Verified status as of August 5, 2026
Checked by defend.network against the NIST National Vulnerability Database (NVD) and CISA’s Known Exploited Vulnerabilities catalog.
- CVE-2026-18577 in N-Able N-Central is listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog (added 2026-08-03; federal remediation due 2026-08-06). NVD rates it 8.1 (HIGH) on CVSS v3.1. NVD lists a patch reference.
TL;DR
Malware attackers are exploiting Google Password Manager's synced passkeys on Windows to hijack accounts without user verification [2, 7]. Russian state-sponsored actors (APT29) are compromising hotel Wi-Fi networks globally to steal Microsoft 365 credentials [6, 24]. N-able's RMM servers face active exploitation of authentication bypass CVE-2026-18577 [10, 16].
Executive Summary
- Google Password Manager's synced passkeys are vulnerable to three distinct malware-based attack paths on compromised Windows machines, allowing account takeovers without biometric or PIN verification.
- Microsoft linked a global hotel Wi-Fi campaign to Russian state-sponsored actor Midnight Blizzard (APT29), targeting travelers' Microsoft 365 accounts and device infection via custom espionage malware.
- N-able has confirmed active in-the-wild exploitation of CVE-2026-18577, an authentication bypass affecting both hosted and on-premises N-central RMM servers, with a secondary attack vector discovered post-patch.
- 18 malicious npm packages are delivering a cross-platform remote access trojan to Alibaba tool users in a targeted supply-chain attack against Chinese-speaking developer environments.
- Microsoft released a record 570 security patches, nearly triple the previous monthly record, addressing a surge in vulnerability disclosures.
Top Threats Today
1. Google Password Manager Passkey Hijacking via Malware
Severity: HIGH Affected: Technology
Unit 42 researchers have documented three distinct attack paths that allow malware running with ordinary user privileges on a compromised Windows machine to sign into passkey-protected accounts without requiring the victim's fingerprint, PIN, or any on-screen verification [1][2]. The attacks exploit the cloud synchronization mechanism in Chrome's Google Password Manager, allowing malware to extract and abuse passkey private keys offline or ⚠ perform silent account takeovers [1]. This vulnerability breaks the security model of passkeys, which are designed to prevent account compromise even when malware is present on the device [2].
Sources:[1] The Hacker News[2] BleepingComputer
Recommended Action
- Isolate systems showing signs of compromise (unusual login activity, unfamiliar device registrations in Google Account recovery options).
- Force password resets and enable Advanced Protection Program (APP) enrollment for high-value accounts.
- Implement endpoint detection and response (EDR) to monitor for suspicious process activity and keylogging patterns on Windows systems.
- Consider disabling Chrome password sync until Google releases a complete mitigation; use password managers with local-only storage as an interim measure.
2. Russian APT29 Hotel Wi-Fi Campaign Targeting Microsoft 365
Severity: HIGH Affected: Technology
Microsoft has linked a global campaign compromising hotel Wi-Fi networks to Russian state-sponsored threat actor Midnight Blizzard, also known as APT29 [1][2]. The operation uses custom malware to intercept travelers' login credentials and steal Microsoft 365 account access while infecting devices with espionage malware [1]. The campaign targets hospitality infrastructure worldwide, leveraging the trust travelers place in hotel networks to establish persistent access to corporate and personal cloud accounts [2].
Sources:[1] BleepingComputer[2] The Record
Recommended Action
- Enforce mandatory VPN usage when connecting to public Wi-Fi networks, with corporate VPN endpoints verified via certificate pinning.
- Enable passwordless sign-in (Windows Hello, FIDO2) for Microsoft 365 to prevent credential theft from being sufficient for account takeover.
- Implement conditional access policies to flag and block sign-ins from hotel network ASNs or geographic anomalies inconsistent with user travel patterns.
- Audit Microsoft 365 logs for unusual sign-in locations, new device registrations, and forwarding rule creation over the past 90 days.
3. N-able N-central RMM Authentication Bypass (CVE-2026-18577)
Severity: HIGH Affected: Technology
N-able has confirmed active exploitation of CVE-2026-18577, an authentication bypass vulnerability affecting both hosted and on-premises N-central remote management and monitoring (RMM) servers [1]. Over the weekend, the vendor discovered an additional attack vector that bypasses the initial patch, granting attackers administrator access to RMM infrastructure ⚠ [2]. RMM platforms control thousands of customer endpoints; successful compromise provides attackers with lateral movement and persistence across entire managed fleets [1].
Sources:[1] BleepingComputer[2] Dark Reading
Recommended Action
- Apply all N-able-issued patches immediately to both hosted and on-premises N-central deployments; verify patch installation across all servers.
- Isolate N-central instances from internet-facing access until confirmed patched; restrict administrative console access via VPN or zero-trust network access only.
- Review N-central audit logs for unauthorized authentication bypass attempts, unusual privilege escalations, and account creations (look for timestamps around the CVE disclosure date).
- Notify all customers managed by affected N-central instances of potential compromise; recommend credential rotation for accounts managed through those systems.
4. Malicious npm Packages Deliver Cross-Platform RAT to Alibaba Users
Severity: HIGH Affected: Technology
Researchers have identified 18 malicious npm packages that target users of Alibaba developer tools with a cross-platform remote access trojan in a sophisticated supply-chain attack aimed at Chinese-speaking development environments [1]. The packages exploit the trust developers place in npm registries to distribute malware capable of compromising multiple operating systems [1].
Sources:[1] The Hacker News
Recommended Action
- Scan all development systems and CI/CD pipelines for npm package installations from the past 60 days; cross-reference against npm security advisories for the malicious package names.
- Implement npm package approval workflows requiring security scanning (Snyk, npm audit) before installation into development and production environments.
- Isolate any systems that installed the malicious packages; treat as compromised and reimage before returning to service.
- Restrict npm downloads to approved package mirrors or private registries; disable public npm registry access where possible.
5. Microsoft Releases Record 570 Security Patches
Severity: MEDIUM Affected: Technology
Microsoft released software updates addressing at least 570 security vulnerabilities across Windows operating systems and other software products, nearly triple the number patched in its previous record-breaking monthly release [1]. The vendor attributed the surge to an increase in vulnerability disclosures [1].
Sources:[1] Krebs on Security
Recommended Action
- Prioritize patching based on CVSS score, exploitability evidence, and exposure in your environment; begin with CVSS 9.0+ vulnerabilities affecting internet-facing systems.
- Stagger patch deployment across test, staging, and production environments to identify regressions before full rollout.
- Monitor security advisories (CISA KEV, NVD) for any 570 patches flagged as actively exploited; fast-track those deployments.
Today’s Action Checklist
- ☐ URGENT: Audit Google Chrome password manager usage in your organization; communicate risk of passkey hijacking to end users and enforce VPN + EDR on Windows endpoints accessing sensitive accounts.
- ☐ URGENT: Verify all N-able N-central RMM instances are patched for CVE-2026-18577; isolate unpatched servers immediately and review authentication logs.
- ☐ URGENT: Force password reset and MFA re-enrollment for any corporate users who connected to hotel Wi-Fi in the past 90 days; check Microsoft 365 sign-in anomalies.
- ☐ Apply Microsoft’s 570 security patches in phased waves, prioritizing CVSS 9.0+ and any CISA KEV entries; validate each wave in test before production deployment.
- ☐ Scan development environments for the 18 malicious npm packages; implement npm package approval workflow and mirror controls to prevent future supply-chain injection.