September’s attacker tradecraft shifts toward adaptive intrusion workflows

At a glance

What this is: Blackpoint Cyber’s September threat notes describe an attacker landscape built around adaptive intrusion workflows, including ClickFix, rogue RMM, blockchain-resolved command and control, and AI-assisted exploitation state management.

Why it matters: This matters because identity, session, and endpoint controls that focus only on fixed indicators will miss campaigns that keep changing infrastructure while preserving the same behavioural pattern.

Context

September’s attacker tradecraft shows a shift from static infrastructure to adaptive campaign operations. The core governance problem is no longer just initial access, but how defenders maintain visibility when malware, operator tooling, and tasking all mutate during the intrusion. In identity-heavy environments, that creates direct pressure on authentication telemetry, privileged session control, and detection around legitimate tools abused as entry points.

The article’s strongest signal is that attackers are increasingly exploiting trusted workflows rather than purely technical vulnerabilities. That intersects with IAM and NHI governance because identity material, session tokens, browser credentials, and remote support tools all become part of the intrusion path. The practical question for defenders is whether their controls observe behaviour across sessions and workloads, or only recognise known bad artefacts after the fact.

Key questions

Q: What breaks when attackers use trusted authentication flows for initial access?

A: Traditional password-centric controls break because the login itself is no longer the malicious act. A valid user action can become attacker access if the workflow is designed to be easy to approve and hard to distinguish from normal use. Detection has to focus on flow anomalies, not just failed logins.

Q: Why do adaptive intrusion campaigns increase identity and session risk?

A: They increase identity and session risk because once attackers obtain browser credentials, tokens, or remote access footholds, they can keep moving even when the original payload changes. That makes identity artefacts more valuable than the malware sample itself, and it shifts the control question toward how quickly sessions, credentials, and delegated access can be detected and invalidated.

Q: What are the signs that command and control is being resolved dynamically?

A: Look for implants that fetch tasking or panel addresses at runtime, especially when the destination changes without a new payload build. Other signs include unexpected outbound connections after an apparently benign launch, repeated contract or lookup queries, and host behaviour that stays stable while domains and IPs rotate underneath it.

Q: How should security teams respond when a campaign can keep changing infrastructure?

A: They should focus on containment decisions that do not depend on static indicators alone. That means isolating the host, reviewing nearby identity activity, looking for credential access and lateral movement signals, and validating whether remote-access tooling, persistence, or proxy behaviour suggests the intrusion is still active.

Technical breakdown

ClickFix and rogue RMM as initial access paths

ClickFix works because it turns user trust and normal support workflows into the delivery mechanism. Rogue RMM activity adds another layer by abusing legitimate remote administration tools that already have broad network reach and operator credibility. In both cases, the attack is not defined by a single payload. It is defined by a sequence that starts with social engineering, pivots through trusted software or interaction patterns, and ends in a host that looks ordinary until runtime behaviour is inspected. The defender problem is therefore less about spotting one lure and more about identifying when benign tools are being repurposed for control.

Practical implication: monitor for legitimate remote management tools and user workflow abuse as entry conditions, not just malware signatures.

Blockchain-resolved command and control changes the detection problem

When malware pulls its command and control address from a blockchain smart contract at runtime, static domain blocking loses much of its value. The implant can query a public contract, resolve a new backend, and continue operating without changing the malware sample. That makes infrastructure a moving target while the host behaviour stays relatively stable. The defender should treat the C2 resolution step as part of the malicious mechanism, not just the destination. This is especially relevant when the sample uses a bundled runtime or can swap panels without rebuilding the implant.

Practical implication: pivot detections toward runtime resolution behaviour, outbound tasking patterns, and host-level execution traces.

AI-managed exploitation is state management, not magic

The exposed PaperCut workspace suggests AI was used to coordinate exploitation stages, track retries, and manage failure states across many targets. That is more operationally important than whether the exploit itself was novel. If the campaign knows what has already failed, what should be retried, and which targets are still viable, then the attack becomes more scalable and less dependent on continuous human oversight. In practice, that collapses the distinction between automated reconnaissance and campaign orchestration. It also means defenders should expect more persistence in attack workflows even when individual exploit attempts fail.

Practical implication: look for repeated retry logic, failure classification, and stateful automation as indicators of coordinated exploitation.

Threat narrative

Attacker objective: The attacker objective is durable remote control that survives indicator changes, preserves access, and supports credential theft, proxying, and follow-on intrusion activity.

1. Entry occurred through ClickFix, rogue RMM, or a trojanized installer that delivered the first-stage payload under the cover of a trusted user workflow or legitimate-looking document.
2. The payload then established access by injecting into memory, creating persistence, or leveraging browser credentials and remote access channels to preserve operator control.
3. From there, campaigns moved into credential theft, proxying, Active Directory collection, or adaptive tasking through blockchain-resolved command and control infrastructure.
4. The objective was sustained intrusion that could survive infrastructure rotation, automate campaign state, and keep access available for follow-on exploitation or lateral movement.

Breaches seen in the wild

• Shai Hulud npm malware campaign: Shai Hulud campaign: npm malware exposed secrets on GitHub.
• CircleCI breach 2023: Malware stole a CircleCI engineer's SSO session; attackers exfiltrated customers' CI/CD secrets and keys, forcing a platform-wide rotation.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Behavioural persistence now matters more than indicator persistence: attackers are designing operations that can swap domains, panels, and payload names without changing the underlying intrusion pattern. That weakens controls that still depend on static blocking or one-time compromise indicators. The practical conclusion is that detection must follow execution flow, not just known bad infrastructure.

Trusted workflow abuse is becoming the dominant identity-adjacent entry pattern: ClickFix, rogue RMM, and helpdesk-style impersonation all succeed by borrowing legitimacy from tools people already accept. That matters for IAM and NHI programmes because the boundary between authorised access and abused trust is getting thinner. Teams should treat collaboration, remote support, and browser-based identity workflows as part of the attack surface.

Adaptive exploitation creates governance debt for response teams: when AI tracks retries, failures, and next steps, the campaign behaves more like a managed process than a single exploit. This is the named concept to watch: adaptive intrusion orchestration, meaning attacker coordination that preserves momentum even as infrastructure and payloads change. Practitioners should assume the campaign logic will outlive any one sample.

Credential and session artefacts remain the real prize: the article repeatedly returns to browser credential theft, possible PRT access, and token abuse because those assets let attackers move beyond the initial foothold. That is a direct reminder that identity telemetry is not just for authentication audits. It is one of the few ways to observe whether the intrusion is turning into durable access.

Host behaviour is the durable control surface: the more attackers abstract infrastructure behind blockchain lookups or managed tooling, the more defenders need process lineage, memory inspection, and anomalous execution telemetry. That is the practical control shift this month’s reporting points to: hunt the behaviour that remains when everything else rotates.

What this signals

Adaptive intrusion orchestration: attackers are starting to manage exploitation like an operational workflow, with retries, failure classification, and state tracking built into the campaign itself. That means defenders need to see the campaign as a changing process, not a single payload event.

The practical programme implication is that detection must move closer to behaviour, session activity, and process lineage. If infrastructure rotates faster than rules can be written, then the durable signals are memory injection, unusual remote support usage, and identity artefacts that appear after the first lure.

Identity teams should treat browser credentials, tokens, and remote session material as part of the intrusion surface, not just authentication plumbing. Once those artefacts are exposed, the attacker can keep operating even when the malware or command infrastructure has already changed.

For practitioners

• Hunt for trusted-workflow abuse Correlate ClickFix-style user interaction, rogue RMM installs, and unusual Run dialog activity with subsequent process creation and network egress.
• Prioritise runtime C2 detection Detect malware that resolves tasking dynamically through smart contracts, DNS lookups, or other runtime indirection rather than static destinations.
• Expand identity telemetry around browser and session artefacts Watch for browser credential theft, token use, possible PRT access, and anomalous sign-ins that follow remote-access or social-engineering chains.
• Instrument memory-injection and persistence paths Alert on memory-resident loaders, suspicious scheduled tasks, and registry Run key creation when they appear after user-facing lures or support-tool abuse.
• Treat failed exploit retries as campaign telemetry Track repeated failure states, retry loops, and target filtering because they may indicate AI-managed or operator-assisted exploitation workflows.

Key takeaways

• Attackers are increasingly combining trusted workflows, remote administration abuse, and dynamic command infrastructure to make intrusions harder to pin to a single indicator.
• The article’s strongest evidence points to behaviour that persists even when domains, payload names, and backend panels rotate.
• Defenders need controls that follow execution, identity artefacts, and runtime tasking because static blocking will not keep pace with adaptive campaigns.

Key terms

• Composite Intrusion Orchestration: Composite intrusion orchestration describes attacks assembled from separate specialist roles such as initial access, exfiltration, and extortion. The model matters because defenders must detect the handoff between stages, not just the name of the threat group, if they want to interrupt the campaign early.
• ClickFix: A browser-delivered social engineering technique that persuades a user to paste and execute a malicious command, usually through clipboard manipulation and a fake instruction sequence. The key risk is that the endpoint may see a normal user action even though the payload originated from a hostile webpage.
• Dynamic Command and Control: A command and control model where malware resolves its backend at runtime instead of hardcoding a single address. This gives the operator more flexibility and forces defenders to focus on runtime behaviour, host telemetry, and outbound tasking patterns rather than static infrastructure lists.
• Verification Artefact: A verification artefact is any record created during identity proofing, including images, scores, approval notes, or vendor returns. These artefacts are valuable for audit and fraud review, but they also create privacy and breach risk if they are retained too long or exposed broadly.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, secrets management, and identity lifecycle control. It helps practitioners connect identity risk to the broader security programme they run every day.