Category: Cybersecurity

Summary: Changing the password blocks someone from signing in with the old password. However, they may still have an active session, a forwarding rule, access through a connected app, mailbox permissions, or a recovery method they added.

When someone gets into a business email account, changing the password should happen immediately. Once that is done, the account still needs a full check because other forms of access may remain.

During the time they had access, the attacker may have created a forwarding rule, approved a connected app, added a sign-in method, or granted access to another account. They may also have a browser or email app that is still signed in.

Email deserves particular care because it is connected to so many other services. Password-reset messages for accounting software, cloud storage, social media, and other business systems often arrive by email. Someone who can still read the inbox may be able to reach those accounts too.

That is why current recovery guidance from Microsoft, Google, and the UK National Cyber Security Centre includes several checks beyond changing the password.

Why a New Password May Not Remove Every Form of Access

Email services use sessions so you do not have to enter your password every time you open a message. After you sign in, the service gives your browser or email application a cookie or token that confirms the login has already been approved.

The service can continue accepting that session until it expires or is revoked. This means someone who signed in before the password changed may stay connected for a period of time, depending on the provider and the type of session.

The providers handle password changes differently. Google says that changing a password signs the user out in most places, but it lists exceptions that can include some devices and third-party applications. Google Workspace administrators also have separate controls for suspending an account and resetting its sign-in cookies.

Microsoft takes a similar approach for business accounts. Its guidance tells administrators to disable the affected account during the investigation and revoke active sessions separately.

The password change also leaves mailbox settings in place. A forwarding rule, delegate, or recovery method added while the account was compromised will remain until someone finds and removes it.

An Existing Session May Still Work

An active session is one of the first things your IT provider should check.

IMAGE SOURCE: https://www.pexels.com/photo/smartphone-screen-showing-account-verification-alert-33440144/  

If the attacker signed in through a browser or email application, that session may still hold a valid token. Malware on an employee’s computer can also steal a session cookie and send it to someone else.

A stolen cookie may allow the attacker to use a session that has already passed the normal login checks. In that situation, they may not need to enter the new password.

The administrator should use the email provider’s tools to revoke the account’s active sessions and tokens. The exact name of the control varies between services. It may appear as “revoke sessions,” “reset sign-in cookies,” “sign out everywhere,” or “log out of all devices.”

If malware may be present on the employee’s computer, use another device to begin the recovery process. The affected computer should be checked before the employee signs in again.

Forwarding Rules Can Keep Sending Out Your Email

After closing the active sessions, check what was changed inside the mailbox.

An attacker can create a forwarding rule that sends a copy of every new email to another address. They may also use a filter that only forwards messages containing terms such as “invoice,” “payment,” “bank,” or “password reset.”

More selective rules are harder to notice because most email continues arriving normally. The attacker only receives the messages they are interested in.

Rules can also hide activity. For example, a rule may move security warnings, customer replies, or questions about a payment request into a folder the employee rarely checks.

Both Microsoft and Google tell users and administrators to check forwarding settings and mailbox rules after a suspected compromise.

Microsoft 365 administrators should perform this check through the administration tools, not only from the employee’s Outlook settings. Microsoft specifically recommends reviewing all inbox rules, including hidden ones.

A Connected App May Have Permission to Read the Mailbox

Forwarding rules are one way to keep receiving email. A connected application can provide another.

Image Source: https://www.pexels.com/photo/creative-photo-of-a-lock-key-16564254/

Businesses commonly connect email accounts to scheduling tools, customer management systems, mobile email apps, document services, and browser extensions. These connections often use OAuth.

When a user approves an OAuth request, the application receives permission to access certain parts of the account. The application does not need to store the user’s password.

Attackers can misuse this process by creating an application that looks genuine and asking the user to approve it. Microsoft explains that a harmful app consent grant can provide access to email, files, contacts, and forwarding rules.

Some app connections may stop after a password reset, while others need to be removed separately. Review every application connected to the account and remove anything the business does not recognize, use, or approve.

An application’s name and logo do not confirm who created it. Your administrator should check the company behind it and the exact permissions it received.

Someone Else May Have Mailbox Permissions

Business email platforms allow one person to access another person’s mailbox. An executive may give an assistant access, for example, or several employees may work through a shared mailbox.

This type of access is called delegation. A delegate signs in with their own account, so changing the mailbox owner’s password does not automatically remove the delegate.

Exchange Online supports Full Access, Send As, and Send on Behalf permissions. Gmail also supports delegated mailbox access.

Check every person and group with access to the mailbox. Confirm why they need it and remove any permission that the account owner or administrator cannot explain.

Sending permissions need attention too. Someone with “Send As” access may be able to send messages that appear to come directly from the mailbox, even if they cannot read its contents.

Check Recovery and Sign-In Methods

The attacker may have added a phone number, recovery email address, authenticator app, passkey, or security key while they controlled the account.

A recovery method could help them regain access later. An authentication method might also allow them to approve another sign-in without knowing the new password.

Microsoft tells administrators responding to a compromised mailbox to review the user’s registered MFA devices and remove anything suspicious. Google also advises users to check recovery details, recent security activity, devices, and sign-in methods.

Compare every entry with the account owner. Remove anything that neither the employee nor the administrator recognizes.

How to Secure a Compromised Email Account

Some of the settings involved are only visible through the business administration tools. Contact your IT provider or email administrator rather than asking the employee to handle the entire cleanup from their inbox.

Disable or Suspend the Account

The administrator may temporarily disable or suspend the account while checking it. They should also revoke active sessions and tokens so the attacker is signed out.

The employee may lose access for a short time, but leaving the account active gives the attacker more time to read, send, or delete email.

Change the Password

Set a password that has not been used for another account. If the employee reused the old password elsewhere, those accounts need new passwords as well.

Do not send the new password to the affected mailbox. Use a phone call, an approved password manager, or another method your business trusts.

Some older applications use separate app passwords. Microsoft’s current guidance notes that these are not automatically revoked when the main password changes, so your administrator should remove or replace them if they are present.

Review the Mailbox and Account Settings

Check forwarding addresses, inbox rules, filters, blocked addresses, delegates, sending permissions, signatures, automatic replies, and connected applications.

Then review the registered devices, phone numbers, recovery addresses, authenticator apps, passkeys, and security keys.

POP and IMAP access should also be checked. Some businesses still use these settings for approved email applications, so confirm how the account is used before disabling them.

Find Out What Happened

Once access has been removed, work out what the attacker did while they were inside.

Check the Sent, Deleted, Drafts, Junk, and Archive folders. Look for messages the employee did not write, replies they did not see, password-reset emails, and changes to payment instructions.

The administrator should review sign-in logs, audit records, email traces, and security alerts. Start the search before the first known warning because the original compromise may have happened earlier.

A login from an unfamiliar location does not prove that someone else used the account. Mobile networks, VPNs, and internet providers can affect location data. The device, time, IP address, application, and activity around the login provide more useful context when considered together.

Contact Anyone Who May Have Received a Fraudulent Message

If the account sent false messages, contact the recipients through a trusted channel. Tell them which messages were not genuine and whether they need to change a password, delete a file, or ignore a payment request.

Pay particular attention to messages involving bank details, invoices, payroll, gift cards, or password resets.

If money may have been sent to the wrong account, contact the bank or payment provider immediately. Use a phone number from its official website or your existing records rather than one found in the email conversation.

Secure the Account Before Returning It to the Employee

Once the unknown access, settings, and permissions have been removed, the administrator can return the account to the employee.

Require MFA before the employee signs in again. Where the email platform supports them, passkeys and physical security keys provide better protection against phishing than codes that can be entered into a fake login page.

MFA helps prevent another login with a stolen password. The earlier checks are still required because MFA does not remove existing forwarding rules, delegates, connected apps, or recovery methods.

How to Reduce the Risk of Another Compromise

Ask your IT provider to block automatic forwarding to outside addresses unless your business has a reason to allow it. Microsoft 365 and Google Workspace also provide controls for limiting which third-party applications employees can connect.

Require MFA for every email account, especially administrators and employees who handle payments or sensitive information. Use passkeys or physical security keys where the platform supports them.

Employees should report unexpected MFA prompts, unfamiliar login alerts, mailbox changes, and messages sent from their account that they do not recognize. Report these signs as soon as they appear so your IT provider can check the account before more email is sent or deleted.

Frequently Asked Questions

Does changing an email password sign out every device?

It depends on the provider. Some services sign users out of most sessions after a password change, while others provide separate controls for revoking sessions and tokens. Follow the account-compromise instructions for the email service your business uses.

Can someone still receive my email after I change the password?

Yes. A forwarding rule or filter may continue sending them copies of your messages. Check all forwarding settings and mailbox rules.

Can an app access my email without knowing my password?

Yes. An app may receive permission through OAuth, which allows it to access approved account data without storing the password. Review and remove any connected application the business does not recognize.

Should I delete a compromised email account?

The account is usually disabled or suspended while it is secured and investigated. Deleting it could remove information your IT provider needs to work out what happened.

Is MFA enough to secure the account?

No. Local administ MFA helps prevent new sign-ins, but it does not remove mailbox rules, app permissions, delegates, recovery methods, or active sessions that already exist. Those need to be checked separately.

Sources and Further Reading

• Microsoft: Respond to a compromised email account in Microsoft 365
• Microsoft: App consent grant investigation
• Google Workspace: Identify and secure compromised accounts
• Google: Gmail security tips
• UK National Cyber Security Centre: Hacked accounts
• Australian Cyber Security Centre: Review your email account security

If you think someone still has access to your business email, contact your IT provider immediately. If you do not have an IT provider, you can always reach out to us and we’ll help you.

—

Featured Image Credit

This Article has been Republished with Permission from The Technology Press.

Summary: Most small-business websites run on WordPress, and the biggest risk is usually old plugins that nobody has updated. Attackers scan the web for these known weak spots and use the sites they find to spread malware, post spam, or steal what visitors type into forms. Keeping the site and its plugins updated, and knowing who is responsible for that, prevents most of it.

Your website is one of those things you set up once and then stop thinking about. It sits there doing its job, so there’s no reason to touch it. That’s exactly why a neglected website is one of the common ways a small business gets hacked.

Most small-business sites run on WordPress, which powers more than 40% of all websites, according to W3Techs. WordPress itself is solid. The risk is usually the plugins and themes added to it, which often don’t get updated for years.

How a neglected website gets hacked

Attackers don’t usually pick your business by name. They run automated tools that scan huge numbers of websites looking for known weak spots, like a plugin with a security hole that hasn’t been fixed. When the tool finds one, it breaks in. It’s all automatic, and it isn’t aimed at you personally.

That’s why old plugins are the problem. When a plugin maker finds a security flaw, they release an update to fix it. Until you install that update, the hole stays open, and the automated scanners know exactly what to look for. Security researchers who track WordPress flaws find that the large majority are in plugins and themes, not in WordPress itself.

What a hacked website is used for

A hacked website rarely announces itself. Instead of shutting your site down, attackers usually keep it running and use it for their own purposes:

• Serving malware. Your site gets changed so that visitors are infected or pushed to a page that tries to install something.
• Spam and scam pages. Attackers add hidden pages selling fake goods or pushing scams, riding on your site’s good standing with search engines.
• Stealing form data. If your site has a contact or checkout form, a hacked site can copy what people type into it, including personal or payment details.
• Redirects. Visitors who click your link get sent somewhere else, often a scam or malware site.

The damage lands on you even though the attacker was after your visitors. Search engines flag hacked sites with warnings and drop them down the rankings, and browsers may block them, so customers see a red “this site may be dangerous” screen instead of your homepage.

Is your website at risk?

It depends on how your site is built.

If you use a hosted website builder like Wix, Squarespace, or Shopify, most of the security and updates are handled for you behind the scenes, so your risk is lower.

If you have a self-hosted WordPress site, usually set up by a web designer or agency on your own hosting, then keeping WordPress, the plugins, and the themes updated is someone’s job. The question is whose. On a lot of small-business sites, the honest answer is that nobody has touched it since it launched.

You can usually tell your site is at risk if you don’t know who maintains it, it hasn’t been updated in a year or more, or it’s running plugins from a developer who has since disappeared.

How to keep your website safe

• Keep everything updated. WordPress, plugins, and themes all need updating when new versions come out. Many sites can be set to update automatically.
• Remove plugins you don’t use. Every extra plugin is another thing that can go wrong. If you’re not using it, delete it.
• Stick to well-known plugins. Use ones that are popular, well-reviewed, and updated recently. Avoid anything that hasn’t been touched in years.
• Watch for abandoned plugins. Sometimes a plugin stops being updated, or gets removed from the plugin store because of a security problem. When that happens it stops getting fixes, so check now and then that the plugins on your site are still supported, and replace any that aren’t.
• Lock down the admin login. Use a strong, unique password for the website’s admin account, and turn on multi-factor authentication if your setup supports it.
• Add a security plugin or web firewall. A reputable one can block common attacks and warn you when something changes. Your web host or IT provider can recommend one.
• Keep backups. If the worst happens, a recent backup lets you restore the site instead of rebuilding it from scratch.
• Know who’s responsible. Decide who looks after updates and security, whether that’s your web designer, your IT provider, or your hosting company, and make sure it’s clearly somebody’s job.

What to do if your site is hacked

If your site does get hacked, moving quickly limits the damage:

• Get help straight away. Cleaning a hacked site properly is a job for your web host, IT provider, or a website security service. Most hosts have dealt with this many times and can help.
• Take the site offline. Putting up a simple “down for maintenance” page stops visitors from being harmed while it’s cleaned up.
• Change the passwords. From a device you know is clean, change the passwords for your hosting account and the website’s admin login, and turn on multi-factor authentication.
• Restore a clean backup. If you have a backup from before the hack, restoring it is often the fastest fix. If you don’t, the site will need to be cleaned by hand.
• Update and tidy up before it goes back live. Update WordPress, the plugins, and the themes, and remove anything you don’t recognize or no longer use, so the same hole doesn’t get used again.
• Tell anyone whose data was affected. If the site handled customer details or payments, check whether any of that was exposed, and let those people know if it was.

Frequently asked questions

How do I know if my website has been hacked?

Common signs are a warning from Google or your browser, a drop in search traffic, pages or pop-ups you didn’t add, or your web host getting in touch about a problem. If you’re not sure, your IT provider or web host can check.

Do I need to update my website if it works fine?

Yes. A site can look completely normal to you while an out-of-date plugin leaves a door open for attackers. Updates close those holes, which is why they matter even when nothing looks wrong.

I use Wix or Squarespace. Am I at risk?

Much less so. Hosted builders handle the updates and most of the security for you. You should still use a strong admin password and MFA, but you’re not responsible for patching plugins the way a self-hosted WordPress site is.

Who should maintain my website?

Someone should own it clearly: your web designer or agency, your IT provider, or your hosting company, depending on your setup. The important thing is that someone is actually doing the updates.

What is a security plugin or web firewall?

It’s a tool that sits on your website, blocks common attacks, watches for changes, and can alert you to problems. On WordPress, a reputable security plugin is a common, low-cost way to add that protection.

Sources and further reading

• W3Techs: WordPress usage statistics — the share of websites that run on WordPress.
• Patchstack: WordPress vulnerability report — research showing most WordPress security holes are in plugins and themes.
• NCSC: Small Business Guide — UK guidance on keeping software updated and patched.

If you’re not sure whether your website is being kept up to date, or who’s responsible for it, that’s worth sorting out before something goes wrong. Your IT provider or web host can check where things stand and take over the upkeep. And if you don’t have an IT provider, feel free to reach out to us and we’ll help you sort it.

—

Featured Image Credit

This Article has been Republished with Permission from The Technology Press.

Summary: Scammers buy ads on Google and other search engines using the names of trusted brands and software, so their fake site shows up at the very top, above the real one. Click it and you can land on a fake page that steals your login or installs malware. You can avoid nearly all of it by skipping the sponsored results and going to the real website yourself.

When you search Google for a program to download or a website to log into, the first thing you see is usually an ad. It sits at the top, marked “Sponsored,” and most people click it without a second thought, because the top result is normally what you wanted.

Scammers count on that. They buy ads on the names of trusted companies and popular software, so their fake site appears right at the top, above the real one, and you click it thinking it’s the official page.

How the scam works

The trick is called malvertising, short for malicious advertising. A scammer buys a search ad for a term people trust, like the name of your bank, a Microsoft login, or a common program such as a PDF reader or a video player. The ad looks normal, with the real brand name and a web address that looks right.

When someone clicks it, they land on a page built to look exactly like the real one. Sometimes that page asks you to log in and hands your username and password straight to the scammer. Other times it offers the software you were after, and the download installs malware instead of the real program.

Why these ads are so easy to fall for

These ads are convincing. They sit above the real result, so they’re the first thing you see. They use the real company’s name and a web address that looks right. And they show up on a search you started yourself, so they don’t feel as suspicious as a random email or text would.

Attackers have also gotten good at hiding from the checks meant to stop them. They show a clean, harmless page to the ad reviewers and the real, malicious page to everyone else, so the ad can pass review and still do damage.

How common is this?

Very. In its 2025 Ads Safety Report, Google said it blocked or removed more than 8.3 billion ads that broke its rules, suspended 24.9 million advertiser accounts, and took down 602 million ads tied to scams. Google also noted that criminals are now using AI to make fake ads faster.

Security researchers have found scam search ads pretending to be well-known programs like VLC, 7-Zip, and CCleaner, and even Google’s own apps, with downloads that installed password-stealing malware. These show up on the everyday searches your team runs.

What this means for your business

For a business, the risk comes up in two everyday situations: downloading software, and logging in.

When someone downloads software, they search for a tool, click the top ad, and install something that steals the passwords and logins saved in their browser.

When someone logs in, they search for “Microsoft 365 login” or their bank, click the ad rather than the official link, and type their username and password straight into a fake page.

In both cases, the problem is info-stealing malware. Once it’s on a machine, it can steal saved passwords, browser cookies, and session tokens, which can get an attacker into accounts even when multi-factor authentication is switched on.

How to protect your team

• Scroll past the sponsored results. The ads sit at the top, marked “Sponsored” or “Ad.” The real website is usually just below, in the normal results.
• Don’t download software from an ad. Type the maker’s web address yourself, or search and use the normal result, then download from the official site.
• Bookmark the sites you log into. For your bank, Microsoft 365, and other important accounts, use a saved bookmark instead of searching each time.
• Keep devices and browsers updated. Turn on automatic updates so a bad download is less likely to work.
• Tell your team this is a thing. Most people have no idea the top result can be a trap, and once they know, they stop clicking it.

Frequently asked questions

Aren’t ads at the top of Google checked and safe?

Google reviews ads and removes billions that break its rules, but scammers still slip through by showing reviewers a clean page and everyone else the malicious one. A “Sponsored” label doesn’t mean the site is safe.

What is malvertising?

Malvertising is short for malicious advertising: scammers buy online ads, often on trusted brand names, to send people to fake sites that steal logins or install malware.

How do I download software safely?

Go to the maker’s official website by typing the address yourself, or search and use the normal (non-ad) result. Don’t download from a sponsored ad, and don’t trust a download that arrives through one.

What should I do if someone clicked a scam ad?

If they only visited the page, close it and don’t enter anything. If they typed a password, change it and turn on MFA. If they downloaded and ran a file, disconnect the device and have your IT provider check it for info-stealing malware.

Does an ad blocker help?

It can. A reputable ad blocker hides many sponsored results, which takes the fake links off the page before anyone can click them. It isn’t a complete fix, so keep the habits above too.

Sources and further reading

• Google: 2025 Ads Safety Report — Google’s own figures on the scale of scam and policy-breaking ads.
• FTC: Online search results — the good, the bad, and the scammy — US consumer guidance on scrolling past ads and downloading software safely.
• BleepingComputer: Malware pushed via Google search ads for VLC, 7-Zip, CCleaner — a real example of scam ads impersonating popular software.

If you’d like to give your team a plain rundown of what a scam ad looks like, or tighten how software gets installed on your computers, your IT provider can help with both. And if you don’t have an IT provider, feel free to reach out to us and we’ll help you sort it.

—

Featured Image Credit

This Article has been Republished with Permission from The Technology Press.

Summary: Scammers now use AI to write their phishing emails, so the spelling and grammar mistakes that used to give them away are gone. The UK’s National Cyber Security Centre and the FBI both warn that AI makes these messages cleaner, more personal, and harder to spot. The way to catch them now is to look at what an email is asking you to do, because the writing no longer gives anything away.

For years, the advice for spotting a scam email was simple: look for bad spelling and clumsy grammar. A real bank or supplier writes properly, the thinking went, so a message full of mistakes was probably fake. It was easy to teach, and for a long time it worked.

It doesn’t anymore. Scammers now use AI to write their emails, and AI writes cleanly. The typos and awkward phrasing that used to give phishing away are gone, and the messages landing in your team’s inbox read as well as anything from a real company. Worse, they can be written to sound like they came from someone you already know.

Why the old advice stopped working

The spelling-and-grammar tell worked because a lot of scammers were writing in a language that wasn’t their own, and the mistakes showed. AI took that away.

The UK’s National Cyber Security Centre says generative AI can now create convincing phishing lures “without the translation, spelling and grammatical mistakes that often reveal phishing.” The FBI says the same: criminals use AI to limit the grammar and spelling errors that used to mark a message as fake, so it reads as believable. That means the one thing most people were trained to look for no longer tells you much.

Why these emails are so convincing now

• The writing is clean. A scam email reads like a normal business email, because a machine wrote it in seconds, in whatever tone the attacker asked for.
• It’s personal. Attackers can feed public details about your company into an AI tool, pulled from your website, your team’s LinkedIn profiles, or a press release, and get a message tailored to you: the right names, the right job titles, and a believable reason to be in touch.
• There’s more of it. AI makes each message faster to produce, so attackers send far more. The FBI’s Internet Crime Complaint Center added a section on AI to its annual report for the first time, tied to more than 22,000 complaints and nearly $893 million in reported losses.

These days, the scam email isn’t the obvious one anymore. Instead of “Dear customer, your account is suspended,” someone in your finance team gets a message that looks like it’s from a supplier they really deal with, mentions a real project, and asks to update the bank details for the next invoice. It reads exactly like a real supplier email. The only thing wrong is that the supplier never sent it.

Your spam filter won’t catch them all

It’s tempting to assume your email security will handle this. It catches a lot, and you should keep it switched on. But a well-written, personalized email that asks a normal-sounding question doesn’t always look dangerous to a filter, especially when it carries no obvious bad link or attachment. Both the NCSC and the FBI expect AI to push more of these messages through, which is why the last line of defense is a person who knows what to check.

It’s not just email anymore

AI has done the same thing to phone calls and texts. The FBI warns that criminals can clone a voice from a short audio clip, enough to leave a voicemail that sounds like your boss or a family member asking for an urgent payment. The same thing that makes AI emails so convincing makes AI phone scams convincing too. The defense is the same: if a call or voicemail asks for money or logins, hang up and call the person back on a number you already have.

Here are the signs you should still pay attention to

If you can’t trust how an email is written, look at what it’s asking you to do. That’s where the real warning signs are, and AI hasn’t changed them:

• It asks for money, gift cards, or a payment to a new account.
• It asks for a login, a verification code, or personal details.
• It creates pressure: a deadline, a threat, or a “do this now.”
• It asks you to change the bank details for an invoice or a supplier.
• It comes with a link or attachment you weren’t expecting.
• The display name looks right, but the actual email address doesn’t match it.

Every one of these is about what the email is asking for. So the rule to teach your team is simple: when a message is about money, logins, or how you pay someone, slow down before you act.

How to protect your team

• Check money and login requests another way. If an email asks you to pay a new account or change a supplier’s bank details, call the person on a number you already have. Don’t reply to the email or use a number it gives you.
• Stop telling staff to watch for bad spelling. Tell them to look at what the email is asking for, and to slow down when it’s about money or logins.
• Make one rule for payment changes: confirm every change to bank details by phone, even when it’s urgent.
• Turn on phishing-resistant MFA or passkeys, so a stolen password is harder to use even if someone gets tricked.
• Make it easy to report a suspicious email and make sure nobody feels silly for checking.
• Remind the team now and then that scam emails look perfect these days. A quick five-minute chat beats a poster nobody reads.

Frequently asked questions

Can you still spot a phishing email by bad spelling and grammar?

Not reliably. Attackers use AI to write clean, correct emails now, so a message with perfect spelling can still be a scam. Judge it by what it asks you to do.

What are the warning signs that still work?

The request itself: paying money, changing bank details, sharing a login or code, or being pushed to act urgently. Those signs don’t depend on how the email reads.

Is AI-generated phishing really more effective?

Yes. The NCSC and the FBI have both warned that AI makes phishing more convincing and more personal, and the FBI has tied AI to tens of thousands of fraud complaints and hundreds of millions in losses. Cleaner, tailored messages get opened and clicked more often.

Will my spam filter stop AI phishing?

It will catch a lot, and you should keep it on. But a well-written, personalized email with no obvious bad link can still look legitimate to a filter, so don’t rely on it alone. A trained person is the backstop.

What should staff do if they aren’t sure about a message?

Slow down and check through a channel they trust, like calling a known number or asking the person directly. And report it, even if it turns out to be genuine.

Sources and further reading

•  NCSC: The near-term impact of AI on the cyber threat — the UK cyber agency on AI producing phishing lures without the usual spelling and grammar mistakes.

•  FBI IC3: Criminals Use Generative AI to Facilitate Financial Fraud — how criminals use AI-generated text and cloned voices, and how it removes the usual signs of fraud.

If you’d like help teaching your team what to watch for, or turning on phishing-resistant logins so a fooled password doesn’t turn into a break-in, your IT provider can set both up. And if you don’t have an IT provider, feel free to reach out to us and we’ll help you sort it.

—

Featured Image Credit

This Article has been Republished with Permission from The Technology Press.

Article Summary: If your business is hit by a cyberattack, the first hour matters. Disconnect the affected devices from the network instead of powering them off, call your IT provider by phone, and leave the evidence in place. If money was wired to a scammer, call your bank right away. This post is the step-by-step plan, plus where to report an attack in the US, UK, and Australia.

If a cyberattack hits your business, what you do in the first hour really matters.

It’s also the easiest time to make a costly mistake, like turning off the wrong machine, deleting evidence, or replying from an email account the attacker is already reading.

The steps below tell you what to do, in order, so you’re not guessing in the moment.

Doing these steps doesn’t require technical knowledge.

Before anything else: don’t make it worse

Before you touch anything, avoid these:

• Don’t turn the affected computer off, if you can avoid it. Disconnecting it from the network is better, because powering it down can wipe evidence that helps work out what happened.
• Don’t delete anything. Leave the ransom note, the suspicious email, and any alerts exactly where they are. They’re what your IT team and investigators will need.
• Don’t pay a ransom on the spot.
• Don’t use the hacked email or accounts to talk about the attack. If an attacker is in your inbox, they can read those messages. Switch to phone calls or a different account.

The step by step

Work through these in order, starting the moment you notice something’s wrong.

1. Disconnect the affected devices from the network. Unplug the network cable and turn off Wi-Fi on anything that looks affected. This stops the problem spreading to other computers and to your backups. CISA’s guidance is to isolate devices rather than power them off where you can, and to shut a device down only if you can’t get it off the network any other way.
2. Call your IT provider straight away, by phone. Don’t email, in case the attacker is watching your inbox. If you have cyber insurance, call them next, because many policies require you to involve their incident team early.
3. Leave the evidence alone. Don’t wipe, reinstall, or tidy up the affected machines yet. Screenshots of the ransom note or suspicious emails are useful, but keep the originals too.
4. If money was sent, call your bank immediately. Ask them to recall the transfer and freeze it if they can. With wire and bank fraud, acting in the first few hours makes the biggest difference.
5. Reset passwords from a clean device, and turn on multi-factor authentication. Start with email and any admin accounts, and use a device you know isn’t affected.
6. Report it. That can help you recover, and it’s sometimes legally required. Where to report depends on your country.

Where to report it

You’ve reaWhere you report depends on where you are:

• United States: file with the FBI’s Internet Crime Complaint Center (IC3), and report to CISA.
• United Kingdom: report through the NCSC, and to Action Fraud.
• Australia: report through ReportCyber, or call the 24/7 hotline on 1300 CYBER1.

If money was wired to a scammer, report it fast.

The FBI says reporting wire fraud to IC3 within 72 hours gives its Recovery Asset Team the best chance of clawing it back, and that team recovers funds in about 70% of the cases reported in time.

If personal data about your customers or staff was exposed, you may be legally required to notify a regulator and the people affected, sometimes within 72 hours.

The rules depend on where you operate, like GDPR in the UK and Europe, state breach-notification laws in the US, and the Notifiable Data Breaches scheme in Australia.

Ask your lawyer or IT provider early so you don’t miss a deadline.

Should you pay the ransom?

If it’s ransomware, the big question is whether to pay.

The FBI does not recommend it. Paying doesn’t guarantee you get your files back, it marks you as a business that pays, and the money funds more attacks.

It’s ultimately your decision, but it’s one to make with law enforcement, your IT or incident-response team, and your insurer, not alone in the first panicked hour.

Sometimes a free decryption tool already exists for the exact ransomware that hit you, which is one more reason to get the experts involved before you pay anyone.

The best time to prepare is before it happens

All of this is far easier if you’ve decided some of it in advance. You don’t need a thick binder, just a simple plan that covers:

• Who to call first (your IT provider, your insurer) and their numbers, kept somewhere you can reach without your main systems.
• Where your backups are, and proof they’ve been tested by restoring from them.
• Which accounts and devices matter most, so you know what to protect first.

A single page covering those is enough for most small businesses, and it’ll save you a lot of scrambling if the day ever comes.

Frequently Asked Questions

What’s the first thing to do in a cyberattack?

Disconnect the affected devices from the network, by unplugging the network cable and turning off Wi-Fi, then call your IT provider by phone. Getting the device off the network stops the problem spreading while you get help.

Should I turn off the computer if I get ransomware?

If you can, disconnect it from the network instead of powering it off. Shutting it down can wipe evidence stored in memory that helps work out what happened. Only power a device off if you can’t get it off the network any other way.

Should I pay the ransom?

The FBI does not recommend it. Paying doesn’t guarantee you get your data back, and it funds more attacks. Make that decision with law enforcement, your IT or incident-response team, and your insurer, and check whether a free decryption tool already exists first.

We wired money to a scammer. What do we do?

Call your bank immediately and ask them to recall the transfer. If you’re in the US, report it to the FBI’s IC3 within 72 hours, because reported quickly, their Recovery Asset Team recovers the money in about 70% of cases. In other countries, contact your bank and your national reporting service straight away.

Who do I report a cyberattack to?

In the US, the FBI’s IC3 and CISA. In the UK, the NCSC and Action Fraud. In Australia, ReportCyber. Also tell your cyber insurer, and check whether you have a legal duty to notify a regulator if personal data was exposed.

—

Featured Image Credit

This Article has been Republished with Permission from The Technology Press.

Article Summary: A passkey lets you sign in to an app or website using the same fingerprint, face, or PIN you use to unlock your phone or laptop, with no password to type. It’s built on a security standard called FIDO that can’t be phished, because the passkey only works on the real site and there’s no password to steal or reuse. Most major platforms and a growing list of business tools support passkeys, and Microsoft 365 includes them at no extra cost. For most businesses, it’s worth starting to roll them out, beginning with the most sensitive accounts.

Passwords are the weak point in most businesses.

People reuse them across accounts, write them on sticky notes, and type them into convincing fake login pages without realizing it.

Passkeys are the technology built to replace passwords, and they fix the parts that cause the most trouble.

A passkey lets you sign in with the same fingerprint, face scan, or PIN you already use to unlock your phone or laptop. There’s no password to type, so there’s nothing for an attacker to steal, guess, or trick out of you.

Let’s look at what passkeys are, why they’re so much harder to attack than passwords, and whether your business should start using them.

What is a passkey?

A passkey replaces your password with your device’s own security.

Instead of typing a password, you prove it’s you the same way you unlock your phone: a fingerprint, a face scan, or a PIN.

When you set up a passkey for a website, your device creates two matching keys.

The private key stays locked on your device and never leaves it.

The public key is stored by the website.

When you sign in, the site sends a challenge that only your private key can answer, your device answers it once you confirm with your fingerprint or PIN, and you’re in. The website never sees a password, because there isn’t one. This approach comes from a standard called FIDO, which Apple, Google, and Microsoft all build on.

Why passkeys are harder to attack than passwords

A password is a secret you share with the website every time you log in, and that’s exactly what attackers go after.

A passkey has no shared secret. That one difference fixes the biggest problems with passwords.

• They can’t be phished. A passkey only works on the real website it was created for. Land on a convincing fake, and the passkey simply won’t work, so there’s nothing to hand over. That matters, because phishing is how most break-ins start.
• There’s no password to steal in a breach. The website only keeps your public key, which is useless on its own. If the company gets hacked, there’s no password list to grab and try on your other accounts.
• Nothing to reuse or forget. Each passkey is unique to one site and made automatically, so reused and weak passwords stop being a problem.

Older methods like text-message codes and app approval prompts can still be tricked out of people.

Where you can use passkeys already

Support has spread fast.

You can already sign in with passkeys to Microsoft, Google, and Apple accounts, plus a growing list of banks, password managers, and business tools.

Apple, Google, and Microsoft have built passkeys into their phones, laptops, and browsers, so the device in your pocket can already store and use them.

There are two types worth knowing.

A synced passkey is backed up to your Apple, Google, or Microsoft account, so it works across all your devices and you’re covered if you lose one.

 A device-bound passkey stays on a single device, like a physical security key you plug in, which is the most locked-down option and a common pick for sensitive accounts.

Should your business use them?

For most businesses, yes, and you can start small. There’s no need to switch everything overnight or drop passwords on day one.

If you use Microsoft 365, passkeys are already available through Microsoft Entra.

Staff can sign in with a passkey stored in the Microsoft Authenticator app, a security key, or their own device. Google Workspace supports them too.

They’re also just faster. Microsoft says signing in with a synced passkey takes about 3 seconds, against roughly 69 seconds for a password plus a traditional MFA code. Across a whole team, that adds up.

Here’s how you can start using passkeys:

1. Turn passkeys on for your most sensitive accounts first: administrators, finance, and anyone who can move money or change systems.
2. Let everyone else add a passkey as a faster, safer way to sign in, alongside their normal login at first.
3. Make sure each person has a backup, like a second device or a security key, so a lost phone doesn’t lock anyone out.

Your IT provider can switch this on and run the rollout so nobody gets locked out along the way.

What to watch out for

Passkeys aren’t magic, and a few things are worth planning for.

• Account recovery. If someone loses the only device with their passkey and has no backup, they can get locked out. A synced passkey or a second registered device fixes this, but you have to set it up ahead of time.
• Not everything supports them yet. Support is growing fast, but some older systems and smaller vendors still rely on passwords, so you’ll run both side by side for a while.
• Shared devices and logins. Passkeys are tied to a person and their device, so any shared computers or shared accounts need their own plan.

Frequently Asked Questions

What is a passkey in simple terms?

It’s a way to log in using your fingerprint, face, or PIN instead of a password. Your device proves it’s you to the website, and no password is ever typed or stored.

Are passkeys safer than passwords?

Yes. They can’t be phished, there’s no password for a hacker to steal in a data breach, and there’s nothing to reuse or forget. Security agencies like CISA recommend FIDO-based logins, which is what passkeys are, as the strongest widely available option.

What happens if I lose the device with my passkey?

If it was a synced passkey, it’s backed up to your Apple, Google, or Microsoft account and still available on your other devices. If it was device-bound and you have no backup, you’d use a recovery method to get back in, which is why setting up a second passkey or device in advance matters.

Does Microsoft 365 support passkeys?

Yes. Passkeys are available through Microsoft Entra at no extra cost, including the free tier. Staff can use a passkey in the Microsoft Authenticator app, a security key, or their device.

Do passkeys replace multi-factor authentication?

A passkey can count as multi-factor authentication on its own. Unlocking it needs both your device (something you have) and your fingerprint, face, or PIN (something you are or know), so it covers two factors in one step and can replace the old password-plus-text-code routine.

—

Featured Image Credit

This Article has been Republished with Permission from The Technology Press.

Article Summary: Email spoofing is when a scammer sends a message that appears to come from your domain, often to trick your clients or staff into paying a fake invoice or changing banking details. Three DNS records (SPF, DKIM, and DMARC) prove that a message really came from you and tell receiving mail servers to reject the ones that didn’t. The catch is that DMARC only protects you once it’s set to “quarantine” or “reject,” and a lot of businesses leave it on “none,” which monitors but does not block.

Right now, with no special tools, someone could send an email that looks like it came from your company.

The From line would show your domain, your logo could be pasted into the message, and it could ask one of your clients to pay an invoice or update banking details. This is called email spoofing, and it is one of the most common ways fraud against your clients and suppliers begins.

There are three settings you can add to your domain that make this much harder to pull off.

They’re called SPF, DKIM, and DMARC.

Most businesses have one or two of them set up and the third missing.

That’s usually all it takes to let a spoofed email through. This post explains what each one does, the setting most businesses get wrong, and how to check your own domain.

Why scammers can send email in your company’s name

Email was built in a more trusting time.

The system that delivers mail does not, on its own, check that the sender is who they claim to be. The From address on an email is about as trustworthy as the return address handwritten on an envelope. Anyone can write anything there, and the mail still gets delivered.

Spoofing takes advantage of that.

A scammer puts your domain in the From field, sends the message, and unless your domain is set up to prevent it, the receiving mail server has no reason to question it. The message lands in your client’s inbox looking like it came from you. The UK’s National Cyber Security Centre publishes anti-spoofing guidance for exactly this reason.

The three records that stop email spoofing

Three DNS records work together to prove an email really came from your domain. You add them once, at your domain registrar or DNS host, and receiving mail servers check them on every message you send.

SPF (Sender Policy Framework)<

SPF is a list of the mail servers allowed to send email for your domain, published as a DNS record. When a receiving server gets a message claiming to be from you, it checks whether the sending server is on that list. If a server that isn’t on the list tries to send as your domain, SPF flags it.

DKIM (DomainKeys Identified Mail)

DKIM adds a tamper-proof signature to every message you send. Your mail server signs outgoing email with a private key, and the matching public key sits in your DNS. The receiving server checks the signature to confirm two things: the message really came from your domain, and nobody altered it along the way.

DMARC (Domain-based Message Authentication, Reporting and Conformance)

DMARC ties the other two together and tells receiving servers what to do when a message fails the check. It also confirms that the domain in the visible From address matches the domain SPF and DKIM verified, which is the part that stops someone forging your exact address.

And it sends you reports showing who is sending email using your domain, including the senders who shouldn’t be.

The DMARC setting most businesses get wrong

DMARC has three policy settings, and choosing the wrong one is a common mistake.

1. p=none tells receiving servers to do nothing when a message fails. It only monitors and sends you reports. Your domain can still be spoofed.
2. p=quarantine tells them to send failing messages to the junk folder.
3. p=reject tells them to block failing messages before they ever arrive.

A lot of businesses set up DMARC at p=none, watch the reports come in, and never move past it. At p=none, you get reports but your domain still isn’t protected.

Real protection only starts at quarantine or reject.

Microsoft’s own guidance is to work toward p=reject once you’ve confirmed your legitimate mail passes.

What SPF, DKIM, and DMARC don’t stop

These records stop someone from forging your exact domain.

There are two things they don’t catch, though, and both are worth knowing about.

• Lookalike domains. A scammer can register a domain that resembles yours, like yourcompany-invoices.com, or yourcompany.co instead of .com, and send from that. Your records protect your real domain, not a different one the attacker owns.
• Display-name spoofing. The name shown in the From line can read “Your Company Accounts” while the real address behind it is a random Gmail account. DMARC checks the domain, not the display name.

For those, you still need the habits that catch any phishing attempt: check the full email address rather than just the display name, and verify any request to change payment details by calling a known number, not one from the email.

Why this matters even if you don’t send bulk email

The first reason is protection.

These records stop scammers from impersonating your domain to your clients, your suppliers, and your own staff.

The second is deliverability.

The major mailbox providers now require these records from anyone sending in volume.

Since February 2024, Google and Yahoo have required bulk senders, meaning those sending more than 5,000 messages a day, to use SPF, DKIM, and DMARC.

Microsoft began applying similar requirements to Outlook.com and Hotmail in 2025, routing non-compliant high-volume mail to junk and then rejecting it.

Even below those thresholds, a domain with proper authentication is more likely to reach the inbox than the spam folder.

How to check and fix your domain

You can get a rough sense of where you stand without any technical work.

Several free DMARC and SPF checkers let you type in your domain and see which records exist. That tells you whether the records are present, though not whether they’re configured correctly.

Fixing them properly is a job for whoever manages your IT or your domain.

The records live in your DNS, and a mistake can send your own legitimate email to spam, so the rollout is done in stages:

1. Publish SPF and DKIM so all of your real mail sources are covered.
2. Add DMARC at p=none and read the reports to confirm your legitimate mail passes.
3. Move DMARC to p=quarantine, then to p=reject, once the reports look clean.

Microsoft recommends this same gradual path, starting at none and working toward reject, so you protect the domain without blocking your own mail on the way.

Frequently Asked Questions

What is email spoofing?

Email spoofing is when someone sends a message with your domain in the From address to make it look like it came from your company. It’s used to trick your clients, suppliers, or staff into paying fake invoices, changing banking details, or handing over information.

What are SPF, DKIM, and DMARC in simple terms?

SPF is a list of servers allowed to send email for your domain. DKIM is a signature that proves a message came from you and wasn’t altered. DMARC ties the two together, tells receiving servers to reject messages that fail, and reports who is sending email as your domain.

Does DMARC stop all email impersonation?

No. DMARC stops someone forging your exact domain. It does not stop lookalike domains (like yourcompany-invoices.com) or display-name spoofing, where the sender’s name says your company but the address behind it is different. Those still need staff awareness and payment-verification habits.

Will setting up DMARC block my own emails?

Not if you roll it out gradually. Starting at p=none lets you watch the reports and confirm your legitimate mail passes before you move to quarantine and then reject. Skipping straight to reject without checking first is what causes problems.

Do I need these records if I don’t send many emails?

Yes. They protect your domain from being spoofed regardless of how much email you send, and they help your messages reach the inbox. Google, Yahoo, and Microsoft now expect proper authentication, and mail without it is more likely to be filtered.

—

Featured Image Credit

This Article has been Republished with Permission from The Technology Press.

Article Summary: A QR code scam, sometimes called quishing, hides a malicious web link inside a QR code. Because the link is buried in an image instead of written as text, it slips past the email filters that normally catch bad links, and scanning the code usually moves the victim onto a personal phone that sits outside the company’s security. Microsoft reported a 146% rise in QR code phishing during the first quarter of 2026.

QR codes are part of normal business now.

You scan them to see a menu, pay for parking, connect to Wi-Fi, or open a shared document.

 Attackers know that, and they have started hiding malicious links inside QR codes to get past the security tools that would normally catch a bad link in an email.

The technique has a name, quishing, and it works because a QR code is just an image.

Your email filter reads text, so a link encoded into a QR code can pass straight through. When you scan it, you usually do so on your phone, which sits outside most of the protection your work computer has.

This post covers what a QR code scam is, why it gets past your security, what the common ones look like, and the habits that protect your business.

What is a QR code scam?

A QR code scam is a phishing attack that uses a QR code in place of a written link.

Instead of a clickable URL your email security can inspect, the attacker encodes the web address into a square image.

You scan it with your phone camera, your phone opens the link, and you land on a page built to steal your login or your payment details.

The page on the other end is the same kind of fake you would see in any phishing attack, a login screen made to look like Microsoft 365 or a payment form that copies your bank. The QR code is only the delivery method that gets you there.

Why QR code scams get past your security

Two things make these scams effective.

First, the malicious link is hidden inside an image.

Most email security tools scan the text of a message for known bad links. A QR code is a picture, so the link inside it is not text the filter can read.

The UK’s National Cyber Security Centre points out that not all phishing-detection tools scan images, which is the reason criminals started using QR codes to disguise their links in the first place.

Second, scanning a code moves you onto your phone.

Your work computer probably has web filtering, endpoint protection, and DNS controls that block known bad sites.

Your personal phone usually has none of that. So the moment you scan, you step outside the protection your business pays for, often without realizing it happened.

How common are QR code scams?

The volume is climbing fast. In its report on email threats for the first quarter of 2026, Microsoft said it detected around 8.3 billion email-based phishing threats in those three months.

QR code phishing rose 146% across the quarter, from 7.6 million attacks in January to 18.7 million in March.

By the end of the quarter it had reached its highest monthly volume in at least a year.

Microsoft also found that most of these attacks arrived as PDF attachments, growing from 65% of QR code attacks in January to 70% in March.

The QR code sits inside a PDF, the PDF is attached to an email, and the whole thing looks like an ordinary document until someone scans it.

What QR code scams look like

These are the QR code scams that come up most often.

• A “security” email. You get a message that looks like it is from Microsoft or your IT team, telling you to scan a code to re-enroll your multi-factor authentication or keep your account active. The code leads to a fake login page.
• A shared document. An email says a colleague or client has shared a file, and you need to scan the code to view it. The page asks you to sign in first.
• A fake invoice. A PDF invoice includes a QR code “to pay faster.” The code routes your payment to the attacker.
• A delivery notice. A text or email about a missed package asks you to scan a code to reschedule. The US Federal Trade Commission has warned about this exact scam.
• A sticker in the real world. Attackers print QR code stickers and place them over legitimate ones on parking meters, posters, and payment terminals. You think you are paying for parking, and instead you are handing your card details to a stranger.

How to protect your business from QR code scams

Protecting yourself against Quishing comes down to a few habits:

• Be suspicious of QR codes in emails. A code that arrives by email, especially one that asks you to log in or pay, deserves the same caution as a strange link. The NCSC’s advice is to be wary of scanning QR codes inside emails, even though codes in places like restaurants are usually fine.
• Check the web address before you act. When you scan a code, your phone shows the link before it opens. Read it. If the address is not the official site you expected, close it.
• Go direct instead of scanning. If an email says your Microsoft account needs attention, open your browser and type the address yourself, or use a bookmark. Don’t rely on the code to take you to the right place.
• Watch for urgency. Messages that threaten account closure or a fine “within 24 hours” are trying to rush you past your own judgment. That pressure is itself a warning sign.
• Use phishing-resistant MFA. If a scam does capture a password, phishing-resistant multi-factor authentication (a passkey, a hardware key, or number-matching in an authenticator app) makes that password much harder to use.
• Check physical codes for tampering. Before scanning a code on a parking meter or payment terminal, look for a sticker placed over the original.
• Tell your team. Most people have never been warned about QR code scams. Send your staff a short message with a real example so they know what to watch for.

What to do if someone already scanned one

If you or someone on your team scanned a QR code and entered details on the page that opened:

1. Change the password for that account right away, along with any other account that used the same password.
2. Confirm multi-factor authentication is turned on for the account.
3. Tell whoever manages your IT, so they can check for unusual sign-ins.
4. If card or banking details were entered, call the bank and watch the account closely.

Acting quickly limits what an attacker can do with the details they captured.

Frequently Asked Questions

Are QR codes safe to use?

Most QR codes are safe. A code on a restaurant table or an official payment terminal is usually fine. The risk comes from codes sent in unexpected emails or texts, and from stickers placed over real codes in public. Treat those with caution.

What is quishing?

Quishing is phishing that uses a QR code instead of a written link. The word combines “QR” and “phishing.” The goal is the same as any phishing attack: to get you onto a fake page that captures your login or payment information.

Can antivirus or email filters stop QR code scams?

Not always. Many email security tools scan the text of a message for bad links, and a QR code hides its link inside an image, so it can slip through. Some products now scan images for codes, but you should not assume the scam will be caught before it reaches you.

Why is a QR code in an email more dangerous than a normal link?

A written link can be inspected by your email security and opened on a managed work computer. A QR code hides the link from those tools and pushes you to scan with your phone, which usually has far less protection than your work device.

What should I do if I scanned a scam QR code but didn’t enter anything?

If you closed the page without typing anything, the risk is low. Close it, don’t go back, and let your IT contact know so they can keep an eye out. If you did enter a password or payment details, follow the recovery steps above.

—

Featured Image Credit

This Article has been Republished with Permission from The Technology Press.

Small businesses are the most common ransomware target by volume of incidents, even though many small business owners assume hackers focus on larger organizations. A 22-person company has enough revenue to be worth attacking, no dedicated security team to defend it, and a publicly traceable footprint that takes about an hour to research.

What follows is a step-by-step walkthrough of how a small business gets attacked, written from the attacker’s side. The company in this account is composite, but the methods are accurate to current threat intelligence reporting. After the walkthrough, you’ll see five specific points where the attack would have been stopped by controls that come bundled with security tools most small businesses already pay for.

Monday: how I picked you

I work regular hours and run a small volume operation. My spreadsheet has about 40 prospects per month, and I prefer businesses between 10 and 50 staff. The reason for that range is economics. Large enterprises have security teams, incident response contracts, and lawyers who make recovery expensive on my end. At the other end of the scale, sole traders rarely have enough at stake to bother with. A 22-person commercial services company sits in the right zone: payroll, customer database, project files, supplier relationships, and an owner who will pay to get the lot back. The return per hour is better at this size than at either extreme.

I did not find you through a breach or a tip. I found you on a public business records portal. State business registries, federal contract awards, and county-level licensing databases publish enough detail for me to identify your company, look up your name, estimate your revenue, and pick the most useful person inside the business. One search told me your company name, your registered agent, the contract value of a recent municipal job, and the named contact on the submission.

The fact that nothing has gone wrong at your company yet is the strongest signal I get. It tells me your credentials are probably still valid, your staff has not been trained to spot anything, and nobody has had a reason to change a password. A clean record is the first indicator I look for.

Tuesday: building your org chart for free

I spend about 40 minutes researching your company today using only a browser.

LinkedIn gives me eight of your current employees with their job titles listed. Your office manager has been there for six years and lists “accounts payable, payroll, and supplier invoicing” in her profile summary. Your second admin joined 14 months ago. You list yourself as director, with a sparse profile and a low connection count, which tells me you are unlikely to notice when someone unusual starts engaging with your profile or your company’s social media.

Public business filings confirm your registered business name and your full legal name. A “meet the team” post from two years ago on your Facebook page lists first names and photos, including someone described as helping out in the office a couple of days a week. One of the commenters shares your surname.

I now know who handles your money, what their name is, how long they have been there, what software they probably use (I will check your job ads on Indeed for the phrase “experience with QuickBooks or Sage”), and who in your business has the authority to approve a payment without a second signature.

That last person is my primary target. You are harder to reach and probably more cautious. Your office manager has system access, handles supplier payments, and is busy enough that one more email in her inbox does not get scrutinized the way it might if she had nothing else to do.

I have not spent a dollar yet.

Wednesday: I bought your credentials for $14

Stealer logs are credential packages harvested by infostealer malware that infected someone’s personal device, often months or years earlier. The malware records every username and password typed into the machine, then bundles the data for sale. Marketplaces on Telegram channels and forums let buyers search these logs by company email domain.

I search for your company’s email domain. Two results come back. One is your office manager’s work email, with a password that looks like it was saved in her browser. The other is a personal Gmail address that appears to belong to a family member of yours, probably from a device that shared a home network.

I pay $14 for the package. It takes four minutes.

Your office manager’s password follows a common pattern: a pet or child’s name combined with a year and an exclamation mark. I check it against HaveIBeenPwned, which is the same free database security professionals use, and find that it appeared in a credential dump from a retail loyalty program breach three years earlier. The password has not been changed since.

Your family member’s credentials are more interesting than they look at first. The same password, with minor variations, shows up across a streaming service, a gaming account, and your company’s Microsoft 365 login. The password works. The only thing standing between me and the inbox is the second factor.

Total spend so far: $14.

Thursday: getting past your MFA

Multi-factor authentication stops a lot of attacks, but the implementation matters more than the checkbox.

Simple push-notification fatigue does not work against your office manager’s account. Microsoft enabled number matching by default for all Microsoft Authenticator push notifications in May 2023, which means she would have to type a code from her login screen rather than just tap approve. Push bombing fails against that configuration.

What still works is adversary-in-the-middle (AiTM) phishing. I send your office manager an email designed to look like a routine Microsoft 365 password reset notification, citing the breach that her password appeared in (the same breach I found her credentials in earlier in the week). The link in the email takes her to a page that mirrors the real Microsoft sign-in screen. That page is a proxy I control.

When she enters her password and approves her MFA prompt, my proxy forwards both to the real Microsoft login server. Microsoft validates the credentials, completes the MFA challenge, and issues a session token back to my proxy. I capture the token. She sees a normal login experience on what she thinks is the real Microsoft site, then a “password updated successfully” message.

I am now signed in as her. The MFA prompt succeeded, and the session token sits in my browser instead of hers. Microsoft sees a valid authenticated session and treats my activity as legitimate.

I had a backup plan in case the email did not get clicked. Earlier in the day, I called your office posing as your IT support company, using a name I found in a Google review you had left 18 months earlier. I told your receptionist that we were seeing unusual login activity on the office manager’s account and that I would need her to approve a verification push in the next few minutes. She said the office manager was not at her desk. I said no problem, I would try again later. The call cost me nothing.

By Thursday night, I am inside your office manager’s Microsoft 365 account. I set up an inbox forwarding rule so her emails copy to an address I control without notifying her, then I wait.

Friday 2:47pm: why I waited 36 hours before encrypting

I spend 36 hours reading email before I encrypt anything. That dwell time is how I size the ransom correctly.

In those 36 hours, I find your cyber insurance policy attached to an email from your broker, with a cyber liability sub-limit of $250,000. A bank reconciliation your office manager sent you two weeks ago shows your business account at around $180,000 at month end. Your customer list sits in a quote template she emailed to herself, and a message thread with a municipal project manager mentions a job starting in three weeks with a hard deadline you cannot afford to miss.

I set my ransom at $65,000 in cryptocurrency. That figure is low enough that you will pay rather than fight it, high enough that it is worth my time, and well within what I know you can access. Ransoms set above 10 percent of visible liquid assets tend to get contested. The figure I picked sits below that line.

I deploy the encryption payload at 2:47pm on Friday. The timing is deliberate. Your bookkeeper finishes at 3pm on Fridays, which I know from an out-of-office reply I saw in the forwarded emails. You are on a job site, with your calendar synced to the shared inbox. The person most likely to notice something wrong and call for help is already gone, and the person with the authority to make decisions is unreachable.

By the time anyone understands what has happened, it is a Friday evening, every file on your shared drive is encrypted, and a ransom note sits on every screen in your office.

Total cost to me: $14 for credentials and about six hours of work spread across the week.

Five places this attack would have died

The attack on your business worked because five ordinary things were not in place. None of them were expensive. Most were already bundled into security tools you already pay for.

1. The credential purchase on Wednesday.

HaveIBeenPwned is free. Microsoft Entra password protection can detect and block reused or commonly-compromised passwords across your accounts. Enforcing unique passwords per account, through a password manager and through Entra’s policies, makes a stolen credential purchase useless for me.

2. The MFA bypass on Thursday night.

Microsoft already blocks the simpler push-bombing attack, because number matching has been enabled by default for all Microsoft Authenticator push notifications since May 2023. The current dominant credential-based bypass is adversary-in-the-middle phishing. Defenses include phishing-resistant MFA (FIDO2 hardware keys, passkeys, or Windows Hello for Business), Conditional Access policies that require a compliant or hybrid-joined device, and anti-phishing protection in Microsoft Defender for Office 365. Any one of these would have either prevented the session token capture or made the captured token unusable from my IP address.

3. The inbox forwarding rule.

Microsoft 365 allows admins to block external email forwarding rules at the tenant level. With that block in place, the inbox forwarding rule I used to read 36 hours of email would not have worked. I might have encrypted anyway, but I would have been guessing on the ransom size.

4. The 36-hour dwell time.

Microsoft Defender for Business, included in Microsoft 365 Business Premium, generates an alert when a new inbox forwarding rule is created. If anyone had been watching those alerts, or if the alerts had been routed somewhere visible, I would have been detected on Thursday night. The most impactful change for a business your size is rarely a new product purchase. The improvement comes from someone reviewing the security alerts that the tools you already pay for are already generating.

5. The public business records.

You cannot unpublish a state contracting registry or a federal contract award. That data will stay public. What you can control is what your team chooses to post about their specific responsibilities. Your office manager’s LinkedIn profile listed her financial responsibilities in enough detail to make her the obvious target. That detail is worth a conversation with your team, framed as practical security awareness rather than a rule about what people can post.

Three questions to send your IT provider

These three questions cover most of where the example attack failed. Each one corresponds to a control that comes bundled with security tools you most likely already pay for.

1. Are we using phishing-resistant MFA (FIDO2 keys, passkeys, or Windows Hello for Business) for finance, admin, and executive logins?
2. Is external email forwarding blocked at the tenant level?
3. Are our security alerts going somewhere, and is someone reviewing them?

Frequently asked questions

Do hackers target small businesses?

Yes. Most ransomware operations target small and mid-sized businesses because the ratio of payout potential to defensive resources is higher than at either extreme of company size. The volume sweet spot is roughly 10 to 50 staff, where there are assets worth encrypting but no dedicated security team to defend them.

What is adversary-in-the-middle (AiTM) phishing?

AiTM phishing is a technique where the attacker hosts a proxy page that mirrors a real login screen, such as Microsoft 365 or Google Workspace. When the user enters credentials and approves the MFA prompt, the proxy captures the resulting session token. The legitimate service treats the login as successful, but the session token ends up in the attacker’s browser. AiTM has become the dominant credential-based attack vector against Microsoft 365 tenants after the default rollout of number matching ended simpler push-bombing attacks.

What is a stealer log?

A stealer log is a package of credentials harvested by infostealer malware from an infected personal device. The logs include browser-saved passwords, session cookies, and stored authentication tokens, and they are sold on underground markets for $10 to $20 per package. The malware that creates them typically infects personal computers through pirated software or malicious browser extensions.

How much does it cost an attacker to compromise a small business?

In the example walkthrough above, the total spend was $14 for stolen credentials and about six hours of work. Costs vary, but the threshold to attempt the kind of attack described in this post sits well below $100.

Are there free tools that would have stopped this attack?

Several of the controls referenced in the walkthrough come bundled with Microsoft 365 Business Premium licenses that businesses in this size range typically already hold. External forwarding restrictions and Defender for Business alerts are configuration changes rather than new purchases. HaveIBeenPwned is a free check available to anyone. Phishing-resistant MFA hardware keys are a small per-user cost compared with the cost of a successful ransomware incident.

Sources and further reading

• CISA: Stop Ransomware Guide — federal guidance on the controls referenced throughout this walkthrough.
• Microsoft Learn: How number matching works in MFA push notifications — Microsoft’s documentation on the default-enabled Authenticator feature that blocks push-bombing attacks.
• HaveIBeenPwned — the free database used to check whether an email address has appeared in known breaches.
• Microsoft Learn: Configure external email forwarding in Microsoft 365 — how to block tenant-level external forwarding rules.

If any of this walkthrough sounded uncomfortably similar to your environment, the three questions above are a good starting point. Your IT provider should be able to confirm what is in place and what is not within an hour or two. And if you don’t have an IT provider, feel free to reach out to us and we’ll help you sort it.

—

Featured Image Credit

This Article has been Republished with Permission from The Technology Press.

Most cyberattacks do not start with a sophisticated intrusion. They start with a click on a personal email, a reused password, or a file uploaded to a familiar cloud service because the approved option felt slower.

The Verizon Data Breach Investigations Report found that 68% of breaches involve the human element. 

Not a zero-day exploit. Not a brute-force attack on a hardened system. Human behavior, in the course of an ordinary working day.

For businesses running cloud-based workflows across multiple devices, the personal and professional overlap is now the rule. Understanding where that overlap creates risk is no longer optional. It is a core part of modern security strategy.

The Risk Sitting Outside Your Security Stack

Personal web habits are not reckless behavior. They are normal behavior.

Checking a personal inbox on a work laptop. Logging into a social account during a break. Saving a work password in a browser already loaded with personal accounts. Uploading a document to a storage service because it is faster than the approved option.

None of these feel like security decisions in the moment. But each creates a connection between personal digital activity and business systems, and that connection sits outside most traditional security controls.

Hardening systems, deploying tools, and locking down networks addresses part of the problem. The rest moves with the people.

How Personal Web Habits Create Business Exposure

Personal channels are phishing’s preferred territory

Personal inboxes, messaging platforms, and social media feeds are where phishing thrives. 

These environments are harder to filter, easier to spoof, and loaded with the emotional triggers that make people act before they think.

When those channels share a device or browser with business systems, a single click can cross the boundary instantly.

Phishing is the most common entry method for attackers precisely because it exploits distraction rather than technical weakness. The target does not need to be careless. They just need to be busy.

Password reuse turns personal breaches into work incidents

Password reuse is one of the most direct connections between personal and professional exposure. 

When credentials from a personal account are compromised, attackers run them against business systems automatically. This technique, credential stuffing, is low-effort and highly effective because so many people use the same password across multiple accounts.

Unique credentials for every account, combined with multi-factor authentication, break that chain. 

A personal breach has nowhere to go when the work account requires a second factor that the attacker cannot relay.

Shadow IT is usually about convenience, not defiance

Most unauthorized tool usage does not begin with disregard for IT policy. It begins with a productivity gap. Employees use personal cloud storage, consumer messaging apps, or AI tools because they are faster and more familiar than the approved alternative.

The security risk is not the intention behind the choice. It is what happens to the data. 

Once business information moves into platforms that IT cannot see, audit, or secure, it falls outside every control in place. The tool usage is predictable. The data exposure is not.

Why Blocking Behavior Doesn’t Work

The instinct is to lock things down: block personal apps, restrict browsing, enforce strict device policies.

In practice, blanket restrictions rarely stop the behavior. They relocate it. Users find workarounds. Unapproved tools move to personal devices. IT teams lose visibility into exactly the activity they were trying to manage. 

The risk does not disappear. It moves somewhere harder to see.

Security strategies that assume perfect compliance perform poorly in real workplaces. The goal is not eliminating the overlap between personal and professional digital activity. It is managing it without breaking how people work.

What Actually Reduces Risk

The controls that work are the ones that match how people actually operate.

Separate contexts, not people

The simplest way to reduce crossover risk is to reduce crossover. 

Separate browser profiles for work and personal activity, clear guidance on where business accounts should be accessed, and identity boundaries that prevent accidental mixing all reduce exposure without restricting what people do with their time.

This is not about surveillance. It is about creating enough distance between personal and professional digital activity that a compromise in one does not automatically reach the other.

Design for credential failure

Assume passwords will eventually be exposed somewhere. Design for that outcome rather than hoping to prevent it.

CISA reports that enabling multi-factor authentication makes accounts 99% less likely to be compromised, even when the underlying password has already been stolen.

MFA converts the most common attack path into a dead end. 

Stolen credentials from a personal breach cannot reach a work account that requires a second factor. A password manager handles unique credentials across every account, making that protection sustainable without placing an unrealistic burden on users.

Make secure behavior easier than unsafe behavior

Personal web habits are not dangerous by default. Ignoring the risk they create is. The most secure environments today are not the most restrictive. They are the most realistic: built around how people actually work, designed to contain failure when it happens, and focused on making safer behavior the path of least resistance.

Helping clients reduce human-driven security risk is one of the most impactful services an MSP can offer. 

Contact us or schedule a consultation to review current controls and identify where the most important gaps are.

—

Featured Image Credit

This Article has been Republished with Permission from The Technology Press.