ThreatsDay: CEO Phishing Kits, 5K Dropbox Account Hacks, OAuth Traps + 17 More Stories
- ID
- 21202
- Status
- summarized
- Published
- 04 Sep 2026, 2:02 AM
- Fetched
- 04 Sep 2026, 4:03 AM
- Provider
- The Hacker News
- Category
- security
- Original URL
- https://thehackernews.com/2026/09/threatsday-ceo-phishing-kits-5k-dropbox.html
- Source URL
- https://feeds.feedburner.com/TheHackersNews
Summary
- Score
- 6.0
- Created
- 04 Sep 2026, 4:07 AM
- Tags
- Audience
- developerssaas_founders
What happened
A weekly cybersecurity roundup covering CEO phishing kits, 5,000 Dropbox account compromises, and OAuth-based attacks, plus 17 additional stories. The standout detail is a Microsoft Teams vishing campaign (dubbed Spring Ring) that targeted 150+ employees across 10+ companies between January and April 2026, where attackers impersonated IT help desk staff via Teams external collaboration, then used RMM tools, PowerShell, a malicious MSI package, a portable Node.js runtime, and an obfuscated JavaScript implant to gain persistent C2 and pivot to domain controllers via WinRM.
Why it matters
If your team uses Microsoft Teams external collaboration or relies on OAuth 'Allow' flows for third-party app integrations, these are now confirmed attack vectors with documented enterprise breach chains. Builders should review whether external Teams access is enabled by default and audit OAuth consent prompts in their SaaS stack, since the attack path described goes from a single social-engineered click to domain controller access.
Discussion angle
The attack chain from a Teams chat to domain controller compromise via a Node.js implant is worth walking through live—specifically whether your org's Teams external collaboration settings and OAuth app consent policies would stop this at step one or fail open.