Dropbox Abused in New Phishing, Malspam Scam to Steal SaaS Logins

Darktrace researchers observed a Dropbox-themed phishing and malspam campaign that sends emails from seemingly legitimate Dropbox addresses containing links to PDFs; those PDFs host links to a malicious domain (mmv-securitytop) that redirects users to a fake Microsoft 365 login page to harvest SaaS credentials. Attackers were observed bypassing MFA using valid tokens, creating mailbox rules to hide malicious messages, and using VPN services to obscure their locations, resulting in suspicious logins and potential SaaS account compromise.