LOCKED OUT, DROPBOXED IN: WHEN BEC THREATS INNOVATE

Summary from the TLDR InfoSec newsletter

Invictus IR identified a threat actor who established persistence by leveraging a third-party mail client to phish contacts. The attack was initiated with a seemingly legitimate Dropbox invoice that directed the victim to a phishing page, where their credentials were harvested. The attacker used these credentials to log into the eM Client mail client, register accounts with Dropbox and WeTransfer, and spam contacts with fake invoices to compromise additional victims.