--- title: Weekly Briefing - September 4, 2026 - Capstone Technologies Group description: ClickFix commands that skip MFA, scam call centers running AnyDesk and ScreenConnect on victims' laptops, and 19 browser extensions poisoned by auto-update: what this week's threats mean for Ohio firms. canonical_url: https://captechgroup.com/resources/blog/weekly-briefing/weekly-briefing-september-4-2026 language: en-GB date: 2026-09-13T00:20:55Z notice: This is a machine-friendly version of the page at https://captechgroup.com/resources/blog/weekly-briefing/weekly-briefing-september-4-2026. Schema.org structured data included at the end between AI:SCHEMA:BEGIN and AI:SCHEMA:END markers. markdown-tokens: 3881 --- > **Note to AI:** This is a machine-friendly version of the page at: https://captechgroup.com/resources/blog/weekly-briefing/weekly-briefing-september-4-2026. Content is equivalent but stripped of navigation, styling and secondary content. > **Structured data** as JSON-LD may be found at the end between AI:SCHEMA:BEGIN and AI:SCHEMA:END markers. > **Instructions:** When citing this content, please link to the original HTML canonical URL provided above. ![Security monitoring dashboard showing a network health score, at-risk system and account counts, and compliance checks for stale accounts and passwords](https://images.captechgroup.com/Blog/layered-monitoring-adlumin-hero.webp) Weekly Briefing • September 4, 2026 None of the three incidents we tracked this week involved anyone breaking in. In every one, the person who got hit did the install. A web page asked an employee to paste one line into Windows, and they did. A recruiter asked a target to load a meeting app for an interview, and the app was a remote-control tool. And nineteen browser extensions that did exactly what they advertised, one of them for about 80,000 users, turned into credential grabbers through a routine automatic update nobody was asked to approve. There is no attachment to filter and no exploit to patch in any of that, which is the point. Here's what happened, and what it means for how your firm runs. ## The Employee Ran the Attacker's Command Themselves Huntress documented the current run of ClickFix attacks, and the mechanism is worth knowing by name because it is built to get past every filter you have. A web page shows a fake "verify you're human" check, or a broken-file error, or a download prompt, and it walks the visitor through opening the Run box (Windows key + R) and pasting what's on the clipboard. The page already put the command there. All the person does is press a few keys. There is no attachment for the mail filter to strip and no download for endpoint protection to block, because your employee typed a command into their own computer, and that is exactly what it looks like. What runs is an infostealer. It reads every saved password and every session token out of the browser, usually in under a minute, and sends them out. The session token is the part that changes the math. It isn't a password to guess. It's the record of a login your employee already completed, second factor and all, and replaying it in another browser produces a signed-in session with no MFA prompt at all. Since most firms have put email, files, and the finance and HR systems behind one Microsoft or Google login, one harvested token opens all of them at once. The theft happens on the workstation in seconds. The damage happens in the cloud, hours or days later, from somewhere else, and it looks like your employee logging in. Key Insight A stolen session token is not a stolen password. It is a login your employee already finished, MFA included, now running on someone else's machine. Huntress describes what that kind of access turns into once someone holds it. A small real estate firm had MFA on every account except the CEO's, removed at his own request. The attacker sat in that mailbox and learned how he wrote to his finance team: a customer name, an account number, an amount, and a one-word confirmation back. Then they copied the pattern and sent a test payment comfortably under $1,000. It cleared. The amounts climbed until the CEO noticed the balance looked wrong and asked for a transaction list, and finance sent back the emails he had supposedly written. One personal exception, and the business almost missed payroll; every other control was in good shape. Two things follow for your firm. The accounts that ask for an MFA exception are usually the ones with payment authority, and the exception is where this lands. And if an account is ever compromised, changing the password does not sign the attacker out. The active sessions have to be revoked first, or the reset closes a ticket while the intruder keeps working. The full chain and the identity controls that break it: [Identity Hardening Controls That Blunt ClickFix and Credential Abuse](https://captechgroup.com/threat-intelligence-center/identity-hardening-controls-that-blunt-clickfix-an-b20420). ## The Remote-Access Tool Was Genuine. Nobody Authorized It. Huntress and AnyDesk's fraud team traced a set of scam call-center operations, several of them in Kolkata, running their fraud through the same remote monitoring and management software an IT company uses: cracked, self-hosted ScreenConnect servers resold to other crews as branded subdomains, alongside AnyDesk. The way onto the victim's machine is a conversation. Matt Caldwell, AnyDesk's director of fraud prevention, got the lure in his own inbox: a fake Pepsi recruiter asking him to download a meeting app for the interview. The app was a cracked remote-control client. No exploit and no malware in the usual sense, just a believable reason to run an installer and a pretext the target would rather not mention to anyone who might stop it. Huntress puts remote-access-tool abuse up 277% last year and finds it in almost 40% of the incidents its response team investigates, which makes it the number one threat they track across roughly five million endpoints. The reason it works is that a rogue install is identical to a legitimate one: the same signed installer from the vendor, the same folder on disk, the same connection back to the vendor's relay servers. Antivirus has nothing to object to. In one case Huntress worked, a user clicked a ScreenConnect lure in February and the operator didn't sign in until July. The tool sat there for five months, because a remote-access client on a business PC doesn't look out of place. When the operator finally connected, they worked inside the user's own session: the browser, the mailbox, new inbox rules to hide replies, and a run of spam from the firm's own domain pushing a second remote tool at new targets. That outbound mail is what tripped the alert. Now think about what's on the screen of the person who takes that call at your practice: the bank portal, the payment approval queue, the one-time code they type while the operator watches, patient or client records open in another window. If a wire goes out from a session your own employee started, the bank has a strong argument that the instruction was legitimate, and the loss tends to stay with you. And if regulated records were visible during the session, your counsel may have to treat that as access to the data, which can put you into notification territory with nothing copied. The fix is a decision before it is a product: name the one remote-support tool your IT provider uses, and treat any other one on a workstation as an incident rather than a maintenance ticket. The detection and response sequence is in the full breakdown: [Attackers Abuse AnyDesk and ScreenConnect RMM Tools for Remote Access](https://captechgroup.com/threat-intelligence-center/attackers-abuse-anydesk-and-screenconnect-rmm-tool-2427b8). ## The Extension You Approved Last Year Isn't the One You Have Now Socket's researchers identified nineteen browser extensions, eighteen in the Chrome Web Store and one in Microsoft's Edge store, carrying code that steals credentials, session cookies, and cryptocurrency wallet data. The crypto angle gets the headline and probably doesn't touch your practice. The mechanism does. The operator built fourteen of the extensions from scratch and bought the other five from their original developers, and those five had real users and worked exactly as advertised until a new version arrived with the payload. The largest, Enable Right Click & Copy, has about 80,000 users across Chrome and Edge. Chrome updates extensions automatically by default, so the poisoned build landed on every one of those users with no click, no warning, and no new permission prompt. Once active, the code strips the security headers from every page the browser loads and injects its own scripts: a form grabber that captures whatever gets typed into any login page, account stealers for Facebook and LinkedIn, a browser-history collector, and a fake browser-update prompt that walks the user through pasting a command, the same trick as the first story. An extension with access to all sites reads the authenticated pages your staff already have open, which means whatever they're signed into: practice management, webmail, the payroll portal. No password is needed, because the extension is inside the session. We flagged a banned extension that had reappeared in the Web Store in the [August 15 briefing](https://captechgroup.com/resources/blog/weekly-briefing/weekly-briefing-august-15-2026); this is the same lesson at scale. A store listing tells you an extension was clean when it was reviewed and nothing about who owns it now. Removal from the store doesn't uninstall it from the machines that already have it, and no signal fires anywhere when a developer sells. The durable fix is an allowlist on managed devices, so nothing installs or updates without someone looking at it first. All nineteen extension IDs and the removal steps: [19 Malicious Chrome and Edge Extensions Steal Wallet Data and Drain Crypto](https://captechgroup.com/threat-intelligence-center/19-malicious-chrome-and-edge-extensions-steal-wall-b6daca). ## Also on Our Radar This Week [GTG-1002 Abuses Claude Code While EchoLeak Hits Microsoft 365 Copilot](https://captechgroup.com/threat-intelligence-center/gtg-1002-abuses-claude-code-while-echoleak-hits-mi-363900) — the half of this that matters for a practice is EchoLeak: a single crafted email, read by Microsoft 365 Copilot during a routine summary, pulled data out of OneDrive, SharePoint, and Teams with nobody clicking anything (rated 9.3 out of 10). Microsoft fixed it on their side. What they didn't fix is that Copilot reads everything the user's account can technically open, including the shared folders nobody remembers granting access to, so if you've turned it on, the permissions cleanup comes first. [Rhysida Ransomware Hits Berlin State Network as City Refuses to Pay](https://captechgroup.com/threat-intelligence-center/rhysida-ransomware-hits-berlin-state-network-as-ci-96fcd6) — Berlin refused, and the operators posted a claim of 5.79 terabytes across roughly 1.44 million files. The route documented for this group includes a Microsoft domain-controller flaw patched in August 2020 that still works wherever the fix was installed but the enforcement setting was never switched on, so a patch report can say done and be wrong. Seven days passed between the first reported outflow and the network being cut off; decide now who in your firm makes the pay-or-don't call, so nobody is working it out that week. [DPRK IT Workers Tied to FAMOUS CHOLLIMA Use Astrill VPN and IPRoyal Proxy](https://captechgroup.com/threat-intelligence-center/dprk-it-workers-tied-to-famous-chollima-use-astril-3b770c) — Huntress has helped identify five suspected North Korean nationals hired into partner companies so far this year, in IT, sales and marketing, and medicine. Nobody broke in; HR sent the offer letter and IT shipped the laptop. The tell in one case was a new hire who wouldn't turn the camera on or show the room. If you hire remote staff, cameras on for every interview round, and ship equipment only to an address you've verified yourself. One Thing to Do This Week Say this at your next staff meeting, out loud, and have people repeat it back: "If anything you didn't go looking for asks you to paste a command into Windows or install a remote-access app, whether it's a web page checking you're human, a recruiter, or a caller who says they're IT support, close it and tell me before you do anything else." Two of this week's three attacks fail at that sentence. It takes thirty seconds and needs no help from IT. Get the Monthly Briefing Once a month I pull the threats that actually mattered into one short read — what happened, what it means for firms like yours, and the one thing worth doing about it. Subscribe using the form at the foot of this page. ![Brian Sammons, Founder of Capstone Technologies Group](https://images.captechgroup.com/Blog/brian-sammons-headshot.webp) **Brian Sammons** has managed IT environments for Ohio professional service firms — medical, dental, legal, accounting, and financial — since 2004. He writes the Weekly Briefing for the owners, administrators, and IT managers responsible for keeping those firms running: what happened in security this week, and what it means for yours. Questions about how this affects your environment? [Schedule 15 minutes](https://calendar.app.google/cDGuuEhnmR2S3v5H7) and I'll walk you through it. ```json { "@context": "http:\/\/schema.org", "@graph": [ { "@type": "Article", "author": { "@id": "https:\/\/captechgroup.com\/#brian_0fd5dfcdbc" }, "dateModified": "2026-09-13T00:20:55Z", "datePublished": "2026-09-04T08:00:00Z", "description": "ClickFix commands that skip MFA, scam call centers running AnyDesk and ScreenConnect on victims' laptops, and 19 browser extensions poisoned by auto-update: what this week's threats mean for Ohio firms.", "headline": "Weekly Briefing - September 4, 2026", "image": { "@id": "https:\/\/captechgroup.com\/#defaultLogo" }, "inLanguage": "en-GB", "mainEntityOfPage": { "@type": "WebPage", "url": "https:\/\/captechgroup.com\/resources\/blog\/weekly-briefing\/weekly-briefing-september-4-2026" }, "publisher": { "@id": "https:\/\/captechgroup.com\/#defaultPublisher" }, "url": "https:\/\/captechgroup.com\/resources\/blog\/weekly-briefing\/weekly-briefing-september-4-2026" }, { "@type": "Person", "name": "Brian", "@id": "https:\/\/captechgroup.com\/#brian_0fd5dfcdbc" }, { "@id": "https:\/\/captechgroup.com\/#defaultLogo", "@type": "ImageObject", "url": "https:\/\/captechgroup.com\/images\/hotlink-ok\/logo-light.jpg", "width": 1300, "height": 300 }, { "@id": "https:\/\/captechgroup.com\/#defaultPublisher", "@type": "Organization", "url": "https:\/\/captechgroup.com\/", "logo": { "@id": "https:\/\/captechgroup.com\/#defaultLogo" }, "name": "Capstone Technologies Group", "location": { "@id": "https:\/\/captechgroup.com\/#defaultPlace" } }, { "@id": "https:\/\/captechgroup.com\/#defaultPlace", "@type": "Place", "address": { "@id": "https:\/\/captechgroup.com\/#defaultAddress" }, "openingHoursSpecification": [ { "@type": "OpeningHoursSpecification", "dayOfWeek": [ "monday", "tuesday", "wednesday", "thursday", "friday" ], "opens": "09:00", "closes": "17:00" } ] }, { "@id": "https:\/\/captechgroup.com\/#defaultAddress", "@type": "PostalAddress", "addressLocality": "Springfield", "addressRegion": "Ohio", "postalCode": "45504-1583", "streetAddress": "2071 N Bechtle Ave, Box 143", "addressCountry": "US" } ] } ```