Full Report
Turning off email images should at least stop the pictures. This week, attackers had a workaround: a scannable QR code built out of text. It still appears, even with images blocked. A small detail, but an annoying one if that was a precaution you were counting on. Elsewhere, a trusted software source delivered code that stole credentials, and a protocol designed for secure network management
Analysis Summary
# Morning News Roll-up September 07, 2026
## Overview
This week's threat landscape is characterized by the exploitation of zero-day vulnerabilities in ubiquitous software like Google Chrome and MikroTik routers, alongside a novel phishing technique that bypasses traditional email security measures using text-based QR codes. Critical infrastructure management tools like N-able N-central also face active exploitation, highlighting a significant risk to managed service providers and enterprise networks.
## Top Stories
### Text-Based QR Code Phishing Bypass
- Summary: Attackers are utilizing a novel workaround to bypass email security settings that block images. By constructing scannable QR codes entirely out of text characters (ASCII/Unicode), malicious links remain visible and functional even when image rendering is disabled, circumventing a common defensive precaution.
- Source: hxxps://thehackernews[.]com/2026/09/weekly-recap-chrome-0-day-router[.]html
### Google Chrome Zero-Day (CVE-2026-85046)
- Summary: Google has patched a high-severity type confusion vulnerability in the V8 JavaScript engine that is being actively exploited in the wild. The flaw allows remote attackers to execute arbitrary code within the browser sandbox via specially crafted HTML pages.
- Source: hxxps://thehackernews[.]com/2026/09/google-releases-chrome-update-to-patch[.]html
### MikroTrick: MikroTik RouterOS Authentication Bypass
- Summary: Threat actors are actively chaining multiple zero-day vulnerabilities (collectively dubbed "MikroTrick") to hijack MikroTik routers. The exploit allows for unauthorized administrative access and the creation of rogue accounts (e.g., "ops") on devices with SSH enabled.
- Source: hxxps://thehackernews[.]com/2026/09/attackers-hijack-mikrotik-routers[.]html
---
# Main Topic
Active exploitation of critical infrastructure, browser zero-days, and novel evasion techniques in email phishing.
## Key Points
- **Image-less QR Codes:** A significant shift in phishing TTPs involves using text-based QR codes to bypass "block images" security policies in email clients.
- **V8 Engine Exploitation:** CVE-2026-85046 represents the sixth Chrome zero-day exploited in 2026, targeting the V8 JavaScript/WebAssembly engine.
- **N-able N-central Compromise:** Despite patches for CVE-2026-86206 and CVE-2026-86207, managed service environments are seeing active compromises, suggesting a narrow window for remediation or the use of additional undisclosed flaws.
- **Router Hijacking:** The "MikroTrick" chain demonstrates that even infrastructure hardware is under sustained targeted pressure to facilitate network persistence.
## Threat Actors
- **Unknown Phishing Groups:** Utilizing text-based QR code generation for credential theft.
- **Unattributed Zero-Day Actors:** Groups targeting Chrome (CVE-2026-85046) and MikroTik routers.
- **Campaign Indicators:** Attacks against MikroTik routers have been observed originating from specific infrastructure in Poland and other regions since September 2, 2026.
## TTPs
- **Text-based QR Codes:** Building scannable matrices using text characters to evade image filters.
- **Type Confusion:** Exploiting engine logic in V8 to achieve Remote Code Execution (RCE).
- **Authentication Bypass:** Chaining vulnerabilities (CVE-2026-67276 + CVE-2026-86060) to gain administrative control without credentials.
- **Privilege Escalation:** Moving from unauthorized access to full platform control in N-central and RouterOS.
## Affected Systems
- **Google Chrome:** Versions prior to 152.0.7977.82.
- **MikroTik RouterOS:** Versions prior to 6.49.21 (Long-term), 7.23.4 (Long-term), and 7.24.2 (Stable).
- **N-able N-central:** All versions prior to the September 2026 hotfixes (CVE-2026-86206, CVE-2026-86207, CVE-2026-86218).
- **Email Clients:** Any client configured to block images but allow text-based rendering of ASCII/Unicode.
## IoCs
- **IPv4:** 82[.]192[.]72[.]4 (Associated with MikroTik attacks)
- **IPv4:** 103[.]102[.]31[.]18 (Associated with MikroTik exploit attempts)
- **Account Name:** `ops` (Unauthorized account created on compromised MikroTik devices)
- **CVEs:** CVE-2026-85046, CVE-2026-67276, CVE-2026-86060, CVE-2026-86206, CVE-2026-86207, CVE-2026-86218.
## Mitigations
- **Patch Management:** Immediately update Chrome to version 152.0.7977.82 or higher and MikroTik RouterOS to the latest stable/long-term releases.
- **N-central Hotfixes:** Apply the fourth hotfix provided by N-able to address RCE and authentication bypass.
- **Security Awareness:** Train users to recognize that scannable QR codes can appear even if images are blocked and to avoid scanning unsolicited codes.
- **SSH Hardening:** Restrict SSH access on routers to trusted management IPs or utilize VPNs for remote administration.
## Conclusion
The current threat environment shows a sophisticated focus on both the entry point (browser/email) and the backbone (routers/MSP tools) of corporate networks. The emergence of text-based QR codes indicates that simple technical controls like blocking images are no longer sufficient. Organizations must adopt a defense-in-depth strategy, prioritizing rapid patching of zero-days and implementing strict access controls for network management interfaces.