Threats Tagged 'remote access'

A phishing campaign impersonates employees of a US company by sending emails with attached PDFs claiming to be transaction receipts. The PDF prompts users to install a fake Adobe Flash Player update, which downloads and runs a VBS script with administrator privileges. This script displays a decoy receipt and silently installs ScreenConnect remote management software, establishing persistent remote access. Attackers leverage this access to execute commands, transfer files, and deploy additional payloads using legitimate administrative tools in a Living-off-the-Land technique.

An authentication bypass vulnerability, CVE-2026-18577, affecting N-able N-central Remote Monitoring and Management platform has been actively exploited since August 1, 2026. This vulnerability emerged after an incomplete fix for a previous authentication bypass issue CVE-2026-18556. The flaw allows remote unauthenticated attackers to bypass authentication mechanisms and gain administrative control over vulnerable N-central servers. Attackers have exploited this vulnerability to leverage the platform's Take Control functionality for remote access to managed endpoints and deployed Cloudflare Tunnel (cloudflared) to establish persistent remote access. Given that N-central is widely used by managed service providers and enterprise IT teams with extensive administrative privileges, successful compromise provides attackers an efficient pathway to compromise downstream managed systems. CISA added this vulnerability to its Known Exploited Vulnerability catalog on August 3, 2026.