30
CVE-2026-76186: Apache Airflow Keycloak provider: Keycloak token cookies not bound to Airflow session identity
Apache Airflow Keycloak provider takes authorization tokens from unauthenticated cookies never checked against the signed session identity, enabling cookie substitution.
CVE-2026-76186 affects apache-airflow-providers-keycloak before 0.10.0. From Airflow 3.3, the Keycloak auth manager derives user identity from the signed Airflow session token but reads Keycloak access and refresh tokens used for every authorization decision from separate unauthenticated cookies. It never verifies that the two correspond to the same user, allowing mismatched token cookies to drive authorization decisions. Severity is rated moderate.
30
30
30
30
30
30
30
30
45
50
Inside Knight Office, a New M365 AiTM Phishing Kit
Huntress details Knight Office, a new AiTM phishing kit stealing Microsoft 365 session tokens and registering attacker-controlled devices.
Huntress investigated an August 18, 2026 adversary-in-the-middle attack using the Knight Office phishing kit, which captured Microsoft 365 session tokens via a DocuSign-style lure routed through a Monday.com tracking link and a compromised Joomla site. After token capture, the actor enrolled an unauthorized host in Microsoft Entra ID and bound a Windows Hello for Business key credential to the account. The kit's operator console, found at IP 104.37.188.94, is built on Python Flask and hosts at least 25 .vu phishing domains. Telemetry links the kit to at least nine token-replay logins in two weeks and roughly 700 reported lure emails since April.
52
30
30
30
30
45
30
45
N0va Phishkit Targets US and EU Businesses: A New Challenge for Identity Security
N0va phishkit targets US and EU organizations with trusted-brand lures, capturing tokens via legitimate authentication flows to gain SSO access to corporate resources.
The N0va phishing kit targets organizations in government, technology, consulting, and healthcare across North America and Europe with lures impersonating Microsoft Teams, SharePoint, OneDrive, DocuSign, Google Drive, Dropbox, Zoom, and Adobe Sign. Victims are guided through legitimate authentication flows, including device code phishing, after which N0va captures access and refresh tokens and abuses token-exchange or device-registration mechanisms to establish SSO access. ANY.RUN tracks the campaign via a characteristic /api/verification/init URL pattern and demonstrates detection in its interactive sandbox.
58
30
30
30
30
CVE-2026-86466: Apache Airflow FAB provider: FAB Authentik provider: id_token issuer/audience not validated
Apache Airflow FAB provider before 3.9.0 skips issuer/audience validation on Authentik id_tokens, allowing tokens minted for other clients to authenticate to Airflow.
CVE-2026-86466 affects apache-airflow-providers-fab before 3.9.0. The Authentik OAuth path in the FAB auth manager does not validate the issuer or audience claims of accepted id_tokens. An attacker holding a token minted by the same Authentik identity provider for a different client application can present it to Airflow and be authenticated. Severity is rated moderate by the reporter.
30
JSCeal Hides Crypto Malware in V8 Bytecode
Check Point details JSCeal, a crypto-stealing malware delivered as compiled V8 bytecode, and built a decompiler pipeline to expose its capabilities.
JSCeal, tracked by Check Point Research since early 2025, is a cryptocurrency stealer delivered as heavily obfuscated JavaScript compiled to V8 bytecode (.jsc) and run by a bundled Node.js runtime. Check Point, presenting at Black Hat USA 2026, extended the open-source View8 decompiler into a pipeline that recovered readable code from 23 samples, revealing theft of browser credentials and cookies, Telegram sessions, keystrokes, screenshots, HTTPS traffic interception with attacker-controlled certificates, and automated Google account takeover. Targeted overrides rewrite content for Binance, Bybit, and Ledger users. Later samples added AES-256-CBC encryption with externally supplied keys and expanded targeting to macOS.
58
30
45
New N0va Phishkit Targets North America and EU: A Growing Identity Risk for SOCs
ANY.RUN researchers uncovered the N0va phishkit targeting government, technology, consulting, and healthcare organizations across North America and the EU via device code phishing.
The N0va phishkit uses lures imitating Microsoft Teams, SharePoint, OneDrive, DocuSign, Google Drive, Dropbox, Zoom, and Adobe Sign to draw victims into a device code authentication flow. After the user completes legitimate authentication, N0va captures access and refresh tokens and abuses token-exchange and device-registration mechanisms to establish persistent SSO access to corporate resources. Because the flow relies on real Microsoft authentication, it can evade MFA-focused detections, and token access can outlive takedown of the phishing page. ANY.RUN says it observed the campaign in sandbox sessions, with targeting spanning government, technology, consulting, and healthcare sectors.
56
30
30
30
30
30
30
30
BambooToken Malware Uses MQTT to Control Windows and Linux Systems
Lumen uncovers BambooToken, a stealthy multi-platform malware using MQTT C2 and Tendyron DLL sideloading to compromise Asian and South American organizations.
Lumen Black Lotus Labs disclosed BambooToken, a previously undocumented malware family active since at least February 2023 that controls Windows and (since December 2025) Linux hosts via the MQTT protocol for C2. The malware sideloads a rogue OnKeyToken_KEB.dll via Tendyron's OnKey PKI token software, gathers host details, and uses a WMI-based plugin to enumerate installed antivirus products and exfiltrate them to C2 domains proxied through Cloudflare. A dozen compromised entities were detected across Asia and South America, and DLL sideloading plus SoftEther VPN usage suggests a China nexus.
48
30
35
30