ThreatsDay Bulletin: MS Teams Hack, MFA Hijacking, $2B Crypto Heist, Apple Siri Probe & More

ThreatsDay Bulletin reports that threat actors abuse Microsoft Teams for extortion, social engineering and financial theft, including after gaining control of MFA through password-reset social engineering to sign in to Teams and access sensitive information. The edition also highlights a campaign using malicious LNK shortcut files to deliver a PowerShell dropper that implants a DLL and enables remote tasking, with its activity aligned to phishing emails and rundll32 execution.

In a separate thread, Citizen Lab notes an Israeli-backed network of around 50 X accounts engaging in AI-generated disinformation aimed at destabilising Iran, codenamed PRISONBREAK, created in 2023 and active since January 2025. The bulletin also covers a set of technical flaws and CVEs, including CVE-2025-5037 in Autodesk Revit leading to remote code execution, CVE-2025-59449 in YoLink Hub as a critical vulnerability, and CVE-2025-34251 in Tesla TCU relating to an ADB lockdown bypass.

It cites North Korea-linked actors responsible for over $2B in crypto theft in 2025, noting a February Bybit breach and the broader pattern of targeting high-net-worth individuals, with Okta data suggesting extensive long-running activity.

Other items mention spoofed domains delivering Android and Windows trojans, and a wave of risk across AWS, Oracle E-Business Suite and other ecosystems, underscoring the need for continuous learning, collaboration and smarter use of technology to maintain trust in a connected world.