Hotel Wi-Fi M365 Breaches, Google Passkey Abuse, and Critical SiYuan and Adobe Flaws Lead August 4 Security News

Top Stories

Hotel Wi-Fi attacks target Microsoft 365 accounts

Microsoft has linked a campaign abusing hospitality Wi-Fi environments to Midnight Blizzard, also known as APT29, according to BleepingComputer’s reporting at BleepingComputer.

Why it matters:
Travel-heavy organizations, executives, consultants, sales teams, and managed service providers are especially exposed. Hotel and conference network access remains a soft spot because users expect captive portals, intermittent connectivity, and pop-up authentication prompts. Attackers can exploit that trust to stage credential theft or session abuse that leads to Microsoft 365 compromise.

What defenders should do now: - Review recent Microsoft Entra ID and Microsoft 365 sign-ins from travel periods. - Flag logins from unusual geographies, impossible travel, and atypical user agents. - Reassess Conditional Access rules for unmanaged devices and risky sessions. - Require phishing-resistant MFA where possible. - Brief traveling staff to avoid entering credentials into suspicious Wi-Fi prompts.

New “Pass-ta-key” attacks show malware can abuse Google-synced passkeys

Researchers described attacks that let malware on an already-compromised Windows device abuse Google Password Manager synced passkeys, according to BleepingComputer.

So what?
Passkeys remain a strong improvement over passwords, but this research is a reminder that endpoint compromise changes the threat model. If malware already runs in the user’s context, local protections, browser trust, and sync mechanisms become part of the attack surface.

Operational takeaway:
Do not interpret passkey rollout as a substitute for endpoint hardening. Security teams still need EDR, application control, browser hardening, and rapid malware containment.

Immediate actions: - Prioritize detection for infostealers, browser credential theft, and suspicious local process injection. - Limit local admin privileges. - Audit browser extension policies and unmanaged software installs. - Treat passkey-protected accounts on compromised endpoints as potentially exposed.

Senate stopgap extends key cyber authorities and the Technology Modernization Fund

A Senate stopgap measure extends key cyber authorities and the Technology Modernization Fund, as reported by Federal News Network via Google News.

Why practitioners should care:
For federal contractors and public-sector security teams, continuity in cyber authorities reduces near-term uncertainty around mission support, modernization, and defensive operations. It is not a direct incident, but it shapes funding and response capacity.

DOUBLECUP ClickFix service hides malware in browser cache images

A new Russian loader-as-a-service called DOUBLECUP uses ClickFix lures and hides malicious code in PNG images cached by browsers, delivering malware including CountLoader and a RAT called DeviceManager, per BleepingComputer.

Why this stands out:
This is another example of social engineering merged with living-off-the-user workflow. ClickFix-style prompts abuse user trust and routine browser behavior. Browser cache artifacts may also complicate straightforward triage if analysts focus only on downloaded executables.

Action items: - Hunt for suspicious command execution launched from browser-initiated workflows. - Train users that “fix your browser” or “paste this command to continue” prompts are hostile by default. - Inspect proxy, DNS, and EDR telemetry around browser cache access followed by script interpreter execution.

Fake Roblox Xeno launcher spreads infostealer and RAT malware

Threat actors are pushing fake Xeno Executor installers to infect Roblox players with credential theft and remote access malware, according to BleepingComputer.

Why SMBs and IT teams should care:
Even if your organization is not in gaming, this campaign reinforces a common enterprise risk pattern: consumer software, cheat tools, cracked apps, and “helper utilities” often become malware delivery channels on personal or unmanaged endpoints that later access business apps.

Critical Vulnerabilities

SiYuan: three critical SQL injection issues with unauthenticated or low-friction exposure paths

Several critical SiYuan vulnerabilities were disclosed with CVSS 10.0 ratings:

• CVE-2026-69083 affects SiYuan before v3.7.3 and enables SQL injection via fullTextSearchAssetContent, according to the advisory at GitHub.
• CVE-2026-69084 affects SiYuan <= v3.7.2 via /api/search/searchEmbedBlock, per GitHub.
• CVE-2026-69085 affects SiYuan before v3.7.3 via /api/filetree/searchDocs, per GitHub.

What makes these dangerous:
The disclosed descriptions indicate attacker-controlled SQL reaching read-write database handles, with some scenarios reachable through publish mode, RoleReader tokens, or anonymous access when publish authentication is disabled. For internet-exposed knowledge management or note systems, that is a serious data integrity and confidentiality risk.

What to do today: - Upgrade SiYuan to v3.7.3 or later. - Disable public exposure until patching is confirmed. - Review publish mode settings and confirm authentication is enabled. - Rotate any exposed tokens associated with publishing or reader access. - Inspect notebooks for unauthorized modification or deletion.

Adobe Campaign Classic: critical code execution and SQL injection issues

Adobe disclosed two critical Adobe Campaign Classic vulnerabilities:

• CVE-2026-48323, an improper neutralization issue that may lead to arbitrary code execution, per Adobe’s bulletin at Adobe.
• CVE-2026-48330, an SQL injection issue that could result in arbitrary SQL execution and potentially elevated access, also documented at Adobe.

Why this is high priority:
Adobe Campaign Classic often sits near customer data, marketing workflows, identity-linked records, and backend integrations. A no-user-interaction path to code execution or SQL abuse raises the stakes quickly.

Priority actions: - Apply Adobe’s security updates immediately. - Restrict administrative and application interfaces to trusted networks. - Review recent campaign configuration changes, unexpected jobs, and database anomalies. - Check for suspicious outbound connections from ACC hosts.

N-able N-central auth bypass is reportedly being exploited

N-able warns that CVE-2026-18577 is an authentication bypass flaw affecting hosted and on-prem N-central servers and is being exploited in attacks, according to BleepingComputer.

Why it matters:
RMM and management platforms are high-value targets. If compromised, they can provide broad administrative reach across customer environments.

Immediate actions for MSPs and admins: - Follow N-able guidance without delay. - Limit external exposure of management interfaces. - Review admin creation events, login logs, and suspicious downstream actions on managed assets. - Hunt for abnormal script execution, software pushes, or policy changes originating from N-central.

What Defenders Should Do Today

1. Hunt for travel-linked account abuse

Focus on users who recently connected from hotels, airports, conferences, or roaming networks.

Check for: - Impossible travel - New device registrations - Fresh OAuth consent grants - Atypical mailbox access - MFA fatigue or repeated failed prompts

2. Treat endpoint compromise as identity compromise

Today’s passkey research reinforces a familiar truth: once a Windows endpoint is compromised, the attacker may be able to abuse local trust stores, browser state, and synchronized credentials.

Priorities: - Accelerate EDR investigations on suspicious hosts. - Isolate systems showing signs of infostealers or browser tampering. - Reset sessions and re-enroll strong authentication after remediation.

3. Patch internet-facing apps first

The highest-risk disclosed flaws today affect products that may be directly reachable or hold sensitive data. Patch in this order where applicable: 1. N-able N-central 2. Adobe Campaign Classic 3. SiYuan exposed instances

4. Reinforce user guidance against ClickFix and fake tools

Two stories today rely heavily on user action: - ClickFix prompt abuse - Fake software installers

Short message for users: - Do not paste commands into PowerShell, Terminal, or Run boxes from websites. - Download software only from official vendor sites. - Report browser prompts that ask you to “fix,” “verify,” or “update” via copied commands.

Technical Deep Dive

Technical Notes: Microsoft 365 log review for suspicious travel-linked access

For Microsoft 365 and Entra ID, review: - Sign-ins from unusual ASN or country combinations - New device IDs during travel windows - Risky sign-in detections - Unexpected token refresh patterns after hotel stays

Example KQL pattern for sign-in review in environments forwarding Entra or sign-in data to Sentinel:

SigninLogs
| where TimeGenerated > ago(7d)
| where ResultType == 0
| summarize Countries=dcount(LocationDetails.countryOrRegion),
            IPs=dcount(IPAddress),
            Apps=make_set(AppDisplayName, 10)
            by UserPrincipalName
| where Countries > 1 or IPs > 5
| order by Countries desc, IPs desc

Look for sudden app access following travel-related sign-ins:

SigninLogs
| where TimeGenerated > ago(7d)
| where AppDisplayName in ("Office 365 Exchange Online", "Microsoft Teams", "SharePoint Online")
| project TimeGenerated, UserPrincipalName, IPAddress, AppDisplayName, ClientAppUsed, ConditionalAccessStatus
| order by TimeGenerated desc

Technical Notes: Browser and endpoint hunting for passkey abuse and infostealers

On Windows endpoints, investigate: - Unusual access to browser profile directories - Non-browser processes reading browser local data - Script interpreters spawned from browser parents - Credential store access shortly before suspicious authentication events

Example PowerShell to identify recent execution of common script engines:

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688; StartTime=(Get-Date).AddDays(-3)} |
  Where-Object {
    $_.Properties[5].Value -match 'powershell.exe|cmd.exe|wscript.exe|cscript.exe|mshta.exe|rundll32.exe'
  } |
  Select-Object TimeCreated, Id, @{Name='Process';Expression={$_.Properties[5].Value}}, @{Name='CommandLine';Expression={$_.Properties[8].Value}}

Technical Notes: Web log patterns for SQL injection attempts against SiYuan

If SiYuan is internet-accessible, inspect reverse proxy and application logs for requests hitting: - /api/search/searchEmbedBlock - /api/filetree/searchDocs - Full-text search asset content endpoints described in the advisory

Example grep patterns for common SQLi indicators:

grep -Ei 'searchEmbedBlock|searchDocs|fullTextSearchAssetContent|union select|regexp|;|--|/\*|\bor\b.+=' /var/log/nginx/access.log

Example suspicious request traits: - Semicolon-separated parameters - Encoded SQL metacharacters - Repeated search calls from a single IP - Requests without normal session behavior - Requests using publish or reader token flows

If you front SiYuan with Nginx, temporarily limit exposure:

location /api/search/ {
    allow 10.0.0.0/8;
    deny all;
}
location /api/filetree/ {
    allow 10.0.0.0/8;
    deny all;
}

Technical Notes: Adobe Campaign Classic and N-central triage

For Adobe Campaign Classic: - Review web server and app logs for unexpected template execution - Check database logs for unusual administrative queries - Inspect scheduled tasks, workflow definitions, and outbound connections

For N-central: - Review recent authentication events and admin changes - Audit script deployment history - Inspect managed nodes for commands or package installations triggered centrally

Example Linux network triage on application hosts:

ss -plant
journalctl -S today | grep -Ei 'auth|login|error|sql|template|workflow'
grep -RinE 'SELECT|INSERT|UPDATE|DELETE|xp_|union|sleep\(' /var/log 2>/dev/null

Final Take

The most important theme today is convergence: identity attacks, endpoint compromise, social engineering, and critical server-side vulnerabilities are all feeding the same outcome, which is durable access to business systems.

If you only do three things today: 1. Patch any exposed N-central, Adobe Campaign Classic, and SiYuan instances. 2. Review Microsoft 365 sign-ins tied to employee travel and unmanaged networks. 3. Push a user advisory on ClickFix prompts, fake installers, and untrusted downloads.

This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.