eSentire's Threat Response Unit (TRU) compiles the following weekly intelligence overview, providing cybersecurity leaders with expert analysis and insights on the most important events of the past week along with important security tips.
Recent Threat Intelligence Advisories
Noteworthy News
N-central Vulnerability, CVE-2026-18577, Exploited
Bottom Line: N-able has disclosed an authentication bypass vulnerability in its N-central Remote Monitoring and Management platform (CVE-2026-18577); exploitation was confirmed affecting a limited number of N-able customers.
On August 2nd, 2026, N-able disclosed the high-severity N-central authentication bypass vulnerability CVE-2026-18577 (CVSS: 8.1). N-able N-central is a Remote Monitoring and Management (RMM) platform widely used by Managed Service Providers (MSPs) to centrally monitor, patch, and remotely access servers and endpoints across their entire customer base. The vulnerability relates to another N-central flaw, CVE-2026-18556 (CVSS: 7.4), that was disclosed along with security patches on August 1st. CVE-2026-18577 is the result of an incomplete fix for the previous vulnerability. N-able subsequently confirmed that exploitation of this flaw began as early as July 31st, 2026, prior to either CVE’s public disclosure.
Exploitation of CVE-2026-18577 could result in attackers bypassing authentication and account takeover in N-central, granting full administrative access to an N-central console. From an N-central administrative console, a threat actor can push scripts and automation jobs to managed endpoints, initiate remote control sessions to servers or workstations, and modify security-relevant configuration including user roles, accounts, and access policies. N-able stated that active exploitation was observed impacting a “limited number of customers”. CISA confirmed this exploitation, adding the flaw to its Known Exploited Vulnerabilities (KEV) catalog.
Following this disclosure, Huntress identified exploitation of CVE-2026-18577 “across multiple organizations”. These attacks involved high-level reconnaissance to identify key targets, process enumeration, and lateral movement. Sophos provided additional details on exploitation, including post-compromise activity. According to this report, threat actor targeted high-value assets including backup servers, domain controllers, and application servers. The actor created a new domain account named ‘veeam’ and reset the passwords of multiple existing domain administrator accounts, establishing privileged persistence. Network reconnaissance commands were executed to enumerate domain controllers and domain admin group membership. The actor then deployed a broad toolkit of remote access software to accessible endpoints, including AnyDesk, TacticalRMM, TeamViewer, RustDesk, SimpleHelp, and HopToDesk. Cloudflare Tunnel was deployed on multiple hosts, providing persistent, encrypted remote access that can survive reboots. When security tools were detected, the actor deployed PhantomKiller, an Endpoint Detection and Response (EDR) evasion tool. Attacks have not been attributed to a specific actor or group at this time.
No public Proof-of-Concept exploit code for CVE-2026-18556 or CVE-2026-18577 has been released at the time of writing.
eSentire Threat Intelligence Analysis:
The layering of multiple commercial RMM tools and a disguised tunnel indicates the actor prioritized redundant, persistent access over a single foothold. If signs of compromise are identified, it is critical that organizations hunt for other persistent mechanisms that may have been deployed. N-able has released a hotfix for CVE-2026-18577 that requires manual action on self-hosted deployments. Applying the fix is critical, but it will not remove other persistence mechanisms that were deployed through prior exploitation.
Exploitation of a platform trusted with administrative access across many downstream client networks illustrates the impact a single RMM vulnerability can have on the broader MSP ecosystem. A single authentication bypass on an MSP’s management console can translate into simultaneous access to every organization that MSP manages; similar attacks have been previously observed involving vulnerabilities in Kaseya VSA. At the time of writing, exploitation of the N-able vulnerabilities appears to be limited, but with publication on attacks and the release of a hotfix, the responsible threat actors may increase activity in an attempt to gain persistence before fixes are applied.
eSentire released an advisory addressing CVE-2026-18577 on August 4th and the Managed Vulnerability Service (MVS) has plugins in place to identify vulnerable devices. eSentire does not have any connection to N-able and does not use their products internally.
Russian APT Targeting Travelers to Deliver Malware and Steal Credentials
Bottom Line: The Russia-linked Storm-2945 has been identified performing an espionage campaign, targeting networks in the hospitality sector, to direct travelers to phishing pages or deliver malware.
On July 31st, 2026, Microsoft Threat Intelligence disclosed an ongoing cyber espionage campaign, designated CaptiveCrunch, that is being conducted by Storm-2945, a subgroup of the Russian state-sponsored threat actor Midnight Blizzard. Since May 2026, the threat actor has been targeting travelers by compromising or manipulating hospitality-sector captive portal infrastructure, enabling the redirection of internet traffic through attacker-controlled systems. Through these operations, the threat actor has been able to conduct credential theft, Adversary-in-the-Middle (AiTM) phishing, malware deployment, and cloud account compromise against victims worldwide.
According to Microsoft, Storm-2945 began conducting AI-assisted phishing operations in February 2026, leveraging device code authentication and OAuth phishing techniques to gain unauthorized access to Microsoft 365 environments. Beginning in May 2026, the group expanded its operations by manipulating DNS and HTTP traffic within networks that utilize captive portal technology, commonly found in hotels, conference centers, airports, and other hospitality venues.
When victims connect to a compromised or manipulated captive portal network, they may be redirected to attacker-controlled websites that present fraudulent browser updates, operating system updates, or network troubleshooting tools. These prompts are designed to convince users to download and execute malicious software. Storm-2945 employs the ClickFix technique, which provide detailed instructions to victims, guiding them through the process of downloading and running malware. In addition to malware deployment, some CaptiveCrunch landing pages redirect users to Microsoft’s legitimate authentication services and instruct them to enter an attacker-generated device code.
Microsoft identified multiple malware components used throughout the campaign, including the CornFlake Remote Access Trojan (RAT), the ChocoShell information stealer, and the FruitStone Command-and-Control (C2) management interface.
eSentire Threat Intelligence Analysis:
The CaptiveCrunch campaign presents a significant threat to organizations whose employees frequently travel and rely on public wireless networks. From an operational perspective, the hospitality sector offers an ideal environment for intelligence collection. Hotels, conference centers, airports, and event venues routinely host executives, government officials, consultants, defense contractors, technology professionals, and diplomatic personnel. By compromising shared captive portal infrastructure, Storm-2945 can gain access to a broad pool of high-value targets without individually targeting each victim organization.
Users connecting to unfamiliar networks may expect authentication requests, software update prompts, certificate warnings, and connectivity troubleshooting messages. As a result, malicious prompts delivered through compromised captive portals are more likely to appear legitimate than equivalent prompts delivered via email or standard phishing websites.
The incorporation of device code phishing into CaptiveCrunch is particularly significant. Device Code Authentication phishing involves a victim entering a threat-actor generated device code into a legitimate Microsoft Device Code Authentication workflow. Using the malicious code would provide threat actors with a valid access token, allowing them to access connected victim resources including accounts, emails, and cloud storage without requiring a password. Microsoft previously reported Midnight Blizzard’s use of device code phishing through Storm-2372 operations. eSentire previously reported on this technique in a February 2025 security advisory, which detailed device code phishing campaigns attributed to Russian state-sponsored groups including Storm-2372, CozyLarch, UTA0304, and UTA0307. eSentire's Threat Response Unit (TRU) also discussed device code and OAuth phishing trends further in the June 2026 TRU Intelligence Briefing.
To mitigate these threats, organizations should treat hospitality and guest wireless networks as inherently untrusted. Employees should use mobile hotspots, cellular connectivity, or enterprise-managed travel routers whenever possible rather than relying on public Wi-Fi. Users should never install software updates, browser updates, or certificates delivered through a captive portal or an unexpected web prompt. Organizations should also implement phishing-resistant Multifactor Authentication (MFA), passkeys, Conditional Access policies, and sign-in risk controls to reduce exposure to device code phishing attacks.
Increase in Token Jacking Attacks Involving Stolen AI API Keys
Bottom Line: Threat actors have been observed obtaining access to AI platform API keys and selling those keys at a discount on grey markets to other actors. This has left victim organizations bearing the financial impact of the unauthorized usage.
On August 6th, 2026, Palo Alto Network’s Unit 42 published a report on the growing attack trend called Token Jacking. The attack involves threat actors compromising corporate developer accounts to create or steal API keys relating to popular AI models. These keys are then sold to transfer stations, which are a “massive gray market of fly-by-night vendors” who sell this stolen AI computing capacity to third parties for a “fraction of the retail cost”. Unit 42 describes this technique as a “new AI-oriented spin on an old technique of stealing access to computing resources”, indicating that these attacks can result in staggering financial costs for victims.
Initial access to corporate developer accounts is often obtained via credentials harvested through phishing campaigns or information stealer malware. An attacker can use the access granted by these accounts to create new API keys, remove billing limits, or disable critical usage alerts and logging. The API keys are then sold to transfer stations, which then sell access to multiple AI services using the stolen credits. Unit 42 notes that while transfer stations may be used by developers who are seeking “inexpensive AI access”, these markets are also used by threat actors to conduct malicious activity.
API keys sold through transfer stations can be used to generate “tens of millions of API calls per day”, which can result in hundreds of thousands of dollars in usage fees for the victim organization. One case highlighted by Unit 42 indicates that an attack resulted in “nearly a million dollars in charges” before it was discovered and remediated. Based on billing cycles, victims may not become aware of Token Jacking until a large number of tokens have already been consumed.
eSentire Threat Intelligence Analysis:
Token Jacking is leveraging the growing popularity with organizations integrating AI and Large Language Models (LLMs) into their everyday workflows. As these API keys become increasingly common, paired with the growing costs for AI model usage, this creates additional financial opportunities for threat actors when conducting attacks. Purchasing cheap access to AI models for use within attacks is not only something that financially motivated attackers do, but Unit 42 also highlights that state-sponsored groups may also use transfer stations to train and refine their own models for a fraction of the cost. The growing popularity of these markets suggests that an increasing number of threat actors may target these API keys within attacks to keep up with increasing demand, suggesting that Token Jacking may become more common in the future.
Unit 42 states that developer accounts that may have been compromised via phishing or information stealer malware are being leveraged to conduct these attacks. Supply chain attacks via compromised npm packages and Visual Studio Code Extensions, which have been increasing throughout 2026, have also been leveraged for initial access in these campaigns. The usage of these stolen credentials underscores the critical impact that these types of infections can have. While the Token Jacking technique is not new, previous reporting indicates that the onus would be on the organization for securing their own credentials and API keys. This suggests that AI companies may not waive any bills incurred through these attacks and could result in major real-world impacts on victim organizations, such as operational disruption, derailed budgets, reputational damage, or even bankruptcy.
To protect against this threat, organizations should ensure that Multi-Factor Authentication (MFA) and Conditional Access policies are implemented on all accounts, to reduce the impact of stolen credentials. Organizations can also ensure that compute resources include network boundaries where possible, to restrict usage of tokens to corporate infrastructure. If information stealer malware or compromised npm packages are detected on a host, all credentials and secrets associated with the account should be rotated to minimize potential impact. eSentire's Threat Response Unit (TRU) is continuing to track the Token Jacking technique for additional information and detection opportunities.
About the threat briefings:
The threat briefing is a weekly intelligence overview for non-technical users. The Threat Intelligence team at eSentire investigates, analyzes, and organizes the most important events of the past week along with important security tips and redistributes the findings for quick reading. The main goal of this briefing is to improve the overall awareness of readers regarding cyber security.
