Threat Intelligence Daily · 2026-09-17

Cisco ISE CVE-2026-76460 is under active exploitation

Severity

Critical

Status

Confirmed active exploitation

CVSS

10.0

CVE

CVE-2026-76460

Affected

Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC)

Cisco says an unauthenticated remote attacker can send a crafted request to an affected API endpoint and bypass the web management interface’s authentication. The advisory was published September 16 and states that software updates are available; there is no workaround. Cisco PSIRT has confirmed exploitation in the wild.

Recommendation

Apply the fixed Cisco release for the deployed ISE branch. Until patching is complete, limit reachability of management interfaces to trusted administrative networks. Review authentication, API and administrative activity for access that cannot be tied to expected operators.

FamousSparrow deploys SparroWocky against Latin American governments

Severity

High

Status

Confirmed cyber-espionage campaign

Threat actor

FamousSparrow

Malware

SparroWocky

Affected

Government organizations in Latin America observed by ESET

ESET attributes the campaign and SparroWocky to FamousSparrow with high confidence. Since mid-2025, 90% of targets visible in ESET telemetry have been in Latin America. The modular C++ backdoor can execute files and commands, proxy TCP traffic, exfiltrate files, take screenshots and execute Beacon Object Files. Persistence uses either a Windows service or a Run-key entry. C2 connections use direct IP addresses, usually on port 443 and sometimes 8080.

Recommendations

• Hunt for the indicators in ESET’s published IOC set and review direct outbound connections to unfamiliar infrastructure on ports 443 and 8080.
• Investigate unexpected services and Run-key persistence together with file exfiltration or periodic screenshot behavior.
• Government organizations in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico and Venezuela should prioritize this campaign in endpoint hunting.

PhantomRaven information stealer distributed through npm

Severity

High

Status

Confirmed malicious-package campaign

Malware

PhantomRaven

Affected

Developers and organizations installing malicious npm packages

CrowdStrike identified a financially motivated actor distributing the JavaScript-based PhantomRaven information stealer through npm. The actor also worked as a bug-bounty hunter and, in one documented case, contacted a potential victim after a dependency-confusion compromise. CrowdStrike assesses with high confidence that an LLM was likely used to develop the malware, based on code characteristics and token analysis; that assessment is separate from the confirmed package distribution and malware behavior.

Recommendations

• Review newly introduced npm dependencies, especially packages added outside normal review or lockfile-change processes.
• Inspect developer endpoints and CI workers that executed untrusted packages. Rotate repository, cloud, CI and package-registry credentials if exposure is found.
• Treat package provenance and behavior as the security signal; LLM attribution does not change remediation priority.

T-Mobile reward-expiry SMS campaign rotates short-lived phishing domains

Severity

Medium

Status

Confirmed phishing campaign

Affected

T-Mobile customers and recipients of T-Mobile-themed SMS lures

Malwarebytes has monitored the campaign since early May. Its dataset contains more than 1,000 closely related message templates and at least 81 domains used over four months. The messages invent reward balances and imminent expiry dates, then direct recipients to rotating t-mobile.<domain>.top sites intended to collect credentials, personal information, payment data or verification codes.

Recommendations

Block known campaign domains and detect the t-mobile.*.top naming pattern where appropriate. Users should open the official T-Mobile app or website independently instead of following links in unsolicited reward messages.

Yorisou e Net app used a hard-coded cryptographic key

Severity

Low

Status

Fixed; no confirmed exploitation

CVSS

2.4

CVE

CVE-2026-75553

Affected

Android and iOS versions of Tohoku Electric Power “Yorisou e Net” before 2.8.0

JVN reports that an attacker with physical access could retrieve a hard-coded cryptographic key from affected app versions. Version 2.8.0 or later fixes the issue. JVN does not report exploitation in the wild.

Recommendation

Update the Android or iOS app to version 2.8.0 or later. The physical attack requirement and limited confidentiality impact keep this below the network-exploitable items above.