The Fake IT Call and the Click That Opens the Door
Attackers are skipping the smash-and-grab, choosing polite phone calls, spoofed login pages and poisoned software guides to walk in through the front door.
Key points
- Attackers are relying on social tricks: fake IT calls, cloned login pages and OAuth consent prompts that look routine.
- One recent wave hit around 5,000 Dropbox accounts through a Lenovo signup flaw, not stolen passwords.
- Phishing kits aimed at chief executives are sold ready-made, with fake Microsoft and Google sign-in screens.
- A single mistyped letter in a web address can send users to a malicious clone of a real service.
- Old, forgotten app permissions on personal accounts are being used as a quiet way back in.
The hackers aren't really hacking anymore. They're knocking.
A staffer gets a phone call from someone claiming to be from the IT helpdesk. A colleague shares a document that looks fine. An app the user vaguely remembers installing asks, politely, to reconnect. Click Allow, and the intruder is inside. No exploit code, no zero-day (a software flaw the maker didn't know about). Just a person being helpful.
That pattern runs through a new roundup from The Hacker News covering more than twenty recent incidents.
How are the attackers getting in without "hacking"?
They're using the tools and habits people already trust: real cloud apps, real login screens, real-looking emails. The trick is convincing the user to hand over access voluntarily.
One common route is phishing, where criminals send fake messages to trick people into typing their password into a copycat website. Entire phishing kits, pre-built websites that mimic Microsoft or Google sign-in pages, are sold on criminal forums and tuned specifically for chief executives and finance staff. Buy the kit, point it at a target list, wait for logins.
Another route is OAuth abuse. OAuth is the system behind those "Sign in with Google" or "Allow this app to access your calendar" prompts. Attackers register an app with an innocent-sounding name, send a link, and ask the victim to approve it. Once approved, the app can read mail or files without ever needing the password again. Changing the password doesn't kick it out. We reported in August on two campaigns that sent over four million spoofed application identities at Microsoft's sign-in system before triggering meaningful alerts, and the same logic applies here.
What happened with the Dropbox accounts?
Roughly 5,000 Dropbox accounts were taken over recently, but credential stuffing (trying username and password pairs leaked from unrelated breaches) wasn't the whole story. As our 2 September report found, a weakness in how Lenovo verified email addresses let an attacker create fake Lenovo IDs and walk straight into those accounts without a password at all.
Some takeovers also relied on stale session links, the tokens that keep you logged in on old devices you forgot about. If those never expire, they're a quiet back door.
What about typosquatting and fake software guides?
Typosquatting is when a criminal registers a web address one letter off a real one. A user searching for a software download follows a top-ranking guide, clicks what looks like the official link, and installs a tampered version. The guide itself, sometimes on a blog or a Q&A site, was planted for exactly this purpose.
| Tactic | What it looks like | What it costs the victim |
|---|---|---|
| CEO phishing kit | Fake Microsoft or Google login page | Email and file access |
| OAuth consent trap | "Allow this app" prompt from an unknown app | Ongoing mailbox access |
| Lenovo signup abuse | Silent Dropbox login from a new location | Files stolen or encrypted |
| Typosquatted download | Software guide linking to a look-alike site | Malware on the device |
What should ordinary users actually do?
Slow down on two things: calls that ask you to click or install something, and any prompt asking an app for access to your email or files. If IT calls, call back on a number you already have rather than trusting the one offered. Review the apps connected to your Google or Dropbox account every few months and remove anything unrecognised. Use a password manager so you aren't reusing the same credentials across sites.
None of this is glamorous. That's the point. The attackers are betting you're busy, and so far the bet keeps paying off.
