{"success":true,"data":{"id":"cloud-file-share-expiry-credential-phish","label":"Cloud file-share expiry credential phishing — impersonates OneDrive, Dropbox, Box, Google Drive, or WeTransfer with a file-expiry urgency + sign-in CTA at a non-official host. Proofpoint 2025-2026; Abnormal Security Q1 2026; CISA 2026.","description":"Phishing emails claiming a shared file or folder on OneDrive, SharePoint, Dropbox, Box, Google Drive, WeTransfer, or Notion is about to expire / be deleted, creating urgency to sign in via a credential-harvesting portal before the deadline. Three-part detection: (1) cloud storage platform brand, (2) file / document / link expiry urgency, (3) sign-in / verify-identity CTA with off-domain link. Proofpoint 2025-2026 documented this as the fastest-growing cloud-storage credential phishing vector; Abnormal Security Q1 2026 confirmed active OneDrive / Dropbox campaigns; CISA 2026 advisory. Distinct from account-suspension or storage-quota signals — specifically exploits the file-expiry urgency.","tier":"danger","category":"phishing","isThin":false}}