Cyber Security Briefing Briefing — September 13, 2026

Attackers are using passkey phishing to take over Microsoft cloud accounts and pull data out of them. For defenders, this raises the priority on phishing-resistant authentication, identity monitoring, and controls that limit what a stolen session or account can access.

Threat Actors & Campaigns

Three South African organizations publicly signaled possible data breaches over the same weekend. For defenders, the immediate issue is exposure of customer or account data and the need to confirm scope, contain any intrusion, and communicate clearly while the facts are still being established.

Regulation & Enforcement

A fraudulent government email appears to have bypassed Revolut’s checks and exposed KYC data. The defender takeaway is that identity verification workflows and email trust controls can create direct exposure of regulated customer records when they are fooled by social engineering.

Regulation & Enforcement

Florida is investigating a data breach that is linked to a cybercriminal organization. For defenders, the immediate issue is exposure of state-held or state-related data and the possibility that the same group may have access to other targets or reused credentials.

Breaches & incidents

Revolut says customer data was exposed after attackers used fake government requests to obtain information. For defenders, the issue is not just a breach but a process-control failure around how sensitive data requests are verified and approved.

Breaches & incidents

Revolut says some customer data were exposed after an email-based scam, which points to a social-engineering exposure rather than a platform breach. Defenders should treat this as a reminder to harden email verification, customer support workflows, and account-recovery controls because attackers can turn small process gaps into data exposure.

Regulation & Enforcement

EasyEquities is warning customers about a possible data breach. For defenders, the main issue is exposure of customer data and the need to assess whether account access, identity data, or other personal records were affected.

Regulation & Enforcement

The headline points to a strike on a Russian refinery, which is a critical energy asset with direct implications for industrial safety, fuel supply, and broader infrastructure risk. For defenders, the issue is exposure of energy infrastructure to wartime attack and the need for hardening, monitoring, and incident response around OT and physical security.

Critical Infrastructure & OT

The headline points to a broad warning about cyber risk to U.S. infrastructure, but the excerpt does not identify a specific attack, vulnerability, or affected operator. For defenders, this signals a need to treat infrastructure exposure as a standing risk, but there is not enough concrete detail here to prioritize a particular control or response.

Critical Infrastructure & OT

The reported flaw in Plesk Backup Manager could let a low-privileged user escalate to root on affected servers. For defenders, this is an exposure and priority issue: check whether Plesk is in use, review privilege boundaries around backup functions, and patch or mitigate quickly because the impact is full server compromise.

Breaches & incidents

The story points to an internal U.S. policy split over how aggressively to address AI-related cyber risk while preserving AI competition. For defenders, that means near-term obligations may be unclear even as attention rises on AI misuse, model abuse, and related security controls across government and critical infrastructure.

Critical Infrastructure & OT

AI infrastructure can be used to accelerate attack activity, so defenders need to think about monitoring, access controls, and abuse detection inside the systems that host or orchestrate AI workloads. The operational risk is not just model misuse but faster reconnaissance, exploitation, and automated follow-on actions against the surrounding environment.

Vulnerabilities & Exploitation

The headline points to a reported breach involving Anthropic’s Claude environment, which matters most as an AI security and incident response issue. For defenders, the question is whether the exposure came from model misuse, account compromise, or a control gap around the service itself.

Regulation & Enforcement

The piece is about using information theory and machine learning to detect industrial cyberattacks. For defenders, that points to a detection and monitoring problem in OT environments, with likely relevance to anomaly detection and incident response rather than a new threat campaign.

Critical Infrastructure & OT

This describes an AI-driven honeypot used in a live deception test that reportedly misled experienced hackers. For defenders, the main takeaway is that active deception tools are becoming part of detection and response, and security teams may need to treat them as a valid layer for monitoring attacker behavior and slowing intrusions.

Regulation & Enforcement

South Korea has brought an expanded espionage law into force as part of a push to protect chip technology. For defenders, the main impact is a higher compliance and governance burden around sensitive engineering information, trade secrets, and insider access tied to semiconductor assets.

Threat Actors & Campaigns

Multiple vulnerabilities in VLC Media Player can let an attacker corrupt or read memory in the application's heap. For defenders, this is mainly an exposure and patching issue: systems that use VLC to open untrusted media should be updated quickly and users should avoid handling suspicious files until fixes are in place.

Vulnerabilities & Exploitation

Pakistan’s national CERT is flagging ongoing application security weaknesses across the country. For defenders, that points to a broad exposure problem in web and software stacks and raises the priority of patching, secure coding, and application-layer monitoring.

Vulnerabilities & Exploitation

The piece appears to frame a hospital-focused cybersecurity risk, which puts patient services, clinical systems, and sensitive health data in scope. For defenders, the main question is exposure inside healthcare environments and whether internal controls around access, connected devices, and segmentation are strong enough to limit harm.

Regulation & Enforcement

The report centers on a claim from an Iranian hacker group about a Dallas AT&T outage, with AT&T saying the disruption was caused by cable theft. For defenders, the main issue is attribution and operational ambiguity: outages can be framed as cyber activity even when the immediate cause may be physical sabotage or theft, which affects incident triage and public communication.

Threat Actors & Campaigns