Cyber Security News

Hacking Editorial Brief — September 14, 2026

China-Aligned Actors Exploit Tencent Input Method Flaw to Deploy GrayRabbit Malware

A China-aligned espionage group is actively exploiting CVE-2026-51990, a critical vulnerability in Tencent's Sogou Input Method application, to deploy GrayRabbit malware on compromised systems. The campaign targets the widely deployed Chinese language input software, enabling attackers to establish persistent access on affected endpoints. Separately, APT31 has been observed deploying the previously undocumented BlueMoon exploit kit, which chains vulnerabilities in Microsoft Windows and Google Chrome to compromise targets. The toolkit represents a shift toward modular, multi-stage exploit chains by advanced persistent threat groups focused on espionage operations. A Russian-speaking threat actor has also been attributed to exploiting PaperCut NG/MF vulnerabilities using AI-assisted techniques to breach hundreds of instances of the print management software.

Malicious Twitch Extension Exfiltrates OAuth Tokens From 31,000 Users

A malicious browser extension distributed through Twitch, identified as JeetBot, successfully exfiltrated OAuth tokens from nearly 31,000 users by transmitting credentials to operator-controlled proxy infrastructure. The campaign targeted Twitch users seeking additional platform functionality, harvesting authentication tokens that could enable account takeover and unauthorized access to linked services. Firefox version 85.8.7 now blocks the malicious behavior, though the scope of compromised accounts and potential downstream impact remains under investigation. The incident highlights ongoing risks associated with third-party browser extensions in gaming and streaming ecosystems.

Microsoft September Patch Tuesday Addresses Record 974 Flaws Including Two Exploited Zero-Days

Microsoft's September 2026 Patch Tuesday addressed 974 vulnerabilities, a record-breaking figure that includes two actively exploited zero-day flaws: CVE-2026-81963 and CVE-2026-85880. The volume represents a substantial increase from the 966 vulnerabilities disclosed in initial reporting and underscores escalating complexity across Microsoft's product stack. Both zero-days were under active exploitation at the time of disclosure, though Microsoft has not publicly attributed the campaigns or detailed exploitation scope.

Sources: Bleeping Computer · The Hacker News · The Hacker News · The Hacker News · Bleeping Computer