![Cybersecurity News | Daily Recap [16 Sep 2026]](https://www.hendryadrian.com/tweet/image/DailyRecap.png "Cybersecurity News | Daily Recap [16 Sep 2026]")
Daily Recap, Iranian and other threat actors continued surveillance and credential-theft efforts using Chosen Brick, fake MRI lure tools, Telegram-controlled spyware, and BambooToken (MQTT) targeting Windows and Linux, while KREMLIN banking malware hijacked Chrome/Edge. On the defensive side, agencies and vendors highlighted actively exploited WordPress RCE paths, a Cisco email-gateway zero-day, and new discovery of Linux kernel flaws alongside CenterPoint Energy confirming customer data theft. #ChosenBrick #FakeMRI #TelegramSpyware #BambooToken #MQTT #KREMLIN #Chrome #Edge #WordPress #AdminMenuEditorPro #Acronis #cPanel #Cisco #SecureEmailGateway #LinuxKernel #Copilot #Outlook #CenterPointEnergy
Malware & Spyware
- Iranian and other threat actors deployed multiple malware campaigns, including Chosen Brick, fake MRI-lure espionage tools, Telegram-controlled spyware, and BambooToken malware using MQTT to control Windows and Linux systems. – Chosen Brick, Fake MRI, Telegram Spyware, BambooToken, BambooToken
- KREMLIN banking malware hijacks Chrome and Edge to steal credentials and session tokens, while Revolut attackers used infostealers for an elaborate social-engineering scheme. – KREMLIN, Revolut Hack
Vulnerabilities & Exploitation
- 200,000+ WordPress sites may be exposed to unauthenticated RCE flaws, as a malicious Admin Menu Editor Pro plugin backdoors 1,500 sites and Acronis warns of an actively exploited cPanel backup plugin bug. – WordPress RCE, Plugin Backdoor, Acronis Flaw
- Cisco disclosed an actively exploited zero-day in email gateways, while a $1 million sandbox challenge uncovered new Linux kernel flaws. – Cisco Zero-Day, Linux Flaws
Nation-State & Geopolitics
- US, UK, and Dutch agencies exposed Iranian surveillance malware, as Norway investigates Telenor‘s work with the Myanmar junta and Ukraine appoints a new cyber-coordination chief. – Iran Malware, Telenor Probe, Ukraine Cyber Lead
Enterprise Security & Identity
- Microsoft is still fixing missing Copilot buttons in classic Outlook, while also committing to stricter AI privacy rules for students. – Outlook Copilot, AI Privacy
- Postman introduced Passport for credential-free API access, F5 highlighted real-time risk scoring for bot defense, and UltraViolet Cyber and DeepZero focused on detection coverage and vulnerable Windows drivers. – Postman Passport, F5 Bot Defense, Detection Coverage, DeepZero
- Windows Server 2022 reaches end of mainstream support next month, marking a key lifecycle deadline for administrators. – Server 2022
Cloud, AI & Security Operations
- Security leaders warned that missing AI agent governance and weak Google Workspace controls can amplify modern attack chains at scale. – AI Governance, Workspace Security
- CISA is reassessing its CDM program as federal cybersecurity tool distribution evolves, amid broader pressure to prove controls are working rather than assumed effective. – CISA CDM, Control Validation
Incidents & Data Theft
- CenterPoint Energy confirmed customer data was stolen in a cyberattack, adding to the day’s list of confirmed breach disclosures. – CenterPoint Breach