A new ThreatsDay roundup from The Hacker News highlights a pattern defenders should not ignore: many of the week’s most serious incidents did not rely on exotic zero-days. They relied on trust. Attackers posed as IT staff, abused collaboration tools, pushed fake shared documents, reused legitimate remote management software, and took advantage of account connections that users may have forgotten existed.

For security teams, the lesson is practical. Identity, remote access, and third-party app permissions now deserve the same attention as malware signatures and vulnerability patching. If a user clicks “Allow,” accepts a remote session, or installs a trusted-looking utility from the wrong source, the attacker may be inside before traditional controls recognize a breach.

Social engineering is moving into trusted collaboration channels

One of the most important themes is the abuse of Microsoft Teams and similar business communication platforms. Microsoft has warned about attackers using external collaboration features to impersonate IT or help desk personnel. The goal is to convince employees to grant interactive remote access. Once that access is approved, the intrusion can move quickly: remote monitoring and management tools, PowerShell, malicious installers, JavaScript implants, Active Directory reconnaissance, screenshot capture, and lateral movement toward high-value systems such as domain controllers.

A related campaign known as Spring Ring reportedly used Microsoft Teams calls and chats to target more than 150 employees across at least 10 organizations. The lure is effective because it resembles an ordinary support interaction. Employees are conditioned to trust urgent help desk messages, especially when the request appears inside a tool they use every day.

Organizations should restrict external Teams communication where it is not required, clearly label outside participants, and create a simple verification process for support requests. Help desk staff should never ask users to install remote tools or run commands through unsolicited chats. Security teams should also monitor for newly installed remote access tools, unusual PowerShell activity, and first-time WinRM connections from workstations.

Phishing-as-a-service keeps lowering the barrier to entry

The roundup also described continued activity around phishing-as-a-service platforms. Outsider reportedly continued producing phishing pages even after law enforcement action disrupted some of its domains. BlueKit, another reported phishing service, is aimed at executives in the financial sector and uses browser-in-the-middle infrastructure to steal credentials and sessions. In selected cases, victims were moved from a fake document viewer into installation of a legitimate ScreenConnect client configured for attacker access.

This is a reminder that multi-factor authentication is necessary but not always sufficient. Browser-in-the-middle phishing attempts to capture live sessions, not just passwords. Defense should include phishing-resistant MFA such as FIDO2 security keys for executives and administrators, conditional access policies, impossible-travel detection, session revocation workflows, and monitoring for unfamiliar device registrations.

Security awareness should also become more specific. Generic “do not click links” training is not enough. Users need examples of fake shared documents, fake IT calls, OAuth consent prompts, and legitimate remote tools being used maliciously.

OAuth and legacy integrations can outlive password resets

The FBI warning on OAuth consent phishing is especially relevant for incident response teams. In this technique, attackers trick victims into approving a malicious application. Once consent is granted, the attacker may retain access through tokens and app permissions even if the user changes their password.

That same persistence problem appears in the Dropbox disclosure discussed in the roundup. Dropbox said about 5,000 accounts were compromised through accounts linked to a Lenovo ID that did not have two-factor authentication enabled. Lenovo described the issue as tied to a legacy integration that could be used to improperly authenticate some Dropbox accounts.

The operational takeaway is straightforward: account recovery must go beyond password resets. After a suspected compromise, revoke active sessions, rotate tokens, remove unknown OAuth applications, disable unused identity links, and require MFA on connected accounts. Administrators should periodically review third-party app grants and legacy SSO or account-linking integrations, especially those created years ago and no longer actively maintained.

Ransomware operators continue to favor practical tradecraft

Several ransomware items in the roundup point to a familiar playbook: opportunistic access, rapid privilege escalation, abuse of native Windows utilities, data theft, backup disruption, and encryption. The Gentlemen ransomware operation, tracked by Sophos as Gold Sherwood, reportedly claimed hundreds of victims by the end of July 2026. VantaCore, assessed as a rebrand of a pro-Ukraine group, has reportedly targeted Russian companies using custom malware, a loader, a RAT, and a BYOVD technique to interfere with security tools. CRPx0 was described as a ClickFix-delivered ransomware-as-a-service operation using fake update prompts and reCAPTCHA-style lures to trick users into running copied commands.

Defenders should assume ransomware prevention is also identity and operations hygiene. Protect backups with immutability and separate credentials. Alert on attempts to stop backup services, modify endpoint protection, add Defender exclusions, or execute suspicious commands copied from a browser. Block ordinary users from installing remote management tools, and use application control for scripting engines where feasible.

Supply-chain and “trusted software” abuse requires stricter defaults

The report also covered attacks involving signed software, DLL sideloading, fake Electron applications, and legitimate deployment tools. These incidents are hard to defend against because they blend into normal administration and software installation workflows. A fake privacy browser delivered through malvertising, trojanized Electron apps shared through repositories, and Faronics Deploy chained to ScreenConnect all show how attackers exploit trust in familiar installers and platforms.

Companies should tighten software acquisition rules. Users should download tools only from verified vendor pages or managed company portals. Endpoint teams should alert on uncommon signed binaries loading unsigned DLLs, new ScreenConnect or similar remote access clients, MSIX installers from ad-driven paths, and unexpected Electron applications accessing credential stores.

Priority actions for security teams this week

Start by reviewing external collaboration and remote support procedures. Then audit OAuth grants, legacy identity links, and connected cloud applications. Require phishing-resistant MFA for executives, administrators, finance staff, and anyone with broad data access. Inventory remote access software and block unapproved variants. Finally, test incident response playbooks to ensure they include token revocation, session termination, remote tool removal, and backup recovery validation.

The common thread is not just phishing; it is delegated trust. Attackers are looking for any place where a user, application, integration, or support workflow can open the door for them. The best response is to reduce standing access, verify requests through separate channels, and continuously inspect what already has permission before granting anything new.

Source: The Hacker News