Loading story…
Attackers exploited a flaw in Lenovo ID's email-verification process to create Lenovo identities using victims' email addresses without controlling their inboxes. Because Dropbox accepted Lenovo as a federated identity provider and matched its asserted email claims to existing Dropbox accounts, the attackers could obtain passwordless access to accounts, including accounts whose owners had not created or linked a Lenovo ID. The reported abuse occurred between August 4 and August 21, 2026.
Dropbox invalidated all Lenovo-authenticated sessions, removed Lenovo ID associations from affected accounts, and now requires users to enter their Dropbox password before enabling Lenovo authentication. Dropbox said its logs found no evidence that files were viewed or downloaded, though the unauthorized access could have exposed sensitive data; the number of affected accounts and broader scope of the issue were not disclosed.
See affected versions and whether adversaries are exploiting it.
8 events from the most recent confirmed update back to the earliest known activity.
Between August 4 and August 21, attackers allegedly registered Lenovo IDs using email addresses they did not control and used Dropbox's federated Lenovo login flow to access Dropbox accounts with matching email addresses. The reported attack did not require victims' Dropbox passwords or prior Lenovo-Dropbox account links.
Around August 31, Dropbox began sending breach-notification emails stating that unauthorized access had occurred between August 4 and August 21. Dropbox said its logs showed no evidence that attackers viewed or downloaded files, although notifications warned that files may have been accessed.
Dropbox stated that it reported the Lenovo-ID single sign-on breach to relevant data-protection regulators, in addition to emailing known affected users and offering support.
Lenovo stated that its customers were unaffected by the abuse of the legacy Lenovo-ID Dropbox login integration and said it was continuing to investigate the issue.
Dropbox published revised service terms that limit liability involving third-party products and customers' non-use of available mitigations, and expanded customer liability provisions. It also revised its privacy policy to explicitly permit analysis of stored files to improve services, with the FAQ referring to AI training.
Dropbox ended the reported abuse by expiring Lenovo ID-authenticated sessions and removing Lenovo-Dropbox associations on affected accounts. It also changed the flow to require entry of the Dropbox password before Lenovo ID authentication can be enabled for an existing account.
Dropbox stated that approximately 5,000 Lenovo ID-linked accounts without Dropbox two-factor authentication were affected. It later said files were viewed or downloaded in fewer than one-third of affected accounts, revising its earlier statement that logs showed no such activity.
Casa co-founder Jameson Lopp said he was among the Dropbox users affected by the Lenovo ID login abuse. He said the attackers attempted to open only a file named IMPORTANT.rtf, which he had encrypted locally before uploading.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
15 references tracked. Mallory keeps watching after this page renders.
bitdefender.com
Open sourcecysecurity.news
Open sourceteiss.co.uk
Open sourcecyberveille.ch
Open sourceheise.de
Open sourcedecrypt.co
Open sourcethecybersecguru.com
Open sourcenews.ycombinator.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A high-severity flaw in the preinstalled `com.oneplus.account` app on OnePlus 13R devices allows any installed malicious app to obtain an authenticated OnePlus Cloud session token. The exported `OPAccountProvider` content provider relies on `com.oneplus.account.READ_ACCOUNT_INFO`, a permission that third-party apps can declare because it is not restricted to software signed by OnePlus; an app can then invoke `get_account_oneplus_token` to retrieve `oldSecondaryToken` without user interaction beyond installation. The exposed token was accepted by the OnePlus Cloud API and was demonstrated to enable modification of victim account data, creating a path to account session takeover. Doyensec confirmed the token exposure remained in firmware `CPH2691_16.0.10.500(EX01)` and disclosed the issue publicly after OnePlus had not remediated it.
Sep 10, 2026
A series of security research articles and reports have highlighted critical vulnerabilities in web application authentication and account management processes, leading to account takeover (ATO) risks. One researcher discovered an insecure email verification flow in a self-hosted program, where changing the account email and then using a previously issued password reset link allowed an attacker to reset the password for the new email address, effectively taking over the account. This flaw was reported and resulted in a medium-severity bug bounty, demonstrating the real-world impact of improper session and token management during email changes. Another case involved a fintech startup where password reset emails were sent over HTTP instead of HTTPS, exposing the reset token to interception by attackers on insecure networks. This seemingly minor oversight could allow attackers to hijack any account by capturing the token, underscoring the importance of secure transmission for authentication links. Additionally, a common SSO misconfiguration was identified, where the identity provider failed to verify email ownership, enabling users from one organization to access data from another simply by sharing the same email address. This logic flaw in SSO implementation could result in complete account compromise across organizational boundaries. The technical details of these attacks reveal that vulnerabilities often stem from overlooked aspects of authentication flows, such as improper invalidation of tokens, insecure communication channels, and misconfigured trust relationships in SSO. The impact of these flaws is significant, as they can lead to unauthorized access, data breaches, and loss of user trust. Security researchers emphasize the need for rigorous testing of authentication and authorization mechanisms, including manual testing and review of edge cases like email changes and SSO integrations. The response from affected organizations has included prompt acknowledgment and remediation of reported issues, with some awarding bounties to the researchers. These incidents serve as a reminder that even well-established security controls like 2FA, SSO, and HTTPS can be undermined by implementation errors. Organizations are advised to review their authentication workflows, ensure all sensitive links are transmitted securely, and validate email ownership at every step. The findings also highlight the value of bug bounty programs and independent security research in uncovering and addressing critical vulnerabilities before they can be exploited by malicious actors.
Jul 1, 2026
A vulnerability in Microsoft Authenticator, tracked as **CVE-2026-26123**, allowed malicious Android and iOS apps to hijack the app’s unclaimed `ms-msa://` deep link and intercept authentication tokens during onboarding and sign-in flows. The flaw affected QR-code-based setup scenarios in which a user scanned a legitimate Microsoft QR code with a mobile camera and opened the resulting link, enabling an attacker-controlled app to capture login data with little visible warning to the victim. Researchers reported that the issue could lead to full takeover of Microsoft accounts and downstream access to services including **Outlook, OneDrive, Teams, Office, and Skype**. Microsoft acknowledged the vulnerability, assigned a CVE, and mitigated the issue, while coverage warned that the bug could expose login codes for large numbers of users on both major mobile platforms. Users and organizations were advised to update Microsoft Authenticator and ensure proper verified app-link handling as the primary remediation.
Jun 29, 2026