URL
  • hxxps://buenosaires-gob[.]top/ar/index.html#/card - IronToll phishing payment page impersonating Buenos Aires
  • hxxps://docsendsr[.]online/ - CSuite phishing URL for session theft
  • hxxps://edl14ek-qs1k-wu5xr-smqa0s7-6738dta[.]wndws-pip3ln-sql3-waf3-gdprsx-dfn-azfn-appsvc-0ffapx[.]workers[.]dev - Wazza phishing URL on Cloudflare Workers
  • hxxps://peputragroup[.]com/m/js/utils.js - Phishing kit JavaScript from utils.js campaign
  • hxxps://securedocu[.]icu/fls/m/js/utils.js - Phishing kit JavaScript from utils.js campaign
  • hxxps://govlodgementhub[.]com/3894/m/js/utils.js - Phishing kit JavaScript from utils.js campaign
  • hxxps://wel[.]poluytyno[.]site/m/js/utils.js - Phishing kit JavaScript from utils.js campaign
  • hxxps://ashland-energy[.]com/aa/m/js/utils.js - Phishing kit JavaScript from utils.js campaign
  • hxxps://pedartgallery[.]com/pr/m/js/utils.js - Phishing kit JavaScript from utils.js campaign
  • hxxps://mk[.]parymg[.]com/mmidk/m/js/utils.js - Phishing kit JavaScript from utils.js campaign
  • hxxps://acrobatdocfiles[.]es/view/m/js/utils.js - Phishing kit JavaScript from utils.js campaign
• File Paths:
  • applaunch.exe - Legitimate signed Microsoft binary renamed for DLL sideloading
  • mscoree.dll - Trojanized DLL sideloaded by applaunch.exe
  • Update.js - Dropper script with 256-token word map
  • Update.zip - Archive downloaded from updatemsnow.com
  • msedge.zip - Renamed Node.js runtime (node-v7.10.1)
• Command Lines:
  • Purpose: Execute hidden PowerShell with execution policy bypass for payload delivery | Tools: powershell.exe | Stage: Execution | powershell.exe -NoProfile -EP Bypass
  • Purpose: System binary proxy execution via slui.exe launched from browser process | Tools: slui.exe, msedge.exe | Stage: Execution | slui.exe -Embedding
• Other:
  • TFDRCRHIXNRJ - Resource name in sideloaded DLL containing 22,017-token word map
  • JP$GWAVF - XOR key used to decode JPEG decoy shellcode