TL;DR
Mirage2FA phishing campaign has compromised 4,500 US and EU companies through Microsoft 365 login spoofing. NVIDIA NemoClaw faces model poisoning risk via malicious webpages. Oracle Weblogic vulnerability added to CISA's exploited list; patch urgently needed.
Executive Summary
- Mirage2FA phishing toolkit has targeted 4,500 organizations since 2024, abusing Microsoft 365 login flows to bypass multi-factor authentication.
- NVIDIA NemoClaw local AI model servers are vulnerable to unauthenticated poisoning attacks via malicious webpages, allowing command injection through the Ollama API.
- Oracle HTTP Server and Weblogic Server Proxy Plug-in improper access control flaw (CVE-2026-21962) added to CISA Known Exploited Vulnerabilities catalog with emergency patch deadline.
- WordPress sites targeted via authentication bypass vulnerabilities in the MiniOrange SAML 2.0 SSO plugin (CVE-2026-61979, CVE-2026-15981).
- Norway's government digital services disrupted by large-scale DDoS attack; AnonyMousKIT PhaaS platform uses voice AI to harvest Apple device passcodes.
Top Threats Today
1. Mirage2FA Campaign Affects 4,500 Organizations via Microsoft 365 Compromise
Severity: HIGH Affected: Finance, Technology
The Mirage2FA phishing-as-a-service toolkit has compromised approximately 4,500 US and EU companies between 2024 and 2026 ⚠[1]. According to ANY.RUN research, the campaign abuses legitimate Microsoft 365 login flows to bypass two-factor authentication, with 48% of targeted email addresses ⚠ belonging to US and EU organizations [1]. The toolkit appears designed to harvest credentials at scale without triggering typical phishing detection systems.
Sources:[1] The Hacker News
Recommended Action
- Review Microsoft 365 sign-in logs for unusual authentication patterns and conditional access violations
- Enable passwordless sign-in (Windows Hello, FIDO2) for privileged accounts to reduce reliance on passwords and MFA codes
- Conduct phishing awareness training emphasizing visual verification of login endpoints
- Implement threat intelligence feeds for Mirage2FA indicators of compromise
2. NVIDIA NemoClaw Model Poisoning via Unauthenticated Ollama Access
Severity: HIGH Affected: Technology
Oasis Security has disclosed a weakness in NVIDIA NemoClaw that allows an attacker-controlled webpage to gain unauthenticated access to the local Ollama instance ⚠ serving an AI agent and plant hidden instructions inside the model [1]. This vulnerability enables persistent model corruption through Model Context Protocol (MCP) command injection [2]. Attackers can exploit the networking issue to compromise any NemoClaw deployment without authentication.
Sources:[1] The Hacker News[2] Dark Reading
Recommended Action
- Isolate local Ollama instances from untrusted network access; restrict to localhost or authenticated API clients only
- Monitor Ollama API logs for unexpected MCP command execution or model modifications
- Apply NVIDIA security patches for NemoClaw when available
- Review AI agent workflows for signs of injected or malicious instructions
3. Oracle Weblogic Server Improper Access Control (CVE-2026-21962) Added to CISA KEV
Severity: HIGH Affected: Technology, Finance
CISA added CVE-2026-21962 to its Known Exploited Vulnerabilities catalog on August 24, 2026, indicating active exploitation [1]. The improper access control vulnerability in Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in allows unauthorized creation, deletion, or modification of critical data, as well as complete access to all Oracle HTTP Server and Weblogic Server Proxy Plug-in accessible data [1]. Federal remediation deadline is August 27, 2026 [1].
Sources:[1] CISA KEV
Recommended Action
- Prioritize patching Oracle Weblogic Server and HTTP Server instances immediately; verify patch deployment by August 27
- Monitor access logs for unauthorized data access or modification attempts
- Restrict network access to Oracle Weblogic and HTTP Server ports to trusted systems only
- Verify that proxy plug-in authentication and authorization controls are enforced
4. WordPress MiniOrange Plugin Authentication Bypass (CVE-2026-61979, CVE-2026-15981)
Severity: HIGH Affected: Technology
CVE-2026-61979 and CVE-2026-15981 are authentication bypass vulnerabilities affecting the MiniOrange SAML 2.0 SSO plugin for WordPress [1]. WordPress sites using this plugin are being actively targeted by threat actors to bypass login authentication. The vulnerabilities allow attackers to gain unauthorized access to sites and their underlying data.
Sources:[1] SecurityWeek
Recommended Action
- Update the MiniOrange SAML 2.0 SSO plugin to the latest patched version immediately
- Review WordPress user access logs and audit trail for suspicious login activity or unauthorized administrative changes
- Reset credentials for all WordPress administrative and service accounts
- Consider temporarily disabling the plugin until verified patched version is confirmed stable in your environment
5. Norway Government DDoS Attack and AnonyMousKIT Voice AI Phishing Platform
Severity: HIGH Affected: Government
A large distributed denial-of-service attack has disrupted Norway's shared government digital infrastructure since Monday, with services gradually coming back online ⚠ [1]. Separately, a newly uncovered phishing-as-a-service platform called AnonyMousKIT automates the retrieval of passcodes used to unlock stolen Apple devices and disable Activation Lock, representing an escalation in mobile device compromise tactics [2].
Sources:[1] BleepingComputer[2] BleepingComputer
Recommended Action
- If government or critical services: coordinate with DDoS mitigation providers and increase traffic filtering thresholds; segregate critical systems from public-facing infrastructure
- For Apple device users: enable stronger Activation Lock recovery options and monitor for unauthorized account access attempts
- Monitor for AnonyMousKIT phishing calls targeting employees; establish voice call verification protocols for sensitive requests
- Implement device-level theft prevention and remote wipe capabilities across organizational mobile devices
Additional Developments
Phishing and AI Manipulation: Dark Reading reports that attackers can use hidden HTML prompts to manipulate AI-powered email summarizers into producing false or malicious summaries [16]. This represents a new vector for social engineering through compromised email automation.
Cybercrime Network Disrupted: Interpol uncovered a crime-as-a-service operation in Argentina run by 196 people providing domains and money laundering support to West African organized crime groups [21]. Fifty-eight individuals were arrested in the international crackdown.
Healthcare Data Breach: Hospital operator Nutex Health is investigating unauthorized exfiltration of data from company servers [10]. Paylogix, an employee benefits platform, disclosed that hackers stole financial and health information on tens of thousands of people [22].
Ongoing Monitoring: Earlier coverage of Zimbra exploitation (CVE-2026-73570) and Microsoft active exploits remains relevant; organizations with extended patch windows should prioritize remediation.
Today's Action Checklist
- ☐ URGENT: Patch Oracle Weblogic Server and HTTP Server (CVE-2026-21962) by August 27 deadline; verify patch deployment in test environments first
- ☐ URGENT: Update MiniOrange SAML 2.0 SSO plugin on all WordPress sites; audit recent user activity for unauthorized access
- ☐ HIGH: Review Microsoft 365 sign-in logs for Mirage2FA phishing indicators; enforce passwordless authentication for sensitive accounts
- ☐ HIGH: Isolate local NVIDIA Ollama instances and restrict API access to authenticated, trusted clients only
- ☐ MEDIUM: Deploy voice-call verification protocols for employee identity verification; educate staff on AnonyMousKIT social engineering tactics