ThreatsDay Bulletin: OAuth Trap, EDR Killer, Signal Phishing, Zombie ZIP, AI Platform Hack & More

This weekly security bulletin covers notable threats and defensive developments across cloud, endpoint, messaging, and hardware domains.

• •Wiz detected a large-scale OAuth consent abuse campaign in early 2025 using 19 fake apps impersonating Adobe, DocuSign, and OneDrive to steal access tokens without needing user passwords
• •Russian-linked hackers are hijacking Signal and WhatsApp accounts of officials and journalists by masquerading as Signal Support chatbots to collect verification codes and PINs
• •Google reports the exploitation window after vulnerability disclosure collapsed from weeks to days, with software exploits replacing misconfiguration (29.4% to 21%) as the leading cloud breach vector
• •Mustang Panda (Camaro Dragon) targeted entities in Qatar using conflict-themed lures delivering PlugX and Cobalt Strike via LNK files in ZIP archives and DLL side-loading