[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fA-_ypPjTHoI8E8CmeWx6GMXO_kr1Sevcm1jZeez7mIw":3},{"article":4,"iocs":55,"watch_terms":56,"solutions":57,"lesson":149},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"4bc1ddb2-1b69-4a55-b79e-85f10fc491f9","ThreatsDay: CEO Phishing Kits, 5K Dropbox Account Hacks, OAuth Traps + 17 More Stories","threatsday-ceo-phishing-kits-5k-dropbox-account-hacks-oauth-traps-17-more-storie-eae086","The worst part is how normal these attacks look. A call from IT. A shared file. A trusted app. A simple request to click “Allow.” Why break in when someone might open the door? That idea runs through this edition. Attackers use real tools, fake login pages, old account links, and software guides that point to unsafe downloads. One wrong letter in a web address can be enough. There is also","This edition of ThreatsDay highlights several evolving attack vectors, including threat actors impersonating IT support via Microsoft Teams to gain remote access and deploy malware. The Spring Ring campaign specifically uses Teams for vishing, sometimes escalating to NTLM relay attacks. Additionally, the Gentlemen ransomware operation continues to expand with a sophisticated affiliate playbook, and the PhaaS platform Outsider shows resilience despite law enforcement actions.","Threat actors exploit IT impersonation, OAuth, and phishing kits in various attacks.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002Fthreatsday-ceo-phishing-kits-5k-dropbox.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEhUcEnh-e0_L2Oz7JQcSCFBd90F29Z7_wHbJYiWOxWeZTeLLHbRZYK6vt1PrcUOgSFei7fxLMnP2lp0QyEOW2rzfcsnBFhayNHtKLPtHJFsu55w_GxuA3XLkZf-kleynMxXjc8zELZt7FBZFdqCAtesj3Fj148fwlGitAxZxu6t1wZDb7wgZQ1MR-Vmc4FL\u002Fs1600\u002Fthreats-main.jpg","2026-09-03T18:02:47+00:00","2026-09-03T20:00:25.208501+00:00",8,[17,20,22,24,27,30],{"name":18,"type":19},"Microsoft Teams","product",{"name":21,"type":19},"Node.js",{"name":23,"type":19},"Windows",{"name":25,"type":26},"ChenLun","threat_actor",{"name":28,"type":29},"Spring Ring","campaign",{"name":31,"type":29},"The Gentlemen ransomware operation","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":32,"icon":34,"name":35,"slug":36},null,"Threat Intelligence","threat-intelligence",[38,43,48,53],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":49},{"id":50,"icon":34,"name":51,"slug":52},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":54},{"id":32,"icon":34,"name":35,"slug":36},[],[18,21,23],{"controls":58,"vendors":140},[59,88,114],{"slug":60,"name":61,"problem":62,"products":63},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[64,72,80],{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"slug":89,"name":90,"problem":91,"products":92},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[93,98,106],{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":94,"product_name":95,"url":96,"description":97},"defender-for-office-365","Microsoft Defender for Office 365","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-office-365","Protection for Exchange Online, Teams and SharePoint against phishing, malicious links and attachments.",{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"abnormal","Abnormal AI","\u002Fvendor-logos\u002Fabnormal.png","abnormal-email-security","Abnormal Inbound Email Security","https:\u002F\u002Fabnormal.ai\u002F","API-based email security for Microsoft 365 and Google Workspace using behavioural models.",{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-email","Darktrace \u002F EMAIL","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Femail","Email security that flags messages deviating from normal communication patterns.",{"slug":115,"name":116,"problem":117,"products":118},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[119,126,132],{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":120,"product_name":123,"url":124,"description":125},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":127,"product_name":128,"url":130,"description":131},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",{"vendor_slug":133,"vendor_name":134,"vendor_logo":135,"product_slug":136,"product_name":137,"url":138,"description":139},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",[141,144],{"slug":81,"name":82,"logo_path":83,"roles":142},[143],"reported_by",{"slug":145,"name":146,"logo_path":147,"roles":148},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png",[143],{"slug":150,"title":151,"body":152,"framework_refs":153,"framework_notes":167},"it-impersonation-via-microsoft-teams-fuels-vishing-ransomware-and-oauth-attacks","IT Impersonation via Microsoft Teams Fuels Vishing, Ransomware, and OAuth Attacks","Threat actors are exploiting trusted collaboration platforms like Microsoft Teams to impersonate IT support staff, trick employees into granting remote access, and deploy malware — a tactic central to the Spring Ring vishing campaign. By abusing legitimate tools, attackers bypass traditional email-based phishing defenses and exploit user trust in internal-seeming communications. The escalation to NTLM relay attacks demonstrates how initial social engineering can rapidly pivot to credential theft and lateral movement. Meanwhile, PhaaS platforms like Outsider show that even law enforcement pressure cannot quickly dismantle industrialized phishing infrastructure, raising the stakes for organizations to harden defenses proactively.",[154,155,156,157,158,159,160,161,162,163,164,165,166],"CIS Control 4 – Secure Configuration of Enterprise Assets","CIS Control 6 – Access Control Management","CIS Control 14 – Security Awareness and Skills Training","CIS Control 17 – Incident Response Management","NIST SP 800-53 AC-2 – Account Management","NIST SP 800-53 AC-17 – Remote Access","NIST SP 800-53 IA-5 – Authenticator Management","NIST SP 800-53 SI-3 – Malicious Code Protection","NIST CSF DE.CM-1 – Network Monitoring","MITRE ATT&CK T1566.004 – Phishing via Service","MITRE ATT&CK T1557.001 – NTLM Relay","MITRE ATT&CK T1550.001 – Use Alternate Authentication Material: OAuth","GDPR Article 32 – Security of Processing",{}]