INTRODUCTION
A support call can give an attacker control of a workstation. A familiar registry can deliver malicious code to a provisioning job. A replication account can do far more than the team managing it expected.
This week’s reports show how those openings can lead to broader compromise. They also bring another reminder from Serbia: a phone can expose sensitive conversations without ever connecting to a corporate network.
For security leaders, the question is practical. Which of these paths exist in your organization, and what would stop an attacker from using them?
Get The Monday Brief in your inbox every Monday. Subscribe for free, and share it with someone who’d find it useful.
Thanks for supporting The Monday Brief.
WEEKLY SIGNALS ANALYSIS
Verify the support request before granting control. Attackers are using external Teams accounts to impersonate IT staff. A familiar application and a convincing caller are enough to get some users to hand over their desktops.
Include infrastructure-as-code registries in supply chain reviews. The Coder incident shows why requesting the correct module and version does not guarantee that the code delivered is trustworthy.
Review what service accounts can actually do. PostgreSQL’s replication flaw turns an operational privilege into code execution. Patching addresses the vulnerability; reviewing those accounts addresses unnecessary exposure.
Protect sensitive conversations wherever they happen. The Serbia cases concern selected political and civil-society targets. For organizations facing comparable threats, personal phones belong in the risk discussion.
THIS WEEK’S SIGNALS
Signal 1: Fake IT Support on Teams Opens a Path to Identity Infrastructure
Why it matters: Microsoft documented attackers using external Teams accounts to impersonate IT support, obtain remote control and install a Node.js-based backdoor. Operators then used it for reconnaissance and lateral movement toward servers, including identity infrastructure. Unit 42 reported a similar playbook in its Spring Ring research, including an attempted domain takeover that defenders blocked. Arctic Wolf Labs had also reported two Teams and Quick Assist intrusions in July, showing the same initial-access pattern with different payloads.
What is being misread: These reports do not describe a Teams authentication vulnerability. The caller is external and pretending to be support. The failure is granting control without independently verifying that claim.
Think Red (Douglas McKee): I will take a user walking me into their workstation over a stolen password every time. A password may still leave me dealing with MFA or a device check. Here, someone is on the call helping me get access through a tool they already trust. Once they hand over control, I can start discovery and stage my payload. I don’t need a Teams vulnerability to get in.
Act Blue (Ismael Valenzuela): A remote-support request is a claim of identity, and most organizations still accept that claim on sight. Give employees one known internal path for confirming an unsolicited support request, restrict external Teams contact where the business allows it, and limit which remote-assistance tools can run at all. Then hunt the sequence Microsoft actually documented rather than any single event: (1) external Teams contact, (2) a Quick Assist or RMM session, (3) PowerShell and a silently installed MSI, (4) a portable Node runtime from a user-writable path, (5) WinRM toward servers or identity infrastructure. Any one of those is defensible on its own and the chain is not. Another banner will not help here, because the platform already labeled the sender external and the request still landed.
Supporting sources:
Microsoft: Impersonating IT support: how threat actors turn a remote session into enterprise-wide access
Arctic Wolf Labs: Similar Tradecraft Across Two Teams & Quick Assist Intrusions
Unit 42: Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams
Signal 2: Coder’s Registry Hijack Delivered Malicious Terraform Modules
Why it matters: On August 31, an attacker used a compromised Cloudflare API key to redirect some Coder registry traffic to a malicious server. For roughly fourteen hours, affected requests received tampered Terraform modules designed to steal cloud credentials. Coder says its codebase was not compromised.
What is being misread: Infrastructure-as-code modules can affect resources and credentials available to the provisioning job. Treating them as harmless configuration understates what a compromised module can do.
Think Red (Douglas McKee): What separates this from another poisoned package is that no maintainer had to be compromised. The attacker went after the thing that decides where the module comes from, which means a victim can request the correct registry, the correct module and the correct version and still be handed something else. Every one of the usual reassurances holds and none of them helps. Pinning a version does not help when the version is right. A domain allowlist does not help when the domain is right. The question worth sitting with is what your pipeline independently knows about an artifact once the registry it trusted is the thing that lied.
Act Blue (Ismael Valenzuela): We made the dependency-pinning case after the poisoned Rust crate, and this incident moves the boundary the argument sits on, because the delivery path itself was what got compromised. Start with the exposure window. Work out which templates or workspaces fetched modules during 31 August, search DNS, proxy and flow logs for the indicators in Coder's advisory, clear cached module artifacts so a tampered copy is not replayed from local disk, and rotate the credentials that were reachable from those provisioner jobs. Going forward, exact versions still buy you reproducibility, and Terraform's dependency lock file is not module integrity verification because it tracks providers rather than remote modules. Where a registry is privileged enough to feed provisioning jobs, put something you control between it and the credentials that build your environment, whether that is a mirror or an artifact-verification step.
Supporting sources:
Coder: Coder Registry Security Incident: What Happened and What to Do
HashiCorp: Dependency Lock File
Signal 3: PostgreSQL Flaw Turns Replication Access Into Code Execution
Why it matters: CVE-2026-6471, also called PostGREShell, allows a role with REPLICATION privilege to load a shared library accessible to the database server’s operating-system account and execute code as that account. The flaw dates to PostgreSQL 9.4. PostgreSQL released fixes on August 13.
Exploitation requires logical decoding to be enabled and attacker-controlled code to be accessible to the server, through a local file or a supported network path. Researchers demonstrated escalation to database superuser and persistent access.
What is being misread: A replication account is not an ordinary read-only account. Backup and data-pipeline identities need scrutiny based on their actual capabilities, even when they do not hold database superuser privileges.
Think Red (Douglas McKee): REPLICATION reads like a constrained permission right up until you ask what PostgreSQL actually lets it invoke. Permission to take part in logical decoding turned out to include permission to choose the plugin, and choosing the plugin turned out to mean loading a library as the server's own account. That is the kind of gap worth chasing on an engagement, and not because anybody forgot to rotate a credential. Privilege names outlive the assumptions that produced them. When a role your architecture diagram calls read-only backup access can reach operating-system execution, the boundary was never where the diagram put it.
Act Blue (Ismael Valenzuela): The patch has been out since 13 August, so the first question is which of your clusters has not yet taken the August update releases, keeping in mind that anything older than PostgreSQL 14 is out of support and will not receive one. After that, inventory every role carrying REPLICATION, strip it where it is not needed, and restrict replication entries in pg_hba.conf to known addresses. Nothing in the advisory says your environment was exploited, so scope the hunt rather than assuming a breach. On clusters where broadly reachable replication credentials genuinely existed, review logical-decoding plugin use, unexpected libraries, privilege changes and any database process spawning operating-system commands or outbound connections. The architecture question outlasts this CVE. Which service identities can cross from a database privilege into execution on the host, and would you find out from the diagram or from an advisory?
Supporting sources:
PostgreSQL: CVE-2026-6471: PostgreSQL logical decoding can dlopen arbitrary file
PostgreSQL: Release 18.6
Cyera: PostGREShell: The database powering much of the internet had an open door for 12 years
PostgreSQL: The pg_hba.conf File
Signal 4: Spyware Targets Serbian Activists and Opposition Figures
Why it matters: SHARE Foundation documented at least 14 people targeted in what it describes as Serbia’s largest documented spyware wave. Findings include one Pegasus infection confirmed by Citizen Lab and two infections involving new NoviSpy-related Android spyware. Eleven additional Apple-notified devices remain under investigation.
The confirmed Pegasus activity spans December 2025–January 2026 and involved a zero-click iMessage exploit. The reported Android spyware cases involved physical access, including a phone confiscated during police questioning.
What is being misread: These are selected targets, not evidence of indiscriminate Pegasus deployment. Fourteen people targeted does not mean fourteen forensically confirmed infections. However, an Apple threat notification warrants immediate expert assistance; Citizen Lab advises treating affected devices as presumed infected while investigating.
Think Red (Douglas McKee): Organizational boundaries and intelligence boundaries are not the same shape, and this is the cleanest illustration of it. A personal handset may never authenticate to anything corporate and still be present for every conversation that matters, carried through the meetings, the relationships and the decisions. One confirmed Pegasus infection here required nothing from the target at all. If the target is a person rather than a network, I stop caring about the corporate endpoint. The device in their pocket answers the same questions and carries none of the monitoring, so that is where I would spend the effort. The asymmetry is what belongs in a threat model, not a general warning that spyware exists.
Act Blue (Ismael Valenzuela): A personal phone that sits in sensitive conversations is an intelligence surface whether or not policy acknowledges it, and the honest starting point is naming which people are realistically in scope. For those few, provide a managed device for sensitive work, keep it patched, turn on Lockdown Mode where the role warrants it, and decide now where an Apple Threat Notification goes at two in the morning and which forensic specialist picks it up. Device compliance and risk-based access still matter for protecting your applications, and they are a different problem from this one. A compromised microphone exposes the meeting without ever authenticating to anything you run.
Supporting sources:
SHARE Foundation: SHARE Foundation: Students and Opposition Politicians Targeted by Spyware
Citizen Lab: Pegasus Spyware Infection of Serbian Pro-Democracy Student Activist
ROLE-BASED TAKEAWAYS
Executive / CISO / Board Level
Help-desk impersonation turns a normal support workflow into privileged remote access. Arctic Wolf Labs, Microsoft and Unit 42 documented external Teams identities posing as IT support to gain access to workstations. Microsoft and Unit 42 also reported activity targeting identity infrastructure. Ask your security team how employees can independently verify a support request before granting remote access, and whether your current controls allow an external caller to talk someone into handing over control.
Your infrastructure-as-code registry is part of the privileged software supply chain. The Coder incident poisoned provisioning jobs by compromising the delivery path rather than the module itself, so the request looked correct in every respect a pipeline normally checks. Request an inventory of every external registry that can feed code into a privileged infrastructure run, the independent control sitting between each one and production credentials, and evidence that your team could reconstruct exactly what was fetched during an incident window.
High-risk personnel carry organizational intelligence onto devices the organization does not own. Serbia’s latest cases involved political and civil-society targets, with 14 people targeted and three infections confirmed so far. For executives with comparable state-level exposure, direct your team to settle two questions before they are urgent. Whether sensitive work belongs on a managed device, and who picks up the phone if a mercenary-spyware notification arrives.
Enterprise Architect
Design Principle Impact: Collaboration presence is not support identity. External users can reach employees through the same interface used for internal work, and the platform labeling them external does not stop the request from succeeding. Remote-control workflows that begin in a collaboration tool should require a separate, independently authenticated support path before control is granted.
New Constraint/Dependency: Any registry able to feed a privileged provisioning job sits inside that job’s trust boundary. Exact versions buy reproducibility rather than integrity, so where a registry compromise would translate directly into execution, put an independently controlled mirror or an artifact-verification step in between.
Security Operations
Implementation Watch Item: Monitor for remote-control sessions initiated after an external Teams chat, and for Node.js processes spawned by remote-support or collaboration tooling.
Common Failure Mode: Verification policies that trigger after a support session has already started. If the callback happens once the attacker is driving the keyboard, the control has already failed.
Monitoring Patterns: Start from the published artifacts. For Coder, module downloads during the 31 August window and traffic to the indicators in its advisory. For PostgreSQL, unexpected logical-decoding plugin use, unfamiliar libraries and host-level execution from database processes. For the Teams campaign, external collaboration followed by remote assistance, then PowerShell and MSI execution, a Node runtime from a user-writable path, and WinRM toward servers or identity infrastructure.
Signal vs Noise Guidance: A remote-support session by itself is routine. The same session followed within minutes by scripting, a silent installer, domain discovery or administrative connections toward identity infrastructure deserves far higher confidence. Sequence and destination carry the signal, not the presence of a support tool.
Take the Adversary by Surprise: Place honeytokens and decoy credentials where an attacker conducting discovery would look, such as support documentation or administrative scripts. Alert when they are used. These unexpected tripwires can expose an attacker operating through a legitimate remote-support session, giving defenders an early warning before the attacker reaches sensitive systems.
See you next Monday!
The Monday Brief is produced by Douglas McKee and Ismael Valenzuela. The opinions expressed are our own and do not reflect those of our employers.