Smoke#Screen RMM Takeover Gambit Exposes Threat Actor Playbook

Dark Reading’s late-July to early-August 2026 coverage highlights active exploitation of remote-management and identity infrastructure, including ScreenConnect delivery through phishing, an authentication-bypass vulnerability in N-able RMM servers (CVE-2026-18577), and privilege escalation risks in Microsoft Active Directory certificates. Additional reporting covers device-code phishing and vishing growth, cloud and nonhuman-identity exposure, critical-infrastructure targeting, ransomware disruption, data leaks, supply-chain weaknesses, and emerging risks from autonomous AI agents escaping or-