Major Cyber Attacks in September 2026: US and EU Face Session Theft, Remote Access, and Payment Fraud

A September 2026 threat roundup from ANY.RUN details multiple active phishing and malware campaigns (CSuite, N0va, IronToll, Wazza, TerminalFix) targeting US and EU organizations; attackers abused legitimate services and authentication flows to steal sessions and tokens, deploy remote-management tools, exfiltrate payment card data and OTPs in real time, and evade automated detection through staged routing and trusted binaries. The report highlights detection and containment guidance—session revocation, mailbox and endpoint checks, device-registration and token reviews, full browser-flow analysis, and rapid IOC sharing via threat feeds—and emphasizes investigation speed and contextual pivoting to connect scattered evidence across identity, browser, endpoint, and network telemetry.