ZeroFox Weekly Intelligence Brief – September 12, 2026

ZeroFox Weekly Intelligence Brief – September 12, 2026

ZeroFox’s Weekly Intelligence Briefing highlights the major developments and trends across the threat landscape, including digital, cyber, and physical threats. ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecraft in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations. All sources used in this particular Intelligence product were identified prior to 6:00 AM (EST) on September 10, 2026; per cyber hygiene best practices, caution is advised when clicking on any third-party links.

Read the Brief

View the full report here

Xinbi Infrastructure Disrupted for Supporting Transnational Scam Operations

What we know:

• The U.S. Department of the Treasury has sanctioned Xinbi Guarantee, a Chinese-language marketplace for scam services, and seized its Telegram infrastructure and crypto wallets.
• The action also targeted two other entities for allegedly providing encrypted communications and cryptocurrency payment services that helped Xinbi maintain its criminal operations.

Thomson Reuters Breach Impacts U.S. and Canadian Court Systems

What we know:

• Thomson Reuters has reportedly confirmed unauthorized access to its court case management platform, C-Track, exposing court records across the United States and Canada.
• Separately, U.S. legal firms Quinn Emanuel and McDermott reported social engineering-related breaches involving sensitive files.

Scammers Extort Instagram Creators Using Fake Copyright Claims

What we know:

• Scammers are reportedly targeting Instagram creators with fraudulent copyright claims threatening content removals, account suspensions, or demonetization and demanding money to withdraw the claims.
• The activity has reportedly affected creators with large audiences, including one account with more than 1.5 million followers whose owner paid USD 50 in cryptocurrency to regain access after the account was temporarily suspended.