ThreatsDay: CEO Phishing Kits, 5K Dropbox Account Hacks, OAuth Traps + 17 More Stories
Threat actors exploit IT impersonation, OAuth, and phishing kits in various attacks.
This edition of ThreatsDay highlights several evolving attack vectors, including threat actors impersonating IT support via Microsoft Teams to gain remote access and deploy malware. The Spring Ring campaign specifically uses Teams for vishing, sometimes escalating to NTLM relay attacks. Additionally, the Gentlemen ransomware operation continues to expand with a sophisticated affiliate playbook, and the PhaaS platform Outsider shows resilience despite law enforcement actions.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Microsoft Teams?
Get an email when a new story names Microsoft Teams, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThreat actors are exploiting trusted collaboration platforms like Microsoft Teams to impersonate IT support staff, trick employees into granting remote access, and deploy malware — a tactic central to the Spring Ring vishing campaign. By abusing legitimate tools, attackers bypass traditional email-based phishing defenses and exploit user trust in internal-seeming communications. The escalation to NTLM relay attacks demonstrates how initial social engineering can rapidly pivot to credential theft and lateral movement. Meanwhile, PhaaS platforms like Outsider show that even law enforcement pressure cannot quickly dismantle industrialized phishing infrastructure, raising the stakes for organizations to harden defenses proactively.
What helps against this
How we list vendors
- Phishing-resistant MFA
A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.