Threats Roundup: CEO Phishing Kits, Dropbox Account Compromises, and OAuth Token Theft

The latest threats roundup from The Hacker News reveals a pattern of attacks that exploit normal-looking scenarios to compromise targets. Campaigns include CEO phishing kits used in business email compromise (BEC) fraud, malicious Dropbox shared links that have affected over 5,000 accounts, and OAuth 2.0 token theft attacks that trick users into granting permissions to malicious applications. Additional stories cover typo-squatting campaigns relying on minor web address errors, fake software guides directing users to unsafe downloads, and the abuse of legitimate tools for malicious purposes. The common thread across these threats is the exploitation of trust in legitimate services and the use of social engineering to bypass technical controls. Attackers are leveraging real tools, fake login pages, old account links, and software guides that point to unsafe downloads. One wrong letter in a web address can be enough to redirect users to malicious sites. The report serves as a reminder that technical controls alone are insufficient without user awareness and verification processes.