# Threat Intel Brief — August 6, 2026

TL;DR

  • Critical npm supply chain worm: ChainDrop malware compromised over 1,300 packages with 2 billion monthly downloads, self-propagating via stolen publishing tokens and stealing developer credentials from CI/CD pipelines.
  • Multiple critical vendor patches: HashiCorp Terraform MCP Server (CVSS 10.0 cross-tenant flaw), Veeam Service Provider Console (CVSS 9.5 unauthenticated credential exposure), and Gitea (CVE-2026-59774, unauthenticated file read) require immediate patching.
  • Active RMM exploitation: CISA added CVE-2026-18577 (N-able N-central) to KEV catalog after confirmed compromises; attackers pivoted to managed endpoints via Take Control feature.
  • Linux privilege escalation: CVE-2026-64531 (OVSwrap) grants local root access on default Linux distributions; public exploit available for ~800 kernel builds.
  • AI-augmented phishing surge: Kali365 and Greatness campaigns weaponize Microsoft OAuth device code flows to bypass MFA; macOS ClickFix operations now use browser fingerprinting to evade detection.

Critical Threats

ChainDrop npm Supply Chain Worm

What happened: A self-propagating credential-stealing worm compromised over 1,300 npm packages (including Keyv, Cacheable, flat-cache, and file-entry-cache) with a combined 2 billion monthly downloads. The malware executes automatically via preinstall hooks, steals npm tokens, GitHub PATs, AWS credentials, Kubernetes secrets, and HashiCorp Vault data, then republishes compromised packages with incremented versions to continue spreading. The attack originated from a compromised GitHub account of the Keyv maintainer and plants hooks in Claude Code and VS Code configurations.

Impact: Any developer workstation or CI/CD pipeline that installed affected versions between the initial compromise and removal is fully compromised. The worm's automatic execution bypasses traditional security reviews. Stolen credentials enable unauthorized repository access, package publishing, and cloud resource abuse. Organizations including Deliveroo, Ornikar, Picsart, Qlik, and ServiceTitan are confirmed affected.

Recommendations:

  • Audit all Node.js projects for affected packages using IoC lists from Wiz, StepSecurity, Aikido, Socket, or Ox Security immediately
  • Treat any system that installed compromised versions as fully compromised; rebuild from clean backups
  • Rotate all credentials accessible from affected environments: GitHub PATs, npm tokens, AWS keys, GCP/Azure credentials, Kubernetes secrets, Vault tokens, database passwords
  • Search network logs for npm-cache[.]com domain and GitHub repositories with description "Shai-Hulud: Here We Go Again"
  • Implement dependency allowlisting, lock file integrity checks (npm ci), and npm provenance verification

Gitea Unauthenticated File Read (CVE-2026-59774)

What happened: A critical vulnerability in Gitea versions 1.22.1 through 1.27.0 allows unauthenticated attackers to read arbitrary files accessible by the Gitea service account using crafted Org-mode markup in public repositories. The flaw can be escalated to remote code execution by reading app.ini to extract INTERNAL_TOKEN, injecting Git hooks via internal logger, and triggering hooks during anonymous clone operations.

Impact: CVSS 9.8 critical severity. Attackers can exfiltrate configuration files, credentials, secrets, and sensitive data without authentication. Self-hosted instances with public repositories are exposed; Gitea Cloud instances upgraded automatically. Post-compromise credential rotation required if exploitation suspected.

Recommendations:

  • Upgrade all self-hosted Gitea instances to version 1.27.1 immediately
  • Review web server logs for anonymous POST requests to /{owner}/{repo}/markup endpoint with Mode: file or Org-mode #+INCLUDE directives
  • If suspicious activity detected, rotate INTERNAL_TOKEN, OAuth credentials, JWT signing keys, and database passwords
  • Inspect repository hook directories for unexpected executable files
  • Temporarily disable public repository access if immediate patching is not possible

Veeam Service Provider Console Critical Flaws

What happened: Multiple critical vulnerabilities in Veeam Service Provider Console require immediate patching per CERT.BE advisory. CVE-2026-58073 (CVSS 9.5) allows unauthenticated attackers to impersonate managed agents and steal credentials; CVE-2026-58072 (CVSS 9.0) enables low-privilege arbitrary file write leading to RCE. Affects all version 9.x builds before 9.3.

Impact: MSPs and hosting providers managing customer backups face risk of credential theft and remote code execution. Particularly critical if console is internet-facing or accessible to untrusted networks. Successful exploitation provides full access to managed backup infrastructure and downstream customer environments.

Recommendations:

  • Upgrade Veeam Service Provider Console to build 9.3.0.35057 immediately if running any version 9.x before 9.3
  • Prioritize patching on internet-facing or multi-tenant deployments
  • Monitor Veeam VSPC logs for unusual agent authentication patterns or unexpected API access by Portal Administrator role
  • Review and restrict network access to VSPC until patched
  • Implement network segmentation to isolate VSPC from untrusted networks

Linux Kernel OVSwrap Privilege Escalation (CVE-2026-64531)

What happened: A memory corruption flaw in the Linux kernel's Open vSwitch datapath allows local users to gain root privileges on default-configured distributions. CVSS 7.8. Public exploit released with pre-built records for approximately 800 x86-64 kernel builds. Affects AlmaLinux, Alpine, Amazon Linux 2023, Arch, CentOS Stream, Debian, Fedora, Gentoo, Kali, Linux Mint, NixOS, openSUSE, Pop!_OS, Rocky Linux, and Ubuntu 22.04.

Impact: Critical risk in multi-tenant environments, shared hosting, or where untrusted users have local access. An attacker who compromised a single user account or container can escalate to full host control. No existing OVS bridge or running ovs-vswitchd required; module auto-loads when Generic Netlink family is resolved.

Recommendations:

  • Apply vendor-patched kernel immediately (Linux 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5 or distribution equivalents)
  • If Open vSwitch is not required, block openvswitch module loading: echo 'install openvswitch /bin/false' > /etc/modprobe.d/ovswrap.conf
  • Disable unprivileged user namespaces as interim mitigation: sysctl -w kernel.unprivileged_userns_clone=0
  • Monitor for unexpected openvswitch module loads and namespace creation by non-root users
  • Prioritize patching on multi-tenant systems, shared hosting platforms, and container environments

Threat Actor Activity

N-able N-central Active Exploitation (CVE-2026-18577)

CISA added CVE-2026-18577 to its Known Exploited Vulnerabilities catalog after confirmed customer compromises. The vulnerability (CVSS 8.2) is an incomplete patch for CVE-2026-18556. Attackers bypass authentication to gain administrative access to N-central servers, then abuse the Take Control RMM feature to pivot into managed endpoints. Post-exploitation includes domain controller reconnaissance, process enumeration, lateral movement, and persistence via Cloudflare tunneling (cloudflared). Threat actors use VPN exit nodes (Mullvad, NordVPN) to obscure origin. Federal agencies must remediate by August 6, 2026.

Defensive actions:

  • Upgrade N-able N-central to version 2026.3 HF1 immediately
  • Review Take Control session logs for connections from IPs 173.249.252.200, 87.249.138.34, 37.19.210.32, 68.235.46.214
  • Search managed endpoints' Documents folders for file named 'svchost.exe' and registered service 'Cloudflared'
  • Audit domain controllers for unauthorized access since initial compromise window

Kali365 Device Code Phishing Campaign

Kali365 targets US organizations through abuse of legitimate Microsoft authentication flows. The campaign tricks victims into approving attacker-controlled device codes on Microsoft's real login portal, obtaining OAuth access and refresh tokens that grant persistent access to Microsoft 365 resources. Over 80 public sandbox sessions recorded weekly. Targets include manufacturing, technology, healthcare, government, consulting, and managed security service providers.

Defensive actions:

  • Implement conditional access policies to restrict device code authentication flows
  • Monitor Microsoft 365 audit logs for unusual OAuth token issuance patterns and device code flow authentications
  • Deploy user awareness training on device code phishing tactics
  • Establish behavioral analytics to detect anomalous post-authentication activity

Greatness PhaaS Adds Device Code Phishing

The Greatness phishing-as-a-service platform ($289/month via Telegram) expanded capabilities to include adversary-in-the-middle attacks and device code phishing targeting Microsoft 365 accounts. Recent campaigns spoof RingCentral communications, leveraging whitelisted domains to bypass email security filters. Attackers replay stolen tokens from VPS and commercial VPN infrastructure to maintain persistent access for over two weeks.

Defensive actions:

  • Audit safe-sender lists and remove blanket domain exclusions; enforce strict SPF/DKIM/DMARC validation
  • Hunt for suspicious MFA-approved Microsoft 365 sign-ins from hosting providers, VPS infrastructure, or commercial VPN addresses
  • Monitor Microsoft Graph API enumeration activity for unusual bulk queries
  • Implement Conditional Access policies requiring compliant devices and blocking sign-ins from anonymizing services

DOUBLECUP Russian Loader-as-a-Service

DOUBLECUP is a Russian loader-as-a-service operation active since June 2026 using ClickFix social engineering lures to stage steganographic PNG images in browser cache. The service delivers CountLoader and a previously undocumented RAT called DeviceManager. Campaigns use fake CRM login pages (NetSuite, Odoo, HubSpot, Salesforce) and employ environmental keying with victim's public IPv4 address as cryptographic seed. Infrastructure exposed through open directory at 213.139.77[.]109:9090.

Defensive actions:

  • Monitor for suspicious clipboard operations and PowerShell/VBScript execution following browser activity
  • Implement network detection for steganographic image downloads followed by script execution
  • Detect scheduled task creation and LNK file modifications targeting browser shortcuts
  • Block connections to 213.139.77[.]109:9090 and implement DNS tunneling detection

Geopolitical Context

Ransomware Operator Sentencing

Maksim Silnikau, 40-year-old Belarusian creator and administrator of Ransom Cartel ransomware-as-a-service, was sentenced to 16 years in prison for attacks against at least 18 companies worldwide between 2021 and 2023. Victims included medical technology startups and law firms, with confirmed losses exceeding $6.7 million. Silnikau operated under aliases "J.P. Morgan," "xxx," and "lansky" on Russian-speaking cybercrime forums since 2005.

Snowflake Breach Guilty Plea

Canadian national Connor Riley Moucka (26) pleaded guilty to unauthorized access of Snowflake cloud storage accounts and data theft from at least 165 organizations affecting over 100 million individuals. The scheme, conducted with co-conspirator John Erin Binns, netted at least $2.5 million in Bitcoin from extortion and $495,000 from data sales. Victims included AT&T, Ticketmaster, Santander, and Los Angeles Unified. Moucka faces maximum 32-year sentence; sentencing scheduled October 27, 2026.

OpenAI Disrupts Cambodia-Based Scam Network

OpenAI disrupted a Cambodia-based scam operation originating from Poipet that used ChatGPT to facilitate investment, romance, gambling, and law enforcement impersonation fraud schemes. The network is linked to Southeast Asian threat actors and operates under conditions consistent with forced labor and human trafficking. The company banned a coordinated network of ChatGPT accounts and collaborated with Meta-owned WhatsApp on the investigation.

Recommended Actions

Immediate (0-24 hours)

  • ChainDrop npm worm: Audit all Node.js projects for affected packages; treat compromised systems as fully breached; rotate all credentials
  • Gitea CVE-2026-59774: Upgrade to version 1.27.1; review logs for exploitation attempts
  • Veeam VSPC: Upgrade to build 9.3.0.35057; prioritize internet-facing deployments
  • N-able CVE-2026-18577: Upgrade to version 2026.3 HF1 by August 6, 2026 (FCEB deadline)
  • Linux CVE-2026-64531: Apply patched kernel or block openvswitch module loading
  • CISA KEV: Patch IBM Langflow, N-central, and Apache Tomcat flaws within three days

24-72 hours

  • cPanel CVE-2026-58048: Update to patched versions (11.110.0.137, 11.118.0.71, 11.126.0.78, 11.134.0.48, 11.136.0.32); revoke MySQL feature from cPanel users if immediate patching not possible
  • Paperclip AI: Update to v2026.416.0; disable open registration on network-accessible instances
  • TP-Link Omada: Update all Controllers, Gateways, Switches, Access Points to latest firmware; verify controllers not directly exposed to internet
  • Terraform MCP: Update to version 1.1.0 or later if running Streamable HTTP mode
  • Django: Patch to version 6.0.8 or 5.2.17 if using GeoDjango with spatial fields

This week

  • macOS ClickFix: Block known IOC domains; monitor for Terminal-initiated curl or bash commands retrieving remote scripts
  • XCSSET malware: Audit Xcode projects for unexpected build scripts; scan developer workstations for ad hoc-signed applications
  • Open VSX extensions: Audit developer workstations for 77 malicious extension IDs; block mangorbit[.]com domain
  • n8n API tokens: Audit for exposed API tokens in public GitHub commits; rotate compromised credentials
  • SMOKE#SCREEN: Restrict MSI/EXE execution via application control; audit RMM tool usage and baseline legitimate ScreenConnect connections

Watch List

  • Palo Alto NOVA AI: Over 14,000 previously unknown vulnerabilities discovered in open-source software supply chain; monitor vendor advisories for affected dependencies
  • Google ADK workflows: Prompt injection vulnerability in AI agent workflows; audit GitHub Actions workflows processing untrusted input
  • NullReceiver npm packages: Trojanized bianira-ui and fluid-type-ui packages use blockchain to hide C2 IPs; block 166.88.134[.]62
  • COLDCARD phishing: Campaign exploits wallet vulnerability fears to deploy ScreenConnect RAT; block coldcardteamnews.com, coldcardcompliance.com
  • Oracle khunt toolkit: SQL injection exploited to deploy post-exploitation toolkit inside database; audit database accounts for excessive privileges

Sources

  • BleepingComputer (multiple articles)
  • The Hacker News (multiple articles)
  • Microsoft Security Blog
  • CERT.BE (Belgium)
  • Palo Alto Networks Unit 42
  • CISA Known Exploited Vulnerabilities Catalog

---

*This report covers threat intelligence from August 4-6, 2026. All CVE identifiers verified against NIST NVD and vendor advisories. Organizations should prioritize patching based on asset criticality, exposure, and available exploit code.*