The Perimeter Held. Everything Inside It Did Not.

Picus Labs ran 338 million real attack simulations across enterprise environments in 2026. The results published in the Blue Report this week confirm something the security industry has been circling around without stating plainly: the perimeter is working reasonably well, and the interior is not.

69% of attacks get stopped at the edge. Security teams built those controls over years and the investment shows. But an attacker who makes it past the perimeter, through phished credentials, a supply chain compromise, a zero-day, a malicious insider, encounters defenses that stop them only 37% of the time. That gap is where every story in this edition lives.

The 37% interior stop rate is the number that contextualizes everything else this week. SAP Commerce Cloud at CVSS 10.0. Lazarus burning a Windows zero-day. North Korean workers already credentialed inside organizations they plan to extort. Chrome DevTools turned into a live session hijacker. Every one of those threats operates inside the perimeter, in environments where the 63% failure rate applies.

The exterior is defended. The interior is where attackers live.

CVE-2026-58231 in SAP Commerce Cloud earned a perfect 10.0 on the CVSS scale and drew active exploitation attempts within days of the patch being released. SAP Commerce Cloud is enterprise e-commerce and customer experience infrastructure used by large organizations to run digital storefronts, order management, and customer data pipelines. A CVSS 10.0 in that environment means unauthenticated access, remote code execution, and the kind of data exposure that combines financial transaction records with customer identity data at scale.

The days-after-patch exploitation timeline is the detail that demands attention. Organizations that treat enterprise platform patches as scheduled maintenance events rather than emergency response items are operating on a cycle that attackers have already outpaced. The 30-day-to-30-minute exploitation compression documented in previous editions of this publication is now a confirmed operational reality, not a projected trend.

Any organization running SAP Commerce Cloud that has not applied the patch for CVE-2026-58231 should treat the instance as potentially compromised and prioritize remediation over every other item on the security queue this week.

The North Korean state-sponsored Lazarus Group exploited a zero-day vulnerability in a core Windows kernel driver handling network socket operations to achieve SYSTEM-level access and deploy a previously undocumented backdoor against defense sector targets. Microsoft patched the flaw in the August 12 Patch Tuesday release as part of a 398-vulnerability update that contained the single actively exploited zero-day.

SYSTEM access through a kernel driver vulnerability is not a privilege escalation. It is a full takeover. The attacker operates as the most privileged process on the machine, able to disable security software, install rootkits, harvest credentials from memory, and move laterally with the authentication material the compromised machine holds. Lazarus deploying a never-before-seen backdoor means defenders have no existing signatures, no behavioral baselines, and no prior attribution data to work from when hunting for it.

Defense sector targeting is consistent with Lazarus Group’s documented objectives, which span both intelligence collection supporting DPRK state interests and revenue generation through cryptocurrency theft and ransomware operations. The combination of a zero-day kernel driver exploit and a novel backdoor payload indicates significant operational investment in this specific campaign, reserved for high-value targets that justified the cost of burning a zero-day.

Microsoft’s 398-flaw patch release this week is one of the largest single-month update packages in recent memory. The zero-day is the top priority. The other 397 are not trivial.

Researchers disclosed a flaw this week affecting the way OpenAI, Anthropic, and Google transmitted hidden AI reasoning data between API calls. The flaw allowed a weaker AI model to decode the internal reasoning of a stronger model from session logs, recovering sensitive information including API keys and passwords that the stronger model had processed during its reasoning chain.

Three major AI providers. Same class of vulnerability. Simultaneously.

The specific mechanism involves how extended thinking or chain-of-thought reasoning is carried across API call boundaries in multi-step agentic workflows. When a powerful model reasons through a task involving sensitive credentials or confidential data, that reasoning can be captured in session logs in a form that a less capable model, or a researcher with the right access, can decode and read. The model was not supposed to expose that reasoning externally. The API boundary was supposed to contain it. It did not.

For enterprise organizations using AI APIs in agentic workflows where sensitive credentials are part of the context, this disclosure requires immediate review of what data is being passed into AI reasoning contexts and what logging is enabled on those API calls. Credentials passed to AI models for task execution should not persist in recoverable session logs. If they do, they are exposed to anyone with access to those logs and potentially to the class of cross-model reasoning extraction described in this research.

API keys. Session logs. Reasoning chains.

This is the fourth SharePoint vulnerability under active exploitation covered in this publication across the past six weeks. CVE-2026-55040 carries a CVSS score of 9.1 and involves an authentication bypass that threat actors began exploiting immediately after proof-of-concept code appeared publicly. The exploitation timeline from PoC publication to confirmed in-the-wild attacks was measured in hours, not days.

The pattern here is no longer a pattern. It is a campaign. SharePoint Server is under sustained, multi-vector attack pressure from threat actors who have identified it as a reliable entry point into enterprise Microsoft environments. Four actively exploited critical vulnerabilities in six weeks is not normal vulnerability disclosure cadence. It is targeted. Organizations still treating SharePoint patching as a scheduled maintenance item need to reclassify it as an emergency response function, because the threat actors attacking it already have.

The standard threat model assumes attackers are outside trying to break in. North Korean IT workers inverted that model entirely. They apply for jobs. They pass interviews. They receive legitimate credentials, badge access, and onboarding documentation. By the time they are inside, they look identical to any other remote employee.

The campaign has expanded beyond technology companies to target government entities and regulated industries. The workers are skilled, their resumes are fabricated but plausible, their references are coordinated, and their interview performance is supported by networks that have been running this operation long enough to refine it. Once hired, they use their legitimate access for espionage, intellectual property theft, and in documented cases, extortion when they are eventually identified and terminated.

Detection requires identity verification practices that go beyond resume review: video interviews that cannot be conducted through AI face-replacement filters, verification of claimed credentials through official channels rather than documents the candidate supplies, and behavioral monitoring after hire for unusual data access patterns that do not match the role’s legitimate requirements. The HR problem is a security problem. They are the same problem.

Researchers detailed a post-exploitation technique this week that activates the Chrome DevTools Protocol inside a running Chrome or Microsoft Edge process on Windows, giving an operator full access to the authenticated sessions active in that browser at the moment of access. No credentials required. No MFA to bypass. The sessions are already authenticated. The attacker just connects to the protocol and uses them.

Every tab. Every logged-in session. Every cookie. Live.

CDP is a debugging interface built into Chromium-based browsers for legitimate developer use. It is powerful by design because it needs to be for its intended purpose. The technique exploits the fact that CDP can be activated and connected to remotely in a running browser process, in a post-exploitation context where the attacker already has code execution on the machine, turning the debugging interface into a session harvesting tool. The sessions being hijacked are the victim’s live authenticated sessions to their banking, email, corporate applications, and anything else open in the browser at the time.

The post-exploitation framing matters. This is not an initial access technique. It requires a foothold already established on the machine. What it does with that foothold is bypass every authentication layer protecting the victim’s active web sessions, which is the thing that makes it operationally significant even for defenders who already know that a compromised machine is a compromised machine.

The threat actor known as Mustang Panda, also tracked as HoneyMyte, deployed an updated version of its CoolClient backdoor this week that incorporates a signed Windows kernel-mode rootkit capable of hiding and protecting malicious processes from visibility at the operating system level. The rootkit carries a valid digital signature, meaning it passes Windows driver signature enforcement checks without triggering the unsigned driver warnings that typically alert security monitoring.

A signed kernel rootkit is not a minor capability upgrade. Kernel-mode code runs with the highest privileges on the system, below the operating system layer where most endpoint security tools operate. Malicious processes hidden by a kernel rootkit are invisible to standard process enumeration, file system queries, and the hooks that endpoint detection and response tools rely on to monitor system activity. The valid signature removes the primary detection signal that monitoring tools use to flag malicious driver loading.

Mustang Panda’s investment in this capability level is consistent with long-dwell espionage objectives. You build a signed kernel rootkit when you need to stay on a network for months without being found. The CoolClient upgrade represents a threat actor that has assessed the detection environment it operates in and responded by moving below it.

Two separate Apple security events converged this week in ways that illustrate the breadth of the threat environment Apple users face regardless of the platform’s security reputation. Apple sent mercenary spyware targeting notifications to customers across 110 countries, an unspecified number of recipients who the company assessed may have been targeted by sophisticated commercial surveillance attacks. Separately, the Netherlands NCSC warned that a recently patched macOS screen sharing vulnerability is being actively exploited in the wild to deploy Monero cryptocurrency mining software on internet-exposed Macs.

The two events are not related but they share a common implication. The macOS security advantages that have historically kept the platform’s malware exposure lower than Windows are not absolute protections against sophisticated or opportunistic threat actors. Unpatched macOS systems exposed to the internet are being actively scanned and compromised. High-value individuals on macOS are being targeted with mercenary spyware that the platform’s standard security model was not designed to stop.

Internet-exposed Macs with unpatched screen sharing vulnerabilities should be patched immediately. The cryptocurrency miner payload is the low-value exploitation of a vulnerability whose access value is higher. Attackers who discover a reliable exploitation path rarely limit themselves to one payload.

The China-linked threat actor known as Jewelbug has been observed conducting government and military espionage operations while simultaneously running cryptocurrency fraud campaigns, using the same infrastructure and tooling for both objectives. The dual mission is documented and confirmed. It represents an operational model where state-aligned threat actors pursue national intelligence objectives and financial self-enrichment as parallel activities rather than distinct programs.

The convergence of espionage and financial crime in a single threat actor’s operational portfolio is not new, but Jewelbug’s documented simultaneous deployment of both missions makes the attribution and response calculus significantly more complex. The espionage activity would normally suggest state sponsorship and the associated diplomatic constraints on offensive response. The cryptocurrency fraud activity suggests financial motivations that overlap with criminal threat actor behavior. Jewelbug operates across both simultaneously, using the same access for both purposes.

A previously undocumented Android malware family called WindRelay was disclosed this week, deployed alongside the SpyNote remote access trojan as part of a contactless payment fraud operation. WindRelay’s function is specific: it turns a victim’s Android device into an NFC relay node, forwarding near-field communication signals from the victim’s phone to attacker-controlled devices that use those signals to make fraudulent contactless payments.

NFC. Relay. Payment fraud.

The victim’s phone becomes the point-of-sale terminal for the attacker’s purchases. The NFC signals from the victim’s payment cards or digital wallets are relayed in real time to wherever the attacker has a receiving device, allowing purchases to be made without the victim’s card or phone being physically present at the transaction location. SpyNote’s presence alongside WindRelay provides the attacker with the remote access needed to keep the relay active without the victim’s knowledge or interaction.

CTM360 uncovered a global recruitment-themed phishing campaign running across more than 3,000 URLs that uses Browser-in-the-Browser techniques to steal Google and Facebook credentials from job seekers. The BitB technique renders a fake browser window inside the real browser window, creating a visually convincing OAuth login prompt that looks identical to a legitimate Google or Facebook authentication dialog but operates entirely within the attacker’s controlled page.

Job seekers are the specific target population because the recruitment context is one where people expect to be redirected to sign in with existing accounts as part of scheduling an interview or accessing a job platform. The social engineering hook is plausible because the flow matches what legitimate recruitment platforms do. The fake interview scheduling page presents a convincing reason to authenticate. The BitB window renders a convincing authentication dialog. The credentials go to the attacker.

3,000 active URLs means this is not a targeted operation. It is scaled credential harvesting running at volume against a broadly distributed population of job seekers across every industry and geography. The harvested Google and Facebook credentials provide access to personal and professional accounts, connected applications, and potentially organizational systems accessed through those identity providers.

A security researcher published a proof-of-concept this week for a vulnerability called ShieldBreak that claims to bypass the patch Microsoft applied to a previous Microsoft Defender vulnerability and still achieve SYSTEM-level access. The implications, if confirmed at scale, involve the security tool that most Windows environments rely on as their primary endpoint protection layer being bypassed by a technique that survived the vendor’s remediation attempt.

A Defender bypass that achieves SYSTEM access is not simply a vulnerability in a security product. It is the removal of the protection layer from the machines that need it most, executed by an attacker who has already found a way in and now needs to disable the detection capability before proceeding. The researcher’s disclosure puts this technique in public view before Microsoft has issued a response, which compresses the window for any organization whose Defender deployment is affected.

The patch did not hold. The technique survived. That is the claim.

Infoblox documented a large-scale threat actor operation involving the acquisition of expired domains specifically to inherit the existing traffic and search reputation those domains carry. The operation, which Infoblox designates as dropcatch domain abuse, has involved spending approaching $7 million on acquiring expired domains across a coordinated campaign. The acquired domains redirect inherited traffic to scams and malware distribution pages.

The operational logic is that an expired domain with years of legitimate traffic, backlinks, and search engine trust is more valuable as an attack delivery mechanism than a freshly registered domain with no history. Perimeter controls that rely on domain reputation and age to filter malicious traffic will treat the inherited reputation of the acquired domain as a trust signal. The traffic arriving at the redirect destination appears to come from a trusted, established source. That trust is the commodity being purchased for $7 million.

Two platform-level security developments closed out the week. The Kimwolf v7 Android and IoT botnet, an evolution of the AISURU framework, added HTTP/2 DDoS capabilities that make attack traffic indistinguishable from legitimate browser traffic at the network inspection layer. The botnet’s operators have specifically engineered the traffic generation to defeat HTTP/2-aware DDoS mitigation systems by mimicking the request patterns of real browser sessions, making volumetric attacks significantly harder to filter without also blocking legitimate users.

Separately, researchers disclosed that Zoom’s annotation feature, the tool that allows meeting participants to draw and comment on shared screens, contained vulnerabilities that allowed anyone sharing their screen to execute code on every watcher’s machine, and allowed any watcher to execute code on the presenter’s machine. The attack surface was every Zoom call with screen sharing and annotations enabled, which describes a significant portion of enterprise video conferencing activity. Zoom has patched the vulnerabilities.

The Zoom finding is particularly notable because the attack surface it exposed was a collaboration feature that organizations explicitly enable and encourage use of. The annotation tool is not a fringe capability. It is a standard meeting feature. Vulnerabilities that live inside actively used collaboration features reach the population that uses them in normal business activity, not users who were doing something unusual.

A White House memo signed this week instructs the National Coordination Center to develop a program allowing private sector companies to take offensive action against foreign criminal groups, leveraging private sector capability in ways that U.S. offensive operations previously could not. The policy implications are substantial and the operational boundaries are still being defined, but the direction is toward authorizing private cyber offensive activity against foreign criminal infrastructure in ways that were previously either illegal or legally ambiguous for private actors.

On the infrastructure side, researchers identified 737 Chrome browser extensions marketed as free VPN and proxy tools that were actually routing user traffic through attacker-controlled proxy infrastructure while primarily targeting Russian-speaking users seeking access to geo-blocked services. The extensions intercept browser traffic, which includes authenticated sessions, credentials entered into websites, and browsing history, and route it through infrastructure the extension operators control. Free VPN extensions in browser stores have been a recurring security problem, but 737 simultaneous malicious extensions in a single discovery represents the scale at which this category of attack is now operating.

737 extensions. One browser. Your traffic going somewhere you did not choose.