Token Replay, AI Hijacking, and Root Escalation: Oct 2026 Alert

Token Replay Attacks Compromise Microsoft 365 Accounts at Scale

A sophisticated Microsoft 365 token-replay campaign has successfully compromised 97 accounts across 79 organizations using adversary-in-the-middle (AitM) techniques. The attack chain captures legitimate authentication sessions, extracts the session tokens, and replays them to bypass multi-factor authentication entirely.

This isn't a weakness in MFA itself—it's an exploitation of how session tokens work. Once a user successfully authenticates, the system issues a token that proves identity for a set period. If an attacker can intercept that token through a phishing proxy or compromised network position, they inherit full access without needing the original credentials or second factor.

Why This Matters

Token replay attacks represent a maturation of credential theft. Traditional phishing captures username and password. AitM phishing captures the entire authenticated session, rendering password rotation and even hardware security keys ineffective if the token is stolen post-authentication.

The scale—79 organizations—suggests either a targeted campaign against specific industries or a toolkit being deployed broadly. Either way, defensive measures need to move beyond "enable MFA" to "assume tokens can be stolen."

What to Do

• Implement Conditional Access policies that bind tokens to device identity, IP ranges, or compliant endpoints. Azure AD and similar platforms support token binding to reduce replay effectiveness.
• Reduce token lifetime to minimize the window of opportunity. Shorter-lived tokens force attackers to act quickly or re-compromise sessions.
• Monitor for impossible travel and anomalous access patterns. If a token is used from New York and then Beijing within minutes, flag and terminate the session.
• Deploy phishing-resistant MFA like FIDO2 or passkeys that cryptographically bind authentication to the origin, making relay attacks significantly harder.

AI Coding Agents Hijacked via Malicious Instruction Files

Researchers at Forever Security discovered a malicious AGENTS.md file sitting in a developer's Downloads folder that successfully instructed an AI coding agent to install a known-malicious npm package. The attack exploits how AI agents scan local directories for context and instructions, treating markdown files as trusted input.

The agent read the file, interpreted the instructions as legitimate development guidance, and executed the package installation without user confirmation. This represents a new attack surface: prompt injection via the filesystem.

The Broader Threat

AI coding assistants operate with elevated permissions—they can read files, execute commands, and modify codebases. If an attacker can inject instructions into the agent's context window through a seemingly innocuous file, they can hijack the agent's capabilities.

This attack vector is particularly insidious because:

• Downloads folders accumulate files from email attachments, browser downloads, and shared drives.
• Developers rarely audit markdown or text files for malicious content.
• AI agents are trained to be helpful and may prioritize explicit instructions in files over ambient context.

Mitigation Steps

• Restrict AI agent filesystem access to project directories only. Avoid giving agents blanket access to home directories or Downloads.
• Implement confirmation prompts for high-risk actions like installing packages, executing shell commands, or modifying critical files.
• Audit your Downloads folder. Remove old files, especially from untrusted sources.
• Use allowlists for package sources and require manual approval for any package not on the list.
• Monitor AI agent activity logs for unusual command sequences or external package requests.

Tailscale SSH Flaws Allow Root Escalation Across Networks

An unpatched vulnerability in Tailscale's SSH implementation allows a compromised device on the network to gain root access to other servers it can reach. The attack leverages weaknesses in how Tailscale handles SSH authentication and privilege escalation within its zero-trust networking model.

Tailscale is widely used to create secure mesh networks without traditional VPNs, particularly popular among startups and remote teams. The assumption is that once a device is on the Tailscale network, it's trusted. This vulnerability breaks that assumption.

The Risk

A single compromised endpoint—a developer laptop with weak local security, a test server with default credentials, or a contractor device—becomes a pivot point for lateral movement. The attacker doesn't need to breach perimeter defenses; they only need to compromise one node, then escalate across the mesh.

What You Should Do

• Monitor Tailscale's security advisories and apply patches immediately when available.
• Implement least-privilege access even within Tailscale networks. Not every device should reach every server, and not every user should have root.
• Deploy endpoint detection and response (EDR) on all devices in the mesh. If one device is compromised, you need visibility into lateral movement attempts.
• Segment your Tailscale network using ACLs to limit blast radius. Production servers should not be accessible from developer laptops without explicit justification.
• Audit SSH configurations and disable root login where possible. Require key-based authentication and log all access.

uCreator Spyware Targets Telegram and WeChat 2FA

A rentable Android spyware kit called uCreator has been identified stealing Telegram two-factor authentication passwords and cloning WeChat accounts. The malware hides its code inside working copies of legitimate messaging apps, making detection difficult.

Users install what appears to be a functional version of Telegram or WeChat, unaware that the app has been modified to exfiltrate credentials, messages, and session tokens. The spyware is distributed through third-party app stores, phishing links, and compromised websites.

Implications for Business Security

While uCreator primarily targets individuals, the business risk is significant:

• Compromised employee accounts can leak internal communications, customer data, or proprietary information.
• 2FA bypass means even security-conscious employees with strong passwords are vulnerable if they install the malicious app.
• BYOD environments are particularly at risk, as personal devices often lack enterprise mobile device management (MDM) or app vetting.

Defense Strategies

• Require apps to be installed only from official stores (Google Play, Apple App Store). Block sideloading on corporate-managed devices.
• Deploy mobile threat defense (MTD) solutions that detect repackaged or malicious apps.
• Educate employees about the risks of third-party app stores and unofficial app sources.
• Use app-based 2FA cautiously. Consider hardware tokens or platform-native authenticators that are harder to compromise.
• Monitor for signs of compromise: unusual login locations, unexpected session tokens, or data exfiltration patterns.

GitHub Token Theft Campaign Steals Repository Secrets

The Gheist campaign uses stolen GitHub tokens to plant workflows that print repository secrets into GitHub Actions logs, which attackers then download before deleting the evidence. The attack targets private repositories, exfiltrating API keys, database credentials, and cloud access tokens stored as GitHub Secrets.

This is supply chain compromise at the CI/CD layer: attackers don't need to breach the application itself if they can steal the secrets used to deploy and operate it.

How the Attack Works

1. Attacker obtains a GitHub personal access token (via phishing, leaked credentials, or compromised developer machine).
2. Token is used to create a new GitHub Actions workflow in a private repository.
3. Workflow includes steps that echo all repository secrets to the Actions log.
4. Attacker downloads the log containing plaintext secrets.
5. Workflow and log entries are deleted to cover tracks.

Protection Measures

• Rotate GitHub tokens regularly and audit token permissions. Use fine-grained tokens with minimal scope.
• Enable GitHub secret scanning and push protection to detect exposed credentials.
• Monitor GitHub Actions logs for unusual workflows, especially those created outside normal development hours.
• Use secret management solutions like HashiCorp Vault or AWS Secrets Manager instead of storing secrets directly in GitHub.
• Implement branch protection and require code review for workflow changes.
• Enable audit logging for all repository access and workflow modifications.

CISA's Latest Exploited Vulnerabilities

CISA added eight vulnerabilities to its Known Exploited Vulnerabilities catalog this week, including:

• CVE-2026-114625: Arista VeloCloud Orchestrator SQL injection
• CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656: Multiple Plex Media Server vulnerabilities including SSRF and path manipulation
• CVE-2026-110936: Siemens Software Center uncontrolled search path

These are actively exploited in the wild. If you run any of these products, patching is not optional.

Taking Action This Week

The common thread across this week's threats: trust assumptions are being weaponized. Tokens are trusted after authentication. AI agents trust local files. Mesh networks trust member devices. App stores are trusted sources.

Modern defense requires:

• Continuous verification, not one-time authentication
• Least privilege at every layer
• Monitoring and logging to detect abuse of legitimate credentials
• Rapid patching of known-exploited vulnerabilities

If your organization needs help assessing these risks or building defenses against token replay, AI-targeted attacks, or lateral movement, Vici Tech Solutions offers penetration testing and security assessments tailored to the 2026 threat landscape.