ThreatsDay: CEO Phishing Kits, 5K Dropbox Account Hacks, OAuth Traps + 17 More Stories

The worst part is how normal these attacks look. A call from IT. A shared file. A trusted app. A simple request to click “Allow.” Why break in when someone might open the door? That idea runs through this edition. Attackers use real tools, fake login pages, old account links, and software guides that point to unsafe downloads. One wrong letter in a web address can be enough. There is also

Report facts: The article describes socially engineered attacks that look like routine IT calls, shared files, trusted apps, and OAuth “Allow” prompts, along with fake login pages and malicious downloads, targeting services such as Dropbox and other cloud/SaaS accounts. These attacks exploit user trust in familiar SaaS workflows and authorization flows rather than exotic exploits. RealGround analysis: As SaaS platforms increasingly embed AI assistants and agents, identical phishing and OAuth abuse patterns can be used to gain access to AI-connected accounts and data, or to authorize malicious apps that can drive or exfiltrate via AI features. Hardening AI-integrated SaaS workflows—especially OAuth flows, file-sharing, and app consent—through secure agent design, least-privilege scopes, and strong user verification can significantly reduce the blast radius when such attacks occur.