A significant number of campaigns are now targeting executives with phishing kits designed to look like legitimate CEO communications. These are often paired with fake login pages that capture credentials in real time. In a separate incident, roughly 5,000 Dropbox accounts were compromised, likely through reused credentials or link-based attacks, and attackers are increasingly leveraging OAuth applications to gain persistent access. Once a user clicks "Allow" on a malicious OAuth app, the attacker has a foothold without needing the actual password.

The methods are deceptively simple:

• Attackers are using old, stale account links to bypass initial checks.
• Software tutorials and guides are being weaponized to point users to malicious downloads.
• Typosquatting remains effective, where a single misspelled character in a URL leads to a fully functional fake portal.

Because these attacks mimic standard user behavior, traditional security awareness often fails. The best defense is verifying out-of-band requests—especially those involving financial transactions or credential changes—and auditing connected OAuth applications on a regular basis.

Source: The Hacker News

Given the uptick in OAuth-related attacks, is your team actively auditing third-party app permissions, or are you relying on user reports to spot them?