Table of Contents

Cyberthreat Analysis

• Inside an AI-Enabled Device Code Phishing Campaign
• Ransomware and Cyber Extortion in Q1 2026
• Securing GitHub: Wiz Research Uncovers Remote Code Execution in GitHub

Industry News

#NMFTACyber On Demand

Inside an AI-Enabled Device Code Phishing Campaign

Microsoft Defender Security Research has observed a widespread phishing campaign leveraging the device code authentication flow to compromise organizational accounts at scale. While traditional device code attacks are typically narrow in scope, this campaign demonstrated a higher success rate, driven by automation and dynamic code generation that circumvented the standard 15-minute expiration window for device codes. This activity aligns with the emergence of EvilTokens, a phishing-as-a-service (PhaaS) toolkit identified as a key driver of large-scale device code abuse.

This campaign is distinct because it moves away from static, manual scripts toward an AI-driven infrastructure and multiple automations end-to-end. This activity marks a significant escalation in threat actor sophistication since the Storm-2372 device code phishing campaign observed in February 2025.

Ransomware and Cyber Extortion in Q1 2026

Total ransomware posts on data-leak sites in Q1 2026 reached 2,638, up 22% from 2,161 in Q1 2025, reflecting the sustained pressure organizations continue to face.

But the bigger story again this quarter was instability below the top tier, across threat actors, geography, and sector. Established groups still drove large-scale disruption, yet much of the operational pressure came from newer and less established actors. As a result, actor rankings matter less than the ability to detect and disrupt the behaviors that repeatedly drive ransomware impact, including exposed VPN and RDP access; abuse of trusted admin tools; and lateral movement through RDP, Server Message Block (SMB), and Group Policy.

Ransomware-as-a-service (RaaS) groups “Akira” and “Qilin” maintained high victim counts despite quarter-over-quarter declines, while relative newcomer “The Gentlemen” surged into the top three. At the same time, two new data-leak sites, “0APT” and “ALP-001,” highly likely used questionable or fabricated “leak” claims to extort large enterprises. Meanwhile, extortion group “ShinyHunters” continued to show that even threat actors with few named victims can still drive enterprise-scale impact through identity- and software-as-a-service (SaaS)-centered intrusions.

Together, these developments show how fragmented ransomware pressure became in Q1 2026 and where organizations should focus to reduce risk in the quarters ahead.

Securing GitHub: Wiz Research Uncovers Remote Code Execution in GitHub.com and GitHub Enterprise Server (CVE-2026-3854)

Wiz Research uncovered a critical vulnerability (CVE-2026-3854) in GitHub's internal git infrastructure that could have affected both GitHub.com and GitHub Enterprise Server. By exploiting an injection flaw in GitHub's internal protocol, any authenticated user could execute arbitrary commands on GitHub's backend servers with a single git push command - using nothing but a standard git client.

Notably, this is one of the first critical vulnerabilities discovered in closed-source binaries using AI, highlighting a shift in how these flaws are identified. Despite the complexity of the underlying system, the vulnerability is remarkably easy to exploit. On GitHub.com, this vulnerability allowed remote code execution on shared storage nodes. We confirmed that millions of public and private repositories belonging to other users and organizations were accessible on the affected nodes. On GitHub Enterprise Server, the same vulnerability grants full server compromise, including access to all hosted repositories and internal secrets.

GitHub mitigated this issue on GitHub.com within 6 hours of our report, released patches for all supported versions of GitHub Enterprise Server, and published the CVE at the time of release. GitHub Enterprise Server customers should upgrade immediately - at the time of this writing, our data indicates that 88% of instances are still vulnerable.

Refer a Colleague

Would you like others at your company to be added to the NMFTA Headline Newsletter email distribution list? Send them this link or fill out the form for them on their behalf below!