5,000 Dropbox accounts compromised; OAuth and Teams phishing campaigns active

Affected Systems

Multiple attack vectors affecting organizations using Microsoft Teams, Dropbox (5,000+ accounts compromised), OAuth-enabled applications, and remote management tools. Campaigns target employees across financial services, government sectors, and general enterprise environments. Specific threats include The Gentlemen ransomware (683 victims), Spring Ring vishing operation (150+ employees at 10+ companies), Outsider PhaaS platform (700+ phishing pages), and BlueKit CEO-targeting kit.

Exploitation Status

Active exploitation confirmed across multiple campaigns. Microsoft Teams external collaboration abuse is ongoing with human-operated intrusions. Spring Ring vishing campaign targeted 150+ employees January-April 2026. The Gentlemen ransomware added 169 victims in July 2026 alone. Outsider PhaaS remains operational despite law enforcement takedown. BlueKit actively targeting financial industry CEOs. No specific CVEs; attacks leverage social engineering and legitimate tool abuse.

Business Impact

High-impact social engineering campaigns are bypassing technical controls by exploiting user trust in legitimate platforms (Teams, Dropbox, OAuth apps). Attackers gain interactive remote access, deploy RMM tools and malware, conduct AD reconnaissance, capture screenshots, and pivot to domain controllers. Financial and credential theft via browser-in-the-middle attacks targeting executives. Ransomware affiliates demonstrate repeatable playbooks with rapid privilege escalation, EDR evasion, and backup disruption. Organizations face data exfiltration, persistent C2 implants, and potential domain compromise from seemingly benign IT support interactions.

Urgency

🟠 Within 24 hours

Recommended Actions

• Restrict Microsoft Teams external collaboration: disable or require admin approval for external access, monitor Teams chat logs for unsolicited IT support contacts, and educate users to verify support requests through established internal channels only
• Audit and revoke OAuth application permissions: review third-party app consents across Microsoft 365 and Google Workspace, remove unused or suspicious OAuth grants, and implement conditional access policies requiring admin consent for high-privilege apps
• Block or monitor RMM tool execution: restrict AnyDesk, TeamViewer, ScreenConnect, and similar tools via application control policies unless explicitly approved; alert on PowerShell downloading MSI packages or staging Node.js runtimes in user directories
• Harden domain controller access: enforce MFA for all privileged accounts, disable NTLM where possible (enable Extended Protection for Authentication), monitor WinRM lateral movement, and alert on unusual DC reconnaissance activity or Kerberos ticket requests
• Reset credentials for compromised Dropbox accounts: force password resets and MFA enrollment for affected users, audit file sharing activity and external collaborators, and review access logs for unauthorized downloads or API usage