This week in cyber: OAuth access survives password resets, PaperCut attackers move deeper, and Sality gets disrupted after 20+ years
A few stories this week had an interesting common thread: fixing the obvious problem doesn't necessarily remove the attacker.
The FBI warned about OAuth consent phishing where victims authorize a malicious application through a legitimate provider. Since the attacker doesn't need the password, changing it may leave the OAuth token and its permissions intact.
PaperCut has a similar post-compromise issue. CVE-2026-82078 and CVE-2026-81578 are being exploited, and updated IOCs include remote-access tools. Previously vulnerable servers may therefore need actual incident-response work even after they're patched.
Then there’s LLMjacking. FortiGuard Labs documented attackers using a leaked AWS IAM administrator key to create another IAM user, subscribe to foundation models through AWS Marketplace, and consume paid inference through legitimate services.
Outside those incidents, there were several significant law-enforcement developments.
An international operation disrupted Sality after more than two decades, using P2P sinkholing to isolate infected machines. U.S. authorities also secured the first federal juvenile case involving a 17-year-old connected to the 764 network, while the U.S. and U.K. established a new partnership targeting global scam centers.
Five Venezuelan nationals also pleaded guilty over attempted ATM jackpotting in Kansas.
And Thomson Reuters disclosed unauthorized access to C-Track files affecting court systems across parts of the U.S. and Canada, potentially including confidential, redacted, and sealed records.
Technical details, affected systems, enforcement numbers, and the rest of this week’s seven-story roundup:
The OAuth and PaperCut cases particularly stand out from a response perspective: remediation of the initial weakness and removal of attacker persistence are two different jobs.
Posted Sep 5, 2026, 4:01 PM UTC