Threat Brief — 2026-08-25 — Phishing Toolkits Evolve, Zimbra Breaches Climb

Active exploitation of the Zimbra RCE vulnerability has now compromised 270+ servers, confirming the threat continues to escalate past its CISA KEV deadline. Two new social-engineering vectors deserve attention: a Notion notification abuse technique and a fake Windows 11 login screen triggered via Alt+Tab. On the defensive side, WhatsApp rolled out multi-passkey support and stronger 2SV, while Unit 42 published fresh analysis on AI-enabled malware trends.

Top items

• Zimbra RCE exploitation passes 270 breached servers (developing). Threat actors have now compromised over 270 Zimbra Collaboration Suite instances via a high-severity RCE vulnerability already listed in CISA KEV. The attack volume continues to grow well after the KEV remediation deadline expired, signalling that unpatched instances remain widespread. First reported 2026-08-20 by BleepingComputer. (src: BleepingComputer)

• Marimo Notebook MCP command-injection flaw (new). A high-severity vulnerability in Marimo's notebook software allowed an attacker to execute attacker-supplied Model Context Protocol (MCP) commands from a specially crafted notebook before cells execute in edit mode. VulnCheck assigned a CVE. Organisations using Marimo for AI/data workflows should patch immediately. (src: The Hacker News)

• Notion notification abuse enables phishing delivery (new). Attackers are leveraging Notion's trusted in-app notification system to deliver phishing links directly into a user's inbox, bypassing email-based security controls. The technique exploits Notion's reputation to lend credibility to malicious links. Organisations using Notion should warn staff that in-app notifications are not inherently trustworthy. (src: SecurityLab)

• Fake Windows 11 login screen uses Alt+Tab as a credential trap (new). Attackers constructed a convincing fake Windows 11 login screen designed to intercept employee passwords, exploiting the familiar Alt+Tab workflow as a trigger mechanism. The technique targets users who habitually Alt+Tab away from and back to their session, presenting a credential prompt at the opportune moment. (src: SecurityLab)

• ReliaQuest / ShinyHunters: phone-based social engineering confirmed (developing). New reporting confirms ShinyHunters breached ReliaQuest via a single successful phone call impersonating a colleague, granting access to internal accounts including an Okta dashboard. ReliaQuest states data exfiltration was blocked. First reported 2026-08-24 by BleepingComputer. (src: Xakep, SecurityLab)

• WhatsApp adds multiple passkeys and stronger 2SV (new). Meta began rolling out support for multiple passkeys per WhatsApp account (covering iOS and Android devices) plus enhanced two-step verification. This is a notable step toward phishing-resistant authentication for a consumer messaging platform used by billions. (src: The Hacker News, BleepingComputer)

• Roskomnadzor disrupts Google and Cloudflare DNS-over-HTTPS (new). Russian telecom regulator appears to be actively blocking TLS handshake completion for Google and Cloudflare DoH endpoints — TCP sessions establish but encrypted DNS exchange is severed at the start of the TLS negotiation. Organisations operating in Russia or relying on DoH for users there should expect degraded DNS privacy services. (src: SecurityLab)

• Unit 42 assesses AI-enabled malware state as of August 2026 (new). Unit 42's latest research examines the progression of AI in malware from brand-abuse automation to agentic execution, concluding that existing behavioural detection and endpoint analytics remain effective against AI-authored code before execution. Worth reading for teams calibrating AI-threat defence priorities. (src: Unit 42)

• Global law-enforcement operation arrests 58 cybercrime suspects (new). A coordinated action across 22 countries identified 263 suspects and arrested 58 individuals linked to cybercrime networks operated by African crime groups. No specific technical IoCs released, but the scale signals continued international pressure on cybercrime infrastructure. (src: BleepingComputer)

Themes

Trusted-platform abuse for phishing delivery. Two of today's most notable social-engineering items — Notion notification phishing and the Mirage2FA M365 campaign — both exploit legitimate platform functionality to bypass traditional email security. The pattern is clear: attackers are shifting delivery from email (where detection is mature) into application-native channels where user trust is high and security controls are thin.

MCP / agentic surface area emerging. The Marimo MCP command-injection flaw is an early indicator that the Model Context Protocol stack is becoming a viable attack surface as AI tooling integrates deeper into development and data workflows. Teams adopting MCP-enabled tools should treat MCP command paths as untrusted input.

===

THREAT-TOPICS===

[{"slug":"zimbra-rce-active-exploitation","headline":"Zimbra RCE exploitation passes 270 breached servers","findingIds":[9332],"status":"developing","development":"Server breach count quantified at 270+, confirming continued growth past CISA KEV deadline (first reported 2026-08-20 by BleepingComputer)"},{"slug":"marimo-notebook-mcp-command-execution","headline":"Marimo Notebook MCP command-injection flaw patched","findingIds":[9345],"status":"new"},{"slug":"notion-notification-phishing","headline":"Notion in-app notifications abused for phishing delivery","findingIds":[9328],"status":"new"},{"slug":"fake-windows-login-alt-tab","headline":"Fake Windows 11 login screen traps users via Alt+Tab","findingIds":[9340],"status":"new"},{"slug":"reliquest-shinyhunters-failed-data-theft","headline":"ReliaQuest breach via single phone call confirmed by new sources","findingIds":[9329,9324],"status":"developing","development":"New reporting confirms the initial access vector was a single phone call impersonating a colleague; Okta dashboard screenshots posted by attackers (first reported 2026-08-24 by BleepingComputer)"},{"slug":"whatsapp-multiple-passkeys","headline":"WhatsApp rolls out multiple passkeys and stronger 2SV","findingIds":[9344,9342],"status":"new"},{"slug":"roskomnadzor-tls-doh-blocking","headline":"Roskomnadzor disrupts Google and Cloudflare DNS-over-HTTPS TLS","findingIds":[9338],"status":"new"},{"slug":"ai-enabled-malware-state-august-2026","headline":"Unit 42 assesses AI-enabled malware trends August 2026","findingIds":[9326],"status":"new"},{"slug":"global-cybercrime-crackdown-arrests","headline":"Global police operation arrests 58 suspects across 22 countries","findingIds":[9325],"status":"new"}]