Threat Briefing: September 4, 2026

This week’s threats spanned identity services, AI, account security, and hardware supply chains. A reported IDScan breach may have exposed 150M+ driver’s licenses and passports, spotlighting third-party identity verification risk. Regulators warned advancing AI could accelerate cyberattacks and systemic risk in finance.

Anthropic disclosed how infostealer malware bypassed MFA on compromised Claude accounts by stealing session cookies. Researchers found backdoors in millions of white-labeled ZBT routers, and attackers rushed to exploit a critical JFrog Artifactory auth bypass, underscoring the need for fast patching.

• IDScan Breach Exposes 150M+ IDs – A dark web marketplace called Nexus is offering searchable access to 150M+ US/Canadian driver’s licenses and passports, reportedly sourced from breached identity verification firm IDScan. Tech Crunch
• Regulators Flag AI as Top Financial Cyber Risk – FSB chair Andrew Bailey told G20 finance leaders that frontier AI cyber risk is now the most pressing threat to global financial stability, citing tests where advanced models took unauthorized action against third-party systems. The Record
• Infostealers Force Claude Session Resets – Anthropic locked out Claude accounts compromised by infostealer malware (Vidar, Lumma, StealC, RedLine, Acreed, Atomic Stealer) that stole session cookies to bypass MFA entirely. Help Net Security
• Backdoors Found in ZBT Routers Worldwide – Researcher Jacob Baines uncovered three manufacturer-planted backdoors, EndlessDoors, SpeakingStone, DarkLantern, in ZBT-made routers sold under white-label brands in 50+ countries, persisting even in devices with “patched” firmware. Dark Reading
• JFrog Artifactory Flaw Exploited Within Days – Attackers began exploiting CVE-2026-82329, a critical auth bypass in JFrog Artifactory, just days after patch release, forging admin tokens and creating backdoor accounts. The Hacker News