The Daily Zero-Day

Executive Summary

Today's intelligence briefing for September 26, 2026, highlights a rapidly evolving threat landscape heavily influenced by autonomous AI payloads, sophisticated malware delivery vectors, and widespread data exposure events. Key incidents include the resurgence of compromised GitHub Actions executing the Mini Shai-Hulud malware, the discovery of the first reported autonomous AI C2 implant (CLOSEDQUORUM), and an escalation in macOS targeting via PamStealer's server-side payload decryption. Concurrently, organizations face infrastructure-wide vulnerabilities ranging from ServiceNow's AI platform flaws to a massive student loan breach exposing 2.5 million records, emphasizing the critical need for resilient access controls, advanced forensic readiness, and proactive multi-factor authentication enforcement.

Top Intelligence Briefings

Supply Chain Security

Compromised GitHub Actions Came Back Online and Resumed Executing Mini Shai-Hulud Malware

Two actions-cool GitHub Actions have been disabled for a second time after the repositories became accessible last week, months after they were initially compromised. This resurgence underscores the ongoing threat of persistent supply chain vectors executing malicious payloads like Mini Shai-Hulud.

Actionable Takeaway: Audit third-party GitHub Actions and pin action references to immutable commit hashes to prevent unexpected execution of re-enabled or hijacked repositories.

Advanced Malware & AI Threats

The Closed Quorum: Inside the First Reported Autonomous AI C2 Implant

Discovered through Cisco Talos’ CAIRN project, the CLOSEDQUORUM malware binary exhibits fully autonomous command and control (C2), marking a paradigm shift in how malware handles operational decision-making without human operator oversight. This aligns with broader concerns regarding AI sandbox escapes and autonomous agent risks.

Actionable Takeaway: Implement strict behavioral egress filtering and forensic readiness protocols to detect unusual autonomous outbound traffic patterns and isolate sandbox breaches immediately.

macOS Threats

PamStealer macOS Malware Adds Live C2 Payload Decryption and Multi-Layer Persistence

Cybersecurity researchers have flagged a new version of PamStealer that ensures its primary payload can only be recovered using live, server-side C2 decryption, complicating traditional static analysis and threat detection mechanisms on macOS endpoints.

Actionable Takeaway: Enhance endpoint monitoring on macOS assets to catch behavioral anomalies during runtime execution and block unauthorized outbound C2 staging requests.

Insider Threat & Cybercrime

U.S. Soldier Gets 70 Months in Prison for AT&T, Verizon Extortions

A U.S. Army soldier who pleaded guilty to hacking multiple major telecommunications companies and illicitly stealing mobile call and text metadata for thousands of individuals has been sentenced to 70 months in federal prison.

Actionable Takeaway: Enforce strict internal privilege management, continuous session monitoring, and robust anomaly detection to mitigate insider access risks across critical telecom infrastructure.

Quick Hits & Advisories

Data Broker Privacy: Consumer data broker Radaris.com has lost domains amid an ongoing privacy fight over opt-out requests, as detailed by Krebs on Security.
Marine Biology & Security: Bruce Schneier highlights a hands-on marine biology event in Tennessee with Friday Squid Blogging.
AI Misuse Analysis: Review Anthropic's latest insights regarding agentic risks via On Anthropic’s AI Misuse Report.
AI Sandbox Escapes: Dark Reading explores why access-control failures make Forensic Readiness Matter More Than Containment.
AI Escape Panel: Catch up on Google Gemini containment issues discussed in What We Missed: Google Gemini Joins the AI Escape Party.
Massive Data Breaches: A student loan breach exposes 2.5M records according to Threatpost.
Watering Hole Campaign: APT TA423 uses watering hole tactics to push the ScanBox reconnaissance tool, reported by Threatpost.
Mobile Security Vetting: Learn how to vet AI-generated software using 5 checks before downloading a vibe-coded app.
Crypto Scam Guidance: Protect yourself against common scripts outlined in Been told to pay at a Bitcoin ATM? Read this first.
Consultancy Elicitation: Talos examines social engineering trends in Trust and the enticing consultancy offer.
Profile Verification: LinkedIn introduces new checks to combat fake profiles, covered by Malwarebytes.
Stealthy Persistence: Kothamine malware leverages Tailscale's tailcat to bypass network detection, analyzed by Malwarebytes.
Have I Been Pwned: Check exposure records for the defunct B2B database via LimeLeads and Burger King Russia.
SANS Intelligence: Review the Macfinger ClickFix campaign analysis and podcast via SANS ISC Diary and Stormcast.
Cloud Security Updates: Explore compliance resources in ICYMI: August 2026 @AWS Security and support the ASD MFA Campaign.
Phishing Defense: Cofense expands its platform as detailed in Cofense Expands AI-Driven Phishing Defense and Beyond Human Risk.
Dark Web & Infostealers: ASEC shares insights on Metaencryptor ransomware and trends via Ransom & Dark Web Issues and the August 2026 Infostealer Trend Report.
Gaming Malware: Fake Roblox cheats deliver Java stealers, flagged by Bitdefender Labs alongside European Fake-Shop Campaigns.
Global Policy Submissions: Citizen Lab publishes updates on UN Reports and IRB Submissions.
Software Vulnerabilities: CERT Polska details CVE-2026-92419 in WEBCON BPS and analyzes Polish Toll Fraud Operations.
Framework Defenses: CIS updates resilience guidelines via CDM v3.0 and the September Benchmarks Update.
Vendor Advisories: CIS releases warnings for ServiceNow AI Platform Vulnerabilities and Google Chrome Code Execution Flaws.