ThreatsDay: CEO Phishing Kits, 5K Dropbox Account Hacks, OAuth Traps + 17 More Stories
Microsoft warns of Teams IT-impersonation intrusions deploying Node.js implants; Spring Ring vishing hit 150+ employees across 10 companies; The Gentlemen ransomware claims 683 victims.
Microsoft warned of a human-operated campaign abusing Teams external collaboration to impersonate IT help desk staff, deploy malicious MSI packages staging Node.js runtimes and obfuscated JavaScript implants, then pivot to domain controllers over WinRM. Unit 42 documented the Spring Ring vishing operation targeting over 150 employees across at least 10 companies using 26 attacker identities, including an NTLM relay variant against domain controllers. Sophos reported The Gentlemen ransomware (Gold Sherwood) reached 683 total victims by end of July 2026, adding 169 in July, with a playbook using BYOVD-based EDR killers and backup tampering. Group-IB found the Outsider phishing-as-a-service platform created 700+ new phishing pages within a month despite law enforcement takedowns.
- Microsoft: Teams social engineering leads to RMM/PowerShell deployment of obfuscated JS implant with C2 and AD reconnaissance
- Spring Ring vishing hit 150+ employees at 10+ companies; advanced variant used NTLM relay to domain controllers
- The Gentlemen ransomware (Gold Sherwood) claimed 683 victims by end of July 2026
- Outsider PhaaS survived takedowns, adding 700+ phishing pages in a month via Telegram distribution
- BlueKit browser-in-the-middle service targets financial-sector CEOs at $250-$940 price tiers
- Tags
- browser-in-the-middledll-sideloadingmicrosoft-teamsphishing-as-a-serviceransomwarespring-ringthe-gentlemenvishing
- Threat actors
- The GentlemenGold SherwoodSpring RingChenLun
- Malware
- BlueKitThe Outsider
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | crpx0.su | the group has advertised the operation on a clearnet site ("crpx0[.]su/v3.txt") as an offensive control panel to manage compromi |
| domain | www.mxsetuplogi.com | fake "privacy browser" downloaded from a counterfeit site ("www.mxsetuplogi.com") that turns remote attacker commands into simulated mouse |
From the original article
12 min read at thehackernews.com
The worst part is how normal these attacks look. A call from IT. A shared file.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.