Afternoon Review in IT Security — September 13, 2026

The threat landscape continues to intensify as attackers exploit both social engineering tactics and critical infrastructure vulnerabilities. Today's review highlights coordinated campaigns targeting cloud environments, widespread probing of newly disclosed flaws, and active exploitation of supply chain software within hours of public disclosure.

Attackers Use Passkey Phishing to Hijack Microsoft Cloud Accounts and Exfiltrate Data

Microsoft has disclosed details of two campaigns in which threat actors are abusing third-party email delivery infrastructure to blast financial fraud scam messages and using passkey-themed social engineering to breach cloud environments. The first campaign involved sending over a million scam emails between August 3 and 5, 2026, by masquerading as chief executive officers. Source: Attackers Use Passkey Phishing to Hijack Microsoft Cloud Accounts and Exfiltrate Data

The attackers leveraged domains including domainlify[.]net and service-nowinc[.]com as part of their infrastructure. This campaign demonstrates the continued effectiveness of CEO impersonation combined with credential-harvesting techniques targeting organizations reliant on cloud services.

GitLab's Critical Flaw is Already Drawing Internet-Wide Probes

GitLab has disclosed critical vulnerabilities affecting self-managed installations, with one flaw allowing unauthenticated attackers to read files from the server. GitLab has urged operators to upgrade immediately as internet-wide scanning activity has already commenced. Source: GitLab's critical flaw is already drawing internet-wide probes

The vulnerabilities tracked as CVE-2026-85706 and CVE-2026-87719 represent a path traversal issue with severe implications for any organization operating self-managed GitLab instances without rapid patching.

Artifactory Flaws Chained in Attacks Deploying Backdoor Malware

Threat actors are actively exploiting critical and high-severity vulnerabilities in JFrog Artifactory to bypass authentication, gain administrative privileges, and deploy a Rust backdoor on vulnerable self-hosted servers. Source: Artifactory flaws chained in attacks deploying backdoor malware

The attacks chain together multiple vulnerabilities tracked as CVE-2026-42016, CVE-2026-42018, and CVE-2026-82329 to achieve rapid compromise and persistence. This supply chain attack vector poses significant risk to organizations using Artifactory for artifact management and deployment pipelines.

GitLab Vulnerability Exploited One Day After Disclosure

The critical-severity path traversal flaw in GitLab is being actively exploited in the wild within one day of public disclosure, allowing unauthenticated attackers to read arbitrary files from vulnerable GitLab servers. Source: GitLab Vulnerability Exploited One Day After Disclosure

The rapid exploitation timeline underscores the urgency of patching CVE-2026-85706 and CVE-2026-87719. Organizations operating self-managed GitLab instances should treat this as a critical priority requiring immediate action.

Organizations must prioritize patching efforts for both GitLab and Artifactory vulnerabilities while reinforcing user awareness training around passkey phishing and CEO impersonation tactics. The convergence of active exploitation, widespread scanning, and sophisticated social engineering campaigns represents an elevated threat posture requiring immediate defensive measures across infrastructure and personnel.