September’s Cybersecurity Highlights cover a Microsoft 365 phishing campaign affecting New Zealand users, a North Korean operative who secured work at a local business, and key findings from the NCSC’s 2026 Cyber Threat Report.
We also examine how attackers are exploiting vulnerabilities within hours of disclosure, the use of fake developer interviews and ClickFix scams to distribute malware, and the latest security updates from Microsoft.
Happenings
[NZ / Global] BigBear 2.0 Phishing Campaign Bypasses Common MFA Protections
Research published in September by CloudSEK identified New Zealand among the leading affected countries in BigBear 2.0, a phishing operation targeting Microsoft 365 users across more than 40 countries. BigBear operates as a live intermediary between the victim and Microsoft, and passes the user’s login details and MFA responses to Microsoft, generating an attacker controlled authenticated session after successful sign-in. The services provides familiar login screen and a genuine authentication prompt to manipulate the login experience to steer users away from passkeys and security keys towards weaker methods where available. Connections can be routed through the victim’s country to further disguise unauthorised access, and defeat Conditional Access policies.
Gambit Security recovered chat sessions from infrastructure associated with the Russian-speaking Aur0ra ransomware group and Reuters subsequently reviewed portions of the data, confirming in reports that Cursor’s AI coding agent had been used during intrusions affecting at least seven companies. The agent was provided with existing access or credentials and used to help navigate victim environments, identify opportunities for further compromise, and determine what actions to take as the intrusion progressed. When the agent refused some malicious requests, the operators restarted conversations and presented the activity as an authorised security test to bypass the controls. Gambit Security’s Director of Threat Intelligence, Eyal Sela, estimated that use of the AI agent made the attackers 30–50 percent faster during operations.
Rather than fully replacing attackers, AI can increasingly take on much of the research, perform troubleshooting, and undertake decision-making that would otherwise require manual effort as an intrusion develops. This pipeline can make it easier for attackers to recognise useful opportunities within an environment and move between systems without needing the same level of specialist knowledge or time that would previously have been required. We are entering a phase of cybersecurity operations where organisations will increasingly need to use AI to identify vulnerabilities and attack paths before attackers do. As offensive use of AI becomes more capable defenders will need to match that speed by using the same technology to continuously test their environments to identify weaknesses and reduce the opportunities available to attackers.
[NZ / Global] BigB[NZ] Business Hires North Korean Operative Posing as Contractor
A New Zealand business reportedly hired a North Korean operative who posed as a remote IT contractor using false identity information and technology designed to obscure their true location. The operative relied on a New Zealand-based intermediary and a locally operated company-issued laptop to appear as though they were working from within the country. After the organisation had investigated and terminated the worker, the individual claimed to possess commercially sensitive information and threatened to release it unless a ransom payment was made.
The incident forms part of a wider campaign identified by international intelligence agencies, including New Zealand’s National Cyber Security Centre (NCSC). North Korea has deployed thousands of skilled IT workers globally to obtain legitimate employment, generate revenue for the countries regime while evading international sanctions. These workers attempt to gain access to sensitive organisational information to perform data theft, extortion, and ransomware activity.
Organisations that unknowingly engage DPRK-linked workers may face sanctions-compliance and legal risks, loss of sensitive or proprietary information, and potential extortion or ransomware incidents. For organisations that regularly hire remote contractors in areas such as software development, web design, graphic design, and IT services, steps should be taken to verify the identity and physical location of workers. This can include independently validating employment history and credentials, maintaining control over company-issued devices, monitoring unusual VPN or remote-access activity, and applying least-privilege access to sensitive systems and information. New Zealand’s Protective Security Requirements (PSR), Personnel Security and Due Diligence Assessment guidance is designed primarily for government agencies, but many of its principles can also assist private-sector organisations when strengthening pre-employment and contractor due-diligence processes.
[Global] Vulnerabilities Exploited Within Hours of Disclosure
GitLab released an urgent security update for CVE-2026-85706, a critical vulnerability affecting self-managed installations and by the following day, security researchers at WatchTowr were already observing attempts to probe the vulnerability. The flaw could allow attackers to access sensitive files on a GitLab server without needing to log in, potentially exposing credentials and other information that could be used in further attacks. CISA added it to its Known Exploited Vulnerabilities catalogue shortly after, confirming that exploitation was known to be occurring in the wild.
An investigation published by GreyNoise provided another example of AI being used to accelerate exploit development, when an attacker used AI agents to analyse recently patched vulnerabilities in the PaperCut print management software, developed working exploits, and tested them against vulnerable systems. Within four hours of beginning the work, the attacker had successfully compromised a real server and over the following days, the campaign was identified to have compromised at least 440 PaperCut installations across 395 organisations in 48 countries. Security updates themselves provide attackers with valuable clues as they can be used to compare the previous version with the new version to identify what has changed and use that information to develop exploits targeting systems that have not yet been updated.
Research by Google’s Threat Intelligence Group points to the growing exploitation of previously disclosed vulnerabilities, with researchers suggesting that AI are accelerating this process by automating the analysis of software patches, vulnerability disclosures, and publicly available exploit code. The challenge is no longer simply keeping software updated, but responding before newly disclosed vulnerabilities can be turned against them. Internet-facing systems are particularly exposed, and routine patching schedules may leave them vulnerable while attacks are already underway. Organisations need to be prepared to deploy urgent updates outside normal maintenance windows and investigate potential compromise where exploitation has already been observed.
[NZ] NCSC Cyber Threat Report for 2026 Outlines AI Preparation Necessity
The National Cyber Security Centre (NCSC) has released its 2026 Cyber Threat Report, highlighting a significant change in New Zealand’s cyber threat environment. In the 12 months to June 2026, the NCSC responded to 369 incidents considered to have potential national significance. Four of these were classified as C2, or “Highly Significant”, matching the total number of incidents at that severity recorded across the previous decade.
The report identifies five major areas of concern for leaders and decision makers: the growing influence of artificial intelligence on cyber threats, persistent state-sponsored activity targeting New Zealand organisations, increasingly severe cybercrime and extortion, ongoing risks within digital supply chains, and the continued effectiveness of social engineering. Artificial intelligence receives particular attention, with the NCSC warning that it is already helping threat actors operate faster and at greater scale across areas such as reconnaissance, phishing and deepfake-enabled deception. As AI capabilities continue to develop, they are expected to make activities such as vulnerability discovery and attack automation more accessible and effective.
The report reinforces that cyber security is ultimately a leadership responsibility and that organisations need to prepare for disruption at both governance and operational levels. Businesses should consider whether they have the people, processes and resources required to respond quickly to incidents, whether cyber risk is receiving appropriate executive attention, and if incident response and business continuity arrangements are sufficiently mature. Organisations should assess how AI is changing their exposure to cyber threats, while considering the security implications of how AI technologies are being adopted internally.
Techniques and Updates
Fake Developer Interviews Used to Deliver Malware
WaterPlum, commonly tracked as Contagious Interview, is a North Korean campaign that targets developers and IT professionals through fake recruitment activity. Attackers pose as recruiters or employers and convince victims to download and run coding challenges, npm packages, GitHub repositories, or VS Code projects as part of a technical interview. These projects contain malware such as BeaverTail, InvisibleFerret, OtterCookie, and StoatWaffle, which can steal browser credentials, cryptocurrency wallets, SSH keys, cloud credentials, API tokens, and other developer secrets before installing persistent remote-access tooling. The campaign is particularly effective because running unfamiliar code is a normal part of a technical interview, and compromised developer workstations may provide access to source repositories, CI/CD systems, cloud environments, and customer infrastructure. A joint Australian, Japanese, US, and German advisory published in September 2026 linked the operation to more than 30,000 compromised devices across over 100 countries. Organisations should treat interview code as untrusted executable content and require it to be run in isolated, disposable environments without access to corporate credentials, cloud profiles, SSH keys, or production systems.
ClickFix Social Engineering Scam
New Zealand’s National Cyber Security Centre (NCSC) warned of compromised websites using a technique named ClickFix to infect visitors with malware. Rather than exploiting a vulnerability, the technique uses social engineering to exploit the trust people place in routine website verification checks such a CAPCHA and Cloudflare verification prompts, persuading them to follow instructions that appear legitimate. ClickFix works by presenting website visitors with a fake verification button that, when clicked, triggers JavaScript on the page to quietly copy a malicious command to their clipboard. On-screen instructions then direct the victim to paste and run the command using a built-in system tool, such as the Windows Run box or macOS Terminal, where, instead of completing a security check, following the instructions can download and run malware, sometimes directly in memory where tools that only scan downloaded files may miss it.
A clear warning sign of the attack is a verification page asking a user to leave the browser and execute a command, which is something a genuine CAPTCHA verification will never require. Anyone encountering these instructions should close the page without proceeding, and if they have run a command, they should contact their Security or IT Team immediately and cannot assume that closing the browser has removed the threat. Exposure can be reduced by restricting access to command-line tools where staff or devices do not require them and application controls that restrict unauthorised code execution. Endpoint protection should be configured to detect suspicious scripting activity even if someone follows the prompt.
Microsoft Security / Updates
Microsoft announced the public preview of Integrated Security Operations Center (ISOC) in Microsoft Defender, further building on the convergence of Defender XDR and Microsoft Sentinel within the Defender portal. ISOC brings SIEM capabilities, threat intelligence, automation and AI-driven security operations together with Microsoft’s existing XDR capabilities. Eligible Microsoft 365 E5, E7 and Microsoft Defender Suite customers receive Defender data retention, which is planned to increase from 30 to 90 days from mid November 2026. Organisations with eligible licensing should consider exploring the capabilities available to them. The current ISOC preview is limited to customers without an active Microsoft Sentinel workspace, and Microsoft advises existing Sentinel customers not to disconnect production environments simply to access the preview.
Microsoft also made the Identity Security dashboard and Coverage & Maturity capabilities generally available within Defender XDR during September. The Identity Security dashboard provides a consolidated view of identity-related risks and security posture, while Coverage & Maturity helps organisations assess the extent to which identities are protected across on-premises, cloud, SaaS, identity-provider and supported partner environments. The dashboard can identify deployment and coverage gaps and prioritise actions to strengthen identity protections. Organisations with applicable licensing should review these capabilities to better understand their current identity-security coverage and highlights areas where existing Microsoft security investments may not yet be fully utilised.
Microsoft’s September security updates addressed two zero-day Windows privilege-escalation vulnerabilities that were already being actively exploited: CVE-2026-81963, affecting the Windows Update Stack, and CVE-2026-85880, affecting Windows Advanced Local Procedure Call (ALPC). Both vulnerabilities can allow an attacker who has local access to an affected system to elevate privileges to SYSTEM. While timely security patching remains important, organisations should continue to prioritise remediation according to factors such as known exploitation, exposure, asset criticality and the wider business risk associated with affected systems.