Hotel Wi-Fi attacks use custom malware to breach Microsoft 365 accounts

BleepingComputer security feed covering active exploitation, malware campaigns, credential and passkey theft, supply-chain compromises, data breaches, and critical vulnerabilities. Notable items include Midnight Blizzard/APT29 hotel Wi-Fi attacks against Microsoft 365 accounts, exploitation of N-able N-central authentication bypass CVE-2026-18577, a critical Rails Active Storage flaw with potential remote code execution, malware delivered through ClickFix and fake Roblox installers, malicious Arch AUR package takeovers, and multiple cryptocurrency theft incidents.