Threats Day: CEO Phishing Kits, 5K Dropbox Account Hacks, OAuth Traps + 17 More Stories
Summary: Microsoft warned of a human-operated campaign using Microsoft Teams external collaboration to impersonate IT and help desk staff, establish remote sessions via RMM tools, then use PowerShell to install a malicious MSI that stages a Node.js runtime and obfuscated JavaScript implant for persistent command execution and C2. Palo Alto Networks Unit 42 reported the Spring Ring operation used external Teams accounts to pose as help desk personnel against more than 150 employees at at least 10 companies between January and April 2026, with 26 distinct attacker identities identified.
Bottom line: The entry point is a chat message from an account your users believe is internal IT, and the payload arrives through trusted Windows binaries and legitimate remote management tools, so the operator is inside your infrastructure before anything looks anomalous. With 26 attacker identities behind the Spring Ring attempts alone, blocking a single account does not close the door.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026