Morning Brief
September 17, 2026 · 07:30
ThreatNoir Morning Brief — September 17
- •No highlights available yet.
- •Check back soon.
- •New briefings publish daily.
HIGH
ThreatNoir
Daily Brief
AI-filtered cyber intelligence for security practitioners.
Morning & Evening briefings. No noise. Just signal.
Supported by Your brand here
Latest Briefs
View all briefsEvening Brief
September 16, 2026 · 18:00
ThreatNoir Afternoon Brief — September 16
- •No highlights available yet.
- •Check back soon.
- •New briefings publish daily.
MEDIUM
Red vs Blue
Real attacks. Real defenses. One minute to become stronger.
ATTACK vs DEFEND
1:40
One Click to GrayRabbit Backdoor
Sogou Input Method's outdated Chromium engine allows one-click remote code execution through a crafted protocol handler link, enabling UNC3569 to deploy the GrayRabbit backdoor into trusted Tencent processes.
ATTACK vs DEFEND
1:20
Invisible Unicode Hides Phishing in Plain Sight
Attackers embedded invisible Unicode characters within finance keywords to bypass email filters, with one campaign reaching 2.37 million messages daily while evading traditional keyword detection.
ATTACK vs DEFEND
1:20
86 Gigs Stolen from Manchester Airports Group
Eighty-six gigabytes of passenger data including names, bookings, and travel plans were stolen from Manchester Airports Group through exposed Iterable API credentials left in public repositories.
Weekly Brief
The week in cyber, summarized.
Week of Sep 7 – Sep 13, 2026
- •AI is no longer just a defender's tool: state-sponsored groups and criminals weaponized Claude, ChatGPT, and OpenAI agents to automate exploitation, rebuild malware, and generate one million personalized phishing emails in three days.
- •GitLab's CVSS 10.0 path traversal flaw (CVE-2026-85706) was actively exploited within 24 hours of disclosure, joining Artifactory, PaperCut, Cisco FMC, Check Point VPN, and NetScaler on CISA's KEV catalog in a single week.
- •A social-engineering attack on a third-party contractor exposed 4.1 million AdaptHealth healthcare records, while IDScan confirmed 153 million driver's license scans were stolen from its cloud platform.
- •️ The BlueMoon exploit kit chains Chrome and Windows zero-days and is being rapidly adopted by Chinese espionage groups, suggesting near-term proliferation to financially motivated actors.