Dropbox Discloses 5,000 Accounts Compromised in August Hack

Dropbox has disclosed that about 5,000 accounts were compromised in August after attackers abused a legacy login integration with Lenovo ID that did not have two-factor authentication (2FA), an extra login step beyond a password. The company told Reuters that it identified unauthorized access affecting accounts linked to a Lenovo ID that lacked 2FA and terminated all sessions authenticated through a Lenovo ID. Lenovo said the issue involved a legacy integration between Lenovo ID and Dropbox that could be used to improperly authenticate certain Dropbox accounts. This is one of several threats covered in the latest weekly ThreatsDay bulletin from The Hacker News, which we are reporting on here for AEU Group readers.

Microsoft has warned of a human-operated intrusion campaign that abuses Microsoft Teams external collaboration to impersonate IT or help desk staff and trick users into granting an interactive remote session. Once remote control is established through remote monitoring and management (RMM) tools, which are legitimate programs used for IT support, the attacker uses PowerShell to download and silently install a malicious MSI package. That package stages a portable Node.js runtime and an obfuscated JavaScript implant that provides persistent command execution and command and control (C2), a server that sends instructions to compromised machines. Microsoft described the pattern as high impact because it gives an outside operator interactive access to internal infrastructure, including reconnaissance against Active Directory and movement toward domain controllers. A related operation tracked as Spring Ring by Palo Alto Networks Unit 42 used external Microsoft Teams accounts to pose as IT help desk for more than 150 employees across at least 10 companies between January and April 2026. In that campaign, which Unit 42 calls voice phishing (vishing), attackers tried to coerce victims into running RMM tools or custom malware, and in an advanced variant moved from a vishing call to a Microsoft NT LAN Manager (NTLM) relay attack aimed at an organization's domain controller. As many as 26 distinct attacker identities were identified behind the chat and call attempts.

Sophos has published a new report on The Gentlemen ransomware operation, tracked internally as Gold Sherwood, which has claimed 683 victims by the end of July 2026, including 169 victims added in July alone. The group uses a repeatable affiliate playbook: opportunistic initial access, rapid privilege escalation, legitimate remote access mechanisms, tool staging in trusted system paths, targeted data exfiltration, aggressive defense evasion, backup disruption, and ransomware deployment. Affiliates use native Windows utilities, commercial and open-source tools, BYOVD-based EDR killers (where BYOVD means bring your own vulnerable driver, a technique that loads a legitimate but flawed driver to disable security software), and backup service tampering. The Outsider phishing-as-a-service (PhaaS) platform, operated by a threat actor known as ChenLun, remains resilient after law enforcement took down a number of domains. Group-IB identified over 700 new phishing pages created with the kit within a month after Google filed a civil lawsuit against its operators, showing affiliates are still using it. Campaigns are delivered via SMS, and the kit includes a WebSocket connection for live keylogging and manipulation of multi-factor authentication challenges. ZeroBEC has detailed BlueKit, a turnkey phishing service targeting CEOs of financial-industry groups with browser-in-the-middle infrastructure and document-sharing lures. The service uses ZeroBot to screen bots, and after a credential theft flow selected victims are moved into a fake document-viewer workflow that delivers a legitimate ScreenConnect client configured for an attacker-controlled cloud instance. BlueKit access is advertised at $250 for seven days, $480 for 14 days, and $940 for 30 days, higher than Tycoon 2FA, Greatness, and Forg365 at roughly $350, $289, and $400 per month.

A government-themed tax notice campaign uses UAE- and India-themed tax assessment lures to persuade recipients to open a malicious disc image, according to iZOOlogic. The disc image contains a legitimate, validly signed commercial executable alongside a hidden, unsigned malicious dynamic-link library (DLL), a type of file that programs load to run code. This makes DLL sideloading the central mechanism: the trusted signed program loads the attacker's file. The malicious DLL acts as a loader and establishes multiple execution and persistence mechanisms. It contains three encrypted payloads: two decrypt to legitimately signed kernel drivers from unrelated commercial products, and the third is a persistence script. The attack chain paves the way for a Registry-resident second stage that connects to an external server over UDP. Separately, Intezer has detailed a fake privacy browser downloaded from a counterfeit site that turns remote attacker commands into simulated mouse and keyboard input, effectively a USB Rubber Ducky attack delivered over the internet. The site was reached through a sponsored search result after the victim mistyped a domain name, and the download was an MSIX installer signed through Microsoft's own infrastructure. Intezer said the attack evades endpoint detection and response (EDR) and sits at zero to two detections on VirusTotal, and the campaign has been tracked back to a similar operation from January 2016, meaning it has been active for at least a decade.

Cybersecurity researchers have analyzed the backend of Prince of Persia, also known as Indy, an Iranian hacking group known for deploying the Foudre and Tonnerre malware families to profile victims and harvest data from high-value targets. Whisper Security's Kaveh Azarhoosh told The Hacker News that the backend is self-authoritative, with each live command and control server also running the nameservers for its own domains. Researchers also found a dormant reserve of 58 domains registered and delegated to the group's own nameservers but not currently pointing at any server. Azarhoosh said they are staged, not live: the moment any one gains an address record, a new command server has gone live and is visible before the server does anything. In another supply-chain risk, a scan of 6,214 live domains belonging to defense contractors, Fortune 500, and Big Tech companies uncovered llms.txt or llms-full.txt files placed at the root of their websites alongside robots.txt. An Israeli stealth startup said these files are curated instruction sets for AI agents: what to read, which APIs to call, which packages to install, and which domains to trust. Of the 8,265 llms.txt and llms-full.txt files surfaced, 120 on different sites featured install instructions pointing to PyPI or npm package names and domains that had never been registered. The researchers selected a small set of package names from companies you have defi