ValleyRAT

Dropbox Accounts Compromised Through Lenovo ID Authentication Flaw

Several thousand Dropbox accounts were breached between August 4 and 21 due to an authorization flaw involving Lenovo ID. The root cause was an error on Lenovo's side that permitted registration of accounts using arbitrary email addresses, which could then be used to access matching Dropbox accounts. Dropbox responded by forcing logouts for all users who had relied on Lenovo ID and by requiring direct password entry for Dropbox credentials. Approximately 5,000 accounts were affected, though only about one-third saw stored files accessed by attackers. Accounts protected by two-factor authentication remained unaffected. Additional reports from the same period covered Kaspersky analysis of ValleyRAT spyware using DLL sideloading, a critical SQL injection vulnerability in the All-in-One WP Migration WordPress plugin, and a Google Chrome update addressing CVE-2026-85046 in the V8 engine.