ThreatPaper

#account-takeover

2 cases

Dropbox via Lenovo ID: How a Third Party's Email Check Became a Password Bypass for 5,000 Accounts

For 17 days in August 2026 an attacker registered Lenovo IDs on other people's email addresses and signed straight into their Dropbox accounts. Lenovo's verification was the flaw; Dropbox's willingness to trust it without a password was the breach.

Data BreachIdentity Theft
Sponsored-Link Bank Phishing: How a Google Ad Above the Real Login Took $14.6 Million

A Russian web developer extradited from Georgia faces trial over a 2023–25 operation that bought search ads impersonating banks, harvested 5,000+ logins and 2FA codes on cloned pages, and tried to wire $5.58 million from one Atlanta company in a day. The mule LLC was registered in Georgia two months

Financial FraudSocial EngineeringIdentity Theft