AI agents are designed to act without waiting for a human to approve each step, and that same...
Weekly Briefing • September 18, 2026
Nothing this week came through the firewall. The most expensive item was an email with no attachment, no link, and a clean authentication record. The one with the most medical records attached happened on a network in San Francisco that belongs to a software company most patients have never heard of. The third is how client files can leave a practice through a consent screen, in about the time it takes to click Allow.
Your security controls sit around your network. All three of these happened outside it — in your payment approval process, in a vendor's building, and in a browser tab. Here's what happened, and what it means for how your firm operates.
Between August 3 and 5, Microsoft tracked a single campaign of more than a million emails, 87.7 percent of them landing in US inboxes. Each one impersonated an executive at the company receiving it and asked accounts payable to process an ACH payment of just under $50,000. Underneath the executive's signature sat a ServiceNow subscription invoice: branding, invoice number, issue and due dates, itemized lines, and bank details pointing at accounts the attacker controlled. Microsoft found no evidence that ServiceNow, or any other company named in those emails, was compromised. The whole operation ran on a lookalike domain registered on July 31, days before the first message went out.
Here is why filtering did not stop it. There was no attachment to scan and no link to check, because the invoice was drawn directly into the body of the email as HTML. The executive's name appeared only in the display name, the signature, and the reply-to label, while the message itself was sent through a real, working third-party email service. SPF, DKIM, and DMARC all check the sending service, and the sending service was legitimate, so the mail passed every authentication test and arrived with no warning banner attached to it. The fraud lived entirely in the parts a person reads and a filter does not.
Key Insight
Every signal that made that invoice look approved — the name in the From field, the signature block, the invoice layout, the forwarded thread underneath it — was typed by the person asking for the money. None of it required access to anything you own.
Microsoft also found the fingerprints of generative AI in how the templates were assembled: heavy HTML commenting, near-identical structure across samples, the same invoice details reused while the company and executive names changed for each target. That is mass production, and it means the version aimed at a twelve-person practice costs the sender no more than the one aimed at a hospital system. Microsoft listed IT services, business advisory, and consumer goods among the industries hit, and nothing in the method is specific to any of them. The tells that survived are human ones: the quoted "forwarded" conversation carries no date headers, which genuine forwarded mail always has; the subject lines use phrases like "due bill" and a misspelled "ACH Parment"; and in one thread the CEO asks not to be copied, then announces in the next message that he is sending it himself. Tell whoever opens your mail to read the thread, not the signature. Full analysis here: AI-Assisted Executive Impersonation Fuels Invoice Fraud at Organizations.
zHealth, a San Francisco company selling cloud practice management and electronic health records software, has reported that 118,563 people had information exposed: names, medical information, and health insurance information, varying by person. The dates are the part to sit with. Someone was inside zHealth's network between January 20 and January 21 of this year, roughly one day. The company did not learn that information may have been copied until around June 15. The review establishing whose data was actually involved finished on September 3. Intrusion to finished answer: about eight months. Affected people are being offered twelve months of single-bureau credit monitoring. zHealth has not said how the attacker got in.
If your practice runs on a hosted EHR or practice management platform, that timeline is part of what you bought. Your patients' records sat in a building you do not own, the window opened and closed before anyone noticed, and your first notice arrives in a letter you had no hand in writing. The shape repeats across the same set of disclosures: a benefits administrator traced its breach to a single employee email account and still reported Social Security numbers exposed, and one intrusion at a credentialing vendor reached about 75 of its customers at once. One break-in at a vendor becomes a notification obligation at every practice on the platform.
Two things follow from that. The call worth making this month is to your EHR or practice management vendor, asking in writing which of your patient records sit in their environment and how quickly they commit to telling you when something happens. Your business associate agreement should say how quickly they must tell you. The second is what you tell patients who ask. Credit monitoring watches for new credit accounts being opened. It does not watch claims submitted to a health plan or prescriptions filled in someone else's name, which is what medical identity theft actually looks like. The check that finds that is reading the explanation of benefits statement line by line. Full analysis here: Health Records Vendor Discloses Data Breach Affecting 118,000 Individuals.
Intezer reviewed roughly 16.9 million enterprise security alerts and found about 73,000 tied to AI tools and agents, a volume that grew 685 percent between February and June this year. Sorted by outcome, 94.1 percent were noise, 5.8 percent were genuine exposure, and 0.02 percent were real attacks. That headline is about alert fatigue inside large security teams, which is not your problem if you have eleven people and no security team. The second finding is.
A large share of AI use never produces a security alert at all, because nothing runs on the machine. Somebody grants a third-party AI application consent to their Microsoft 365 account, or pastes a document into a chat window. Both move your information to an outside company, and neither one looks like an event to any tool watching the endpoint. The researchers saw exactly that: OAuth consent granted to ChatGPT across several customer tenants, first sign-in events for OpenAI, and at one customer a cluster of data-protection alerts for uploads into generative AI tools. For a firm like yours, client files and contract terms sent to a processor nobody approved is a disclosure question, not a tidiness question.
Three questions you can answer this month without buying anything: which AI applications currently hold standing access to your Microsoft 365 tenant, and who approved them; whether the free tier your staff signed into permits prompts to be retained for training; and whether your engagement letters or patient consents actually cover sending that material to a third party. In the environments we manage, a consent grant handing an outside application standing access to mail or files shows up as an identity finding rather than disappearing into tenant logs, which is the only place that activity leaves a trace. The same research also found AI brand names being used as bait: an invoice fraud lure citing a supposed Anthropic approval to justify a large payment, a fake Gemini Ads invitation, and an "OpenAI Partner Summit 2026" invite delivered through genuine Zoom infrastructure. Those land in your finance inbox, not with your IT provider, which is where this briefing started. Full analysis here: Enterprise AI Adoption Reshapes SOC Detection for Claude, Codex and Cursor.
China-Linked Actors Exploit Chrome and Windows Zero-Day Chain to Deploy GRIMWEDGE — Last week's briefing noted that two of September's patched flaws were already being exploited. Volexity has now shown what one of them, CVE-2026-85880, was being used for: a chain of three bugs, two in Chrome and that one in Windows, that turns a single click into code running on the machine. The targets were non-governmental organizations, so this is not aimed at your practice. Two details are, though. The lure linked to a genuine US university website and abused a flaw on that site to bounce visitors onward, so hovering over the link showed a real .edu domain and told the reader nothing. And Chrome downloads its update in the background but does not run the new version until the browser is restarted, which means an inventory report saying every machine is on the current version is not the same as every machine running it. Anyone who has kept forty tabs open for three weeks is still on the old one. Closing and reopening the browser is all it takes to finish the Chrome update.
Fake AI Trading Agent Steals Crypto Wallet Passwords and Deploys XWorm — HP spent April to June tracking a website advertising an autonomous AI trading agent, and what it installed is the useful part. The download contained a genuine Microsoft-signed Windows utility, renamed "Trading Agent.exe," whose only job was to satisfy the reputation check so Windows raised no warning, plus an attacker library beside it that the signed program obligingly loaded. The same research followed invoice-themed campaigns from the same toolkit to XWorm, a remote access tool that gives an operator hands-on control of the machine, and to stealers that read saved browser passwords. Two of the signed installers HP examined change the browser's default search engine and keep the change after they are uninstalled. A signature tells you who built a file. It does not tell you what the file does.
One Thing to Do This Week
Write one sentence and hand it to whoever pays your invoices: "Any invoice over an amount we set, and any request to change where a payment goes, gets confirmed by phone on the number already in our records before it is paid — including when the request comes from me." Say that last part out loud to them. This fraud works because a clerk who follows the rule is, in that moment, questioning the owner, and the rule only holds if it came from the owner first. The number in the invoice, the number in the signature block, and the number in the email footer do not count; the point is to move the conversation onto a line the sender does not control. Microsoft's campaign asked for just under $50,000, and many finance teams set the threshold somewhere in the low five figures. This takes one conversation and a note above the desk.
Get the Monthly Briefing
Once a month I pull the threats that actually mattered into one short read — what happened, what it means for firms like yours, and the one thing worth doing about it. Subscribe using the form at the foot of this page.
Brian Sammons has managed IT environments for Ohio professional service firms — medical, dental, legal, accounting, and financial — since 2004. He writes the Weekly Briefing for the owners, administrators, and IT managers responsible for keeping those firms running: what happened in security this week, and what it means for yours.
Questions about how this affects your environment? Schedule 15 minutes and I'll walk you through it.
Weekly Briefing • September 11, 2026
Three attacks this week, and in every one of them the part a security tool would have inspected was legitimate. A phone call talked a help desk into resetting an employee's second factor, so the sign-in that followed was one the identity system had just approved. A phishing page was never hosted on any server; the victim's own browser assembled it in memory at the end of a redirect chain that ran almost entirely through Microsoft. And a remote access trojan arrived as a PDF, opened a real legal brief from a university website as cover, and was flagged by 0 of 76 antivirus engines on the day it was analyzed.
For three weeks this briefing has said the session is what attackers are after. This week is about what that does to the tools most firms rely on. Filters, blocklists, and antivirus all work by finding something bad to point at, and none of these attacks left one. Here's what happened, and what it means for how your firm runs.
Health-ISAC, the threat-sharing center for the health sector, warned its members in July about a rise in successful attacks by ShinyHunters, a group that steals data and demands payment to keep it off its leak site. There is no ransomware in this, no locked workstation, no downed EHR. The victims it names run across the sector: the device makers Medtronic and iRhythm, One Medical, DentaQuest in dental benefits, AdaptHealth in home medical equipment, and Hims & Hers in telehealth. The way in isn't malware. It's a phone call. The caller reaches the help desk, or whoever handles account access, gets through the verification questions, and asks for a password reset, an MFA reset, or a new device enrolled on the account. In one recent health-sector incident the group said it called several employees before one Microsoft Entra account gave way, then pulled data out of Microsoft 365 and SharePoint.
What makes it fast is what the attacker sees after signing in. The single sign-on dashboard, whether Okta, Entra, or Google, lists every application that account can reach: Microsoft 365, SharePoint, Dropbox, Salesforce, and whatever else the firm has connected. No scanning, no working across the network, no privilege to escalate. The dashboard does the reconnaissance, the downloads run at cloud speed, and the first sign anyone sees is the message saying the data is already gone. Nothing was written to a workstation and no process ran on a managed laptop, so endpoint protection has nothing to examine. The session was one the identity system approved, on a device the help desk had just enrolled through its own reset procedure. Clinical systems keep running the whole time.
Key Insight
Whoever can reset a password or a second factor at your practice is part of the perimeter. That reset procedure carries the same weight as a firewall rule, and it is usually run by someone judged on how quickly the call gets closed.
For a firm your size, the help desk is your IT provider, or the office manager who set the Microsoft accounts up in the first place. The control Health-ISAC puts first costs nothing: no password reset, MFA reset, or device enrollment is completed on the inbound call. Whoever takes the call hangs up and calls back on the number already on file, and anyone with admin rights needs a manager's approval on top. Then there is the part that outlasts the incident. If patient records were in that SharePoint, HIPAA requires notice to the affected individuals and to the HHS Office for Civil Rights whether you pay or not. Paying buys silence, not the data back, and not relief from the obligation. In the environments we manage, Adlumin correlates the sequence that precedes an export, a reset followed by a new device followed by bulk downloads, which matters because each step on its own is a login the tenant considers valid. The full detection list and the 30-to-60-day hardening plan are in the write-up: Health-ISAC Warns ShinyHunters Steals Healthcare Data in Rising Attacks.
Barracuda's researchers documented a phishing campaign in which the fake Microsoft login page is never hosted anywhere. The email is a DocuSign-style signature request with a calendar invite attached. The link goes to Microsoft's genuine sign-in endpoint. A crafted redirect parameter then hands the session to Microsoft Teams, which loads a file from an outside content domain, and from there the victim's browser assembles the login form in its own memory as a "blob" address, a temporary pointer that exists only inside that tab. Every hop your mail filter, link rewriter, or web proxy can check resolves to Microsoft. There is no lookalike domain to register and no web server to take down, because there is no page until it reaches the user's machine.
The controls most firms have already paid for are keyed to a hosted page and a suspicious domain, and this chain has neither. It also doesn't sit still. The page stays connected to the operator through a background script and a messaging channel, so what the victim sees can be changed mid-session, and a sandbox can be shown something different from what a real employee sees at the same link. Barracuda found configuration for a centrally managed platform running across many victims at once. One-time codes and push approvals are exposed here, since the operator relays what the person types as they type it, and the sign-in that results is logged as successful and policy-compliant. When the tab closes, the page is gone: no URL to report, no copy to preserve as evidence, and an investigation rebuilt from sign-in and mailbox audit records instead. Barracuda's first recommendation is phishing-resistant MFA, a passkey or a FIDO2 hardware key, because it binds the login to the real site and a form assembled in memory has nothing usable to relay. The staff rule is simpler: a signature request nobody was expecting gets checked with the sender by phone before anyone signs in, even when the address bar shows Microsoft. The detection signals and the order to apply the controls in: Attackers Build Phishing Pages That Exist Only Inside Victims' Browsers.
Huntress found tampered Exodus cryptocurrency wallet installers on four unrelated customer networks between late July and mid-August. Three of the four were hit on August 18, within 85 minutes of each other, by an installer compiled the day before. Nobody in those offices was shopping for a crypto wallet. What they opened was a document that arrived through the browser: a file named to end in .pdf.js, which Windows displays as a PDF because it hides known file extensions by default, or a ZIP holding a single script, run from inside Explorer's compressed-folder view without ever being extracted. Two of the victims believed they were opening work material. One got a marketing ebook. One got a legal brief, pulled live from Georgetown Law's website. Both documents were real and opened normally, and both were hosted on domains nobody had a reason to question. In the background the script installed a genuine copy of the Exodus wallet, made sure it never showed a window, and used it to load a remote access trojan straight into memory. At the time of analysis, 0 of 76 antivirus engines on VirusTotal flagged the installer.
The wallet was packaging. What runs inside it is a general-purpose remote access toolkit: a stealer that takes passwords, cookies, and autofill data out of Chrome, Edge, and Firefox; a hidden remote-desktop module that opens a second, invisible Windows desktop and runs a copy of the employee's browser profile on it, so the operator browses as your employee while the employee keeps working on the screen in front of them; and a proxy that sends the attacker's traffic out through your firm's own internet address. It relaunches every hour through a scheduled task registered in a way that leaves no command line behind, and it blanks the proxy settings so its traffic never reaches whatever would have inspected it. Its instructions travel through Microsoft's Azure storage service, a domain on nobody's blocklist. For a law office, a brief arriving as a PDF is routine. A stolen cookie from that session carries the operator past single sign-on and MFA and keeps working after the password changes, and the hidden desktop means the bank portal or the practice management system is being used inside a session your employee legitimately opened. Huntress's hardening list is short and none of it is exotic: show file extensions so a .pdf.js name reads as what it is, block scripts from running out of the download and temp folders, and stop installers from running out of folders a standard user can write to. Those are policy settings, not per-machine work, which is the question to put to whoever manages your endpoints. The full chain, the artifacts to hunt for, and the cleanup order: Trojanized Exodus Wallet Installer Delivers Modular RAT via ClickFix Lure.
September 2026 Patch Tuesday Addresses 999 CVEs Including CVE-2026-58611 — Rapid7 calls this by far the most CVEs Microsoft has ever published in a single day, 974 in its own products and 723 of those in Windows, and two are already being exploited. Both let someone who already has a foothold on a PC as a standard user climb to full control of that machine, which is the step that turns one compromised mailbox into the whole network. Two things a practice can act on without reading a CVE: the kernel and driver fixes do nothing until the machine restarts, so an update report that says complete on a laptop nobody has rebooted since Tuesday isn't done; and three older products reach the end in October 2026. Office 2021 leaves support on October 13, the last paid update year for Windows Server 2012 ends the same day, and the paid extended updates for Exchange Server 2016 and 2019, out of support since October 2025, end the same month. Anything still running on them stops getting fixes for flaws like these.
ClickFix Moves Into the Browser With Tampermonkey Cryptocurrency Theft — Last week's briefing covered ClickFix as a command pasted into the Windows Run box. Cisco Talos now has it running inside Chrome: the target pastes JavaScript into the address bar, or a script into the Tampermonkey extension, and the code rewrites what the page shows, in this case swapping cryptocurrency deposit addresses, with its instructions fetched from a public Google Sheet so the traffic looks like Google Docs. The crypto angle won't touch most practices. The mechanism will, because the same script pointed at a payroll portal or a bank site rewrites what an authorized user sees and submits, and a script loaded into a signed-in Chrome profile follows that profile to the home laptop. The control is an allowlist of browser extensions on managed devices, and last week's staff rule now covers "paste this into your browser" as well.
One Thing to Do This Week
Ask one question this week of whoever resets passwords and second factors for your practice, whether that is your IT provider or the person in the office who set the Microsoft accounts up: "If someone calls saying they're me and they're locked out, what do you do?" The answer you want is that they hang up and call you back on the number already on file before anything gets reset. If that isn't the answer, make it the rule this week and put it in writing where the resets happen. Health-ISAC calls that one procedure the most important control available against this group, and it takes a single phone call to put in place.
Get the Monthly Briefing
Once a month I pull the threats that actually mattered into one short read — what happened, what it means for firms like yours, and the one thing worth doing about it. Subscribe using the form at the foot of this page.
Brian Sammons has managed IT environments for Ohio professional service firms — medical, dental, legal, accounting, and financial — since 2004. He writes the Weekly Briefing for the owners, administrators, and IT managers responsible for keeping those firms running: what happened in security this week, and what it means for yours.
Questions about how this affects your environment? Schedule 15 minutes and I'll walk you through it.
Weekly Briefing • September 4, 2026
None of the three incidents we tracked this week involved anyone breaking in. In every one, the person who got hit did the install. A web page asked an employee to paste one line into Windows, and they did. A recruiter asked a target to load a meeting app for an interview, and the app was a remote-control tool. And nineteen browser extensions that did exactly what they advertised, one of them for about 80,000 users, turned into credential grabbers through a routine automatic update nobody was asked to approve.
There is no attachment to filter and no exploit to patch in any of that, which is the point. Here's what happened, and what it means for how your firm runs.
Huntress documented the current run of ClickFix attacks, and the mechanism is worth knowing by name because it is built to get past every filter you have. A web page shows a fake "verify you're human" check, or a broken-file error, or a download prompt, and it walks the visitor through opening the Run box (Windows key + R) and pasting what's on the clipboard. The page already put the command there. All the person does is press a few keys. There is no attachment for the mail filter to strip and no download for endpoint protection to block, because your employee typed a command into their own computer, and that is exactly what it looks like.
What runs is an infostealer. It reads every saved password and every session token out of the browser, usually in under a minute, and sends them out. The session token is the part that changes the math. It isn't a password to guess. It's the record of a login your employee already completed, second factor and all, and replaying it in another browser produces a signed-in session with no MFA prompt at all. Since most firms have put email, files, and the finance and HR systems behind one Microsoft or Google login, one harvested token opens all of them at once. The theft happens on the workstation in under a minute. The damage happens in the cloud, hours or days later, from somewhere else, and it looks like your employee logging in.
Key Insight
A stolen session token is not a stolen password. It is a login your employee already finished, MFA included, now running on someone else's machine.
Huntress describes what that kind of access turns into once someone holds it. A small real estate firm had MFA on every account except the CEO's, removed at his own request. The attacker sat in that mailbox and learned how he wrote to his finance team: a customer name, an account number, an amount, and a one-word confirmation back. Then they copied the pattern and sent a test payment comfortably under $1,000. It cleared. The amounts climbed until the CEO noticed the balance looked wrong and asked for a transaction list, and finance sent back the emails he had supposedly written. One personal exception, and the business almost missed payroll; every other control was in good shape. Two things follow for your firm. The exception here was the CEO's, the account finance took payment instructions from, and that is where this landed. And if an account is ever compromised, changing the password does not sign the attacker out. The active sessions have to be revoked first, or the reset closes a ticket while the intruder keeps working. The full chain and the identity controls that break it: Identity Hardening Controls That Blunt ClickFix and Credential Abuse.
Huntress and AnyDesk's fraud team traced a set of scam call-center operations, several of them in Kolkata, running their fraud through the same remote monitoring and management software an IT company uses: cracked, self-hosted ScreenConnect servers resold to other crews as branded subdomains, alongside AnyDesk. The way onto the victim's machine is a conversation. Matt Caldwell, AnyDesk's director of fraud prevention, got the lure in his own inbox: a fake Pepsi recruiter asking him to download a meeting app for the interview. The app was a cracked remote-control client. No exploit and no malware in the usual sense, just a believable reason to run an installer and a pretext the target would rather not mention to anyone who might stop it. Huntress puts remote-access-tool abuse up 277% last year and finds it in almost 40% of the incidents its response team investigates, which makes it the number one threat they track across roughly five million endpoints.
The reason it works is that a rogue install is identical to a legitimate one: the same signed installer from the vendor, the same folder on disk, the same connection back to the vendor's relay servers. Antivirus has nothing to object to. In one case Huntress worked, a user clicked a ScreenConnect lure in February and the operator didn't sign in until July. The tool sat there for five months, because a remote-access client on a business PC doesn't look out of place. When the operator finally connected, they worked inside the user's own session: the browser, the mailbox, new inbox rules to hide replies, and a run of spam from the firm's own domain pushing a second remote tool at new targets. That outbound mail is what tripped the alert.
Now think about what's on the screen of the person who takes that call at your practice: the bank portal, the payment approval queue, the one-time code they type while the operator watches, patient or client records open in another window. If a wire goes out from a session your own employee started, the bank has a strong argument that the instruction was legitimate, and the loss tends to stay with you. And if regulated records were visible during the session, your counsel may have to treat that as access to the data, which can put you into notification territory with nothing copied. The fix is a decision before it is a product: name the one remote-support tool your IT provider uses, and treat any other one on a workstation as an incident rather than a maintenance ticket. The detection and response sequence is in the full breakdown: Attackers Abuse AnyDesk and ScreenConnect RMM Tools for Remote Access.
Socket's researchers identified nineteen browser extensions, eighteen in the Chrome Web Store and one in Microsoft's Edge store, carrying code that steals credentials, session cookies, and cryptocurrency wallet data. The crypto angle gets the headline and probably doesn't touch your practice. The mechanism does. The operator built fourteen of the extensions from scratch and bought the other five from their original developers, and those five had real users and worked exactly as advertised until a new version arrived with the payload. The largest, Enable Right Click & Copy, has about 80,000 users across Chrome and Edge. Chrome updates extensions automatically by default, so the poisoned build landed on every one of those users with no click, no warning, and no new permission prompt.
Once active, the code strips the security headers from every page the browser loads and injects its own scripts: a form grabber that captures whatever gets typed into any login page, account stealers for Facebook and LinkedIn, a browser-history collector, and a fake browser-update prompt that walks the user through pasting a command, the same trick as the first story. An extension with access to all sites reads the authenticated pages your staff already have open, which means whatever they're signed into: practice management, webmail, the payroll portal. No password is needed, because the extension is inside the session. We flagged a banned extension that had reappeared in the Web Store in the August 15 briefing; this is the same lesson at scale. A store listing tells you an extension was clean when it was reviewed and nothing about who owns it now. Removal from the store doesn't uninstall it from the machines that already have it, and no signal fires anywhere when a developer sells. The durable fix is an allowlist on managed devices, so nothing installs or updates without someone looking at it first. All nineteen extension IDs and the removal steps: 19 Malicious Chrome and Edge Extensions Steal Wallet Data and Drain Crypto.
GTG-1002 Abuses Claude Code While EchoLeak Hits Microsoft 365 Copilot — the half of this that matters for a practice is EchoLeak: a single crafted email, read by Microsoft 365 Copilot during a routine summary, pulled data out of OneDrive, SharePoint, and Teams with nobody clicking anything (rated 9.3 out of 10). Microsoft fixed it on their side. What they didn't fix is that Copilot reads everything the user's account can technically open, including the shared folders nobody remembers granting access to, so if you've turned it on, the permissions cleanup comes first.
Rhysida Ransomware Hits Berlin State Network as City Refuses to Pay — Berlin refused, and the operators posted a claim of 5.79 terabytes across roughly 1.44 million files. The route documented for this group includes a Microsoft domain-controller flaw patched in August 2020 that still works wherever the fix was installed but the enforcement setting was never switched on, so a patch report can say done and be wrong. Seven days passed between the first reported outflow and the network being cut off; decide now who in your firm makes the pay-or-don't call, so nobody is working it out that week.
DPRK IT Workers Tied to FAMOUS CHOLLIMA Use Astrill VPN and IPRoyal Proxy — Huntress has helped identify five suspected North Korean nationals hired into partner companies so far this year, in IT, sales and marketing, and medicine. Nobody broke in; HR sent the offer letter and IT shipped the laptop. The tell in one case was a new hire who wouldn't turn the camera on or show the room. If you hire remote staff, cameras on for every interview round, and ship equipment only to an address you've verified yourself.
One Thing to Do This Week
Say this at your next staff meeting, out loud, and have people repeat it back: "If anything you didn't go looking for asks you to paste a command into Windows or install a remote-access app, whether it's a web page checking you're human, a recruiter, or a caller who says they're IT support, close it and tell me before you do anything else." Two of this week's three attacks fail at that sentence. It takes thirty seconds and needs no help from IT.
Get the Monthly Briefing
Once a month I pull the threats that actually mattered into one short read — what happened, what it means for firms like yours, and the one thing worth doing about it. Subscribe using the form at the foot of this page.
Brian Sammons has managed IT environments for Ohio professional service firms — medical, dental, legal, accounting, and financial — since 2004. He writes the Weekly Briefing for the owners, administrators, and IT managers responsible for keeping those firms running: what happened in security this week, and what it means for yours.
Questions about how this affects your environment? Schedule 15 minutes and I'll walk you through it.
Weekly Briefing • August 28, 2026
Three of the incidents we tracked this week are the same con in different clothes: the attacker shows up as someone your staff already trusts with computer problems. A phishing kit poses as the Microsoft 365 sign-in page and lets your real MFA do its work before stealing the result. A malware crew opens a Microsoft Teams chat as "the IT help desk" and offers a cleanup tool. And the extortion group that just breached Apollo Global Management got in the way it has been getting into law firms and financial firms all summer — a phone call from "IT support." Nobody exploited a firewall. They asked.
Here's what happened, and what each one is asking of your firm.
Mirage2FA is a commercial phishing toolkit that researchers at ANY.RUN have linked to activity against 4,532 organizations' email domains between 2024 and 2026, most of them in the United States. Across the campaign they recorded more than 9,000 potential compromise events, and assessed that 48% of the email addresses it targeted were potentially compromised. Roughly half. Not the single-digit click rates most phishing math assumes.
The mechanism is why it works so well. The victim clicks an emailed link and lands on what looks like the Microsoft 365 sign-in page. It is actually a relay: everything the victim types passes through to the real Microsoft login, which validates the real password, sends the real MFA challenge, and — once the victim approves it — issues a real session cookie. The toolkit keeps a copy of that cookie. Replayed into the attacker's browser, it opens an already-signed-in Microsoft 365 session with everything the account can reach: mailbox, OneDrive, SharePoint, and any application connected through single sign-on. There is no failed-login spike to notice, because every login succeeded.
Key Insight
The sign-in this toolkit steals is one Microsoft has already approved — real password, real MFA, real token — which is why resetting the password afterward does not end the attacker's access.
In the last briefing the pattern was systems doing exactly what they were built to do while nobody got an alert. This is that pattern aimed at the login itself: Microsoft validated a genuine password and logged a genuine sign-in. The habit that beats it costs nothing — when a login page arrives by emailed link, you close it and sign in the way you always do, from your own bookmark or by typing the address. A sign-in prompt you navigated to is yours. One that was delivered to you deserves suspicion, no matter how perfect it looks. Full analysis: Mirage2FA Abuses Microsoft 365 Login Flows at 4,500 US and EU Companies.
Security firm Expel documented a new malware family called SynkLoader, first distributed around July 28, that arrives through a Microsoft Teams message from someone impersonating the target company's own IT help desk. The lure is a fake "PowerShell Cleaner" installer — hosted in Microsoft Azure, so the download link carries a Microsoft domain and looks like something your own IT team sanctioned. Once it runs, the operators choose from a menu: a fake Windows lock screen that captures the account password when the user types it, a proxy that tunnels the attacker into internal systems, live desktop viewing and control, and a profiler that counts how many computers are in the company's directory. Researcher Marcus Hutchins reads that last module the obvious way — the operators are measuring how big the environment is because they are scoping it for ransomware.
The delivery is the part your staff can actually see. A Teams message feels internal by default — that assumption is the whole attack, and Microsoft flagged help-desk impersonation earlier this year as an increasingly common opening move. No legitimate support process begins with an unannounced chat and an installer link. If a request like that appears, the verification step is a phone call to the IT number your firm already uses — not a reply in the same chat, because you would be replying to the attacker. Full analysis: SynkLoader Malware Hits Microsoft Teams Users in New Phishing Campaign.
Apollo Global Management — $1.05 trillion under management — confirmed that attackers reached some of its cloud platforms between July 6 and July 10, and determined in mid-August that the compromised data included names, dates of birth, home addresses, and Social Security numbers. Apollo is the first victim to formally confirm personal data loss from a wave of attacks that has been working through private equity firms, law firms, financial rating agencies, and medical technology companies. Google attributes the campaign to BlackFile, a group affiliated with The Com that runs its extortion under four interchangeable brand names. Demands reportedly open around $3 million and settle below $1 million.
The method is the reason this belongs in your briefing and not just Apollo's. There was no software flaw and no malware — operators call employees, impersonate IT support, and talk them through handing over credentials or approving an authentication prompt. The script does not care about assets under management; it cares about help desk conventions, and a fifteen-person practice has those too. The defense is procedural and free: nobody at your firm hands over a credential or approves a sign-in prompt on the strength of an inbound call, ever. Full analysis: Apollo Discloses Data Breach as Attack Wave Hits Financial Sector Firms.
Identity-as-a-Service Markets Sell Executive SSNs Through Bankomat and Xilo — Rapid7 tracked dark-web storefronts selling executives' Social Security numbers for $0.25 to $4 a record, searchable by name and state. The partner whose signature moves your firm's money is cheap to impersonate — which is why payment changes get verified by procedure, not by plausibility.
Fake Recruiter Phishing Targets Corporate Credentials on Mobile Devices — Zimperium documented fake-recruiter flows that reach staff on their phones and reject personal email addresses so only work credentials get through. A job hunt on a personal phone can end with your firm's password in someone else's hands.
Wi-Fi Pineapple Device Disrupts Delta Flight in Onboard Wi-Fi Hack — a passenger knocked a Delta flight's Wi-Fi offline and stood up a look-alike network with a credential-harvesting portal. The same few-hundred-dollar trick works in any airport lounge or hotel, so a login page appearing where it shouldn't is a reason to stay off, not to sign in.
One Thing to Do This Week
At this week's staff meeting, say this sentence out loud and make it policy: "If anyone contacts you claiming to be IT support — by phone, by Teams, by email — and asks you to install something, run a command, approve a sign-in, or read back a code, stop and call our IT provider at the number we already have." Real support survives that check every time. This week's attackers don't.
Get the Monthly Briefing
Once a month I pull the threats that actually mattered into one short read — what happened, what it means for firms like yours, and the one thing worth doing about it. Subscribe using the form at the foot of this page.
Brian Sammons has managed IT environments for Ohio professional service firms — medical, dental, legal, accounting, and financial — since 2004. He writes the Weekly Briefing for the owners, administrators, and IT managers responsible for keeping those firms running: what happened in security this week, and what it means for yours.
Questions about how this affects your environment? Schedule 15 minutes and I'll walk you through it.
Weekly Briefing • August 21, 2026
Three of this week's cases end in the same place: somebody has access to a Microsoft 365 account, and at no point did they need a working password. In the first, the user completes a genuine Microsoft sign-in, approves a genuine MFA prompt, and the attacker collects the token. In the second, a fake login window passes the one-time code to the real service while the user is still typing it, and keeps the session that comes back. In the third, the malware never signs in to the tenant at all — it runs its command channel through SharePoint and Teams.
We flagged a smaller version of this in the last briefing: a trojan stealing session cookies, where nobody gets prompted for a second factor on a session that is already signed in. This week it is the whole pattern, and it changes what containing an incident has to mean. Here's what happened, and what each one is asking of your firm.
Huntress is tracking a run of Microsoft 365 account takeovers in which no password is ever captured. The technique abuses the OAuth device authorization flow — the sign-in path built for equipment that cannot handle a browser login, like smart TVs, conference room displays, and command-line tools. The device shows a short code, and the person signs in on a phone or laptop to finish the job. An attacker starts that flow himself, sends your user the code with a plausible reason to enter it, and the user completes an authentic sign-in on Microsoft's own page. The token that comes out the other end goes to whoever started the flow.
There is no counterfeit portal to spot, because the portal is microsoft.com/devicelogin. There is no password to steal, because the password goes to Microsoft. MFA fires and the user approves it, because from Microsoft's point of view the sign-in is legitimate — and it is. What the attacker walks away with is a token, and the token is the thing that actually opens mail, files, and Teams data. In your own tenant logs it records as an ordinary successful sign-in by a real employee.
Huntress reports an influx of this through 2026, and the volume is concrete. An earlier wave ran through Railway, a platform-as-a-service, and was attributed to a phishing-as-a-service kit called EvilTokens. A second wave came from a VPS reseller called BL Networks starting April 13, 2026. Between April 13 and April 30, Huntress identified 533 authentication events tied to BL Networks from a single address, 113 of them successful logins inside one 48-hour window on April 20 and 21. Between July 3 and July 27 it recorded 26 critical-severity incidents across 23 identities. The part that changes your exposure is the service model: when a kit packages the lure, the hosting, and the token handling for paying customers, the operator no longer needs to understand OAuth to run the attack, and several unrelated buyers can point it at the same tenant at once.
Key Insight
There is no captured password to rotate and no fake login page to take down. Containment here means revoking the token and ending the session — a different action from a password reset, and the only one that actually puts the attacker out.
Microsoft's research on a parallel campaign fills in the lures: invoices, RFPs, shared documents, electronic signing requests, and voicemail notifications, with one observed subject theme of "Action Required: Password Expiration." It also found the attackers checking whether a mailbox existed and was active 10 to 15 days before the phishing attempt, which is usually longer than short log retention keeps. For your firm the teachable moment is narrower than it sounds: a message supplies a code and asks someone to enter it on a Microsoft page. Legitimate device sign-ins run the opposite direction — the code is displayed by the device sitting in front of you, and nobody emails it. Full detection and containment guidance: Device Code Phishing Evolves as EvilTokens PhaaS Kit and Kali365 Emerge, and the campaign Microsoft documented: AI-Enabled Device Code Phishing Campaign Abuses Device Code Sign-In Flow.
CTM360 has documented more than 3,000 phishing URLs in a campaign it tracks as RecruitTrap, impersonating recruiters at more than 50 organizations across 14 sectors. It opens with an unsolicited email or meeting invitation that appears to come from a recruiter at a company the recipient would recognize, references their actual professional background, and offers an interview slot. The landing page is a counterfeit Calendly-style scheduler or a branded careers portal, reusing the names, photographs, and job titles of genuine recruiters pulled from public profiles.
The technique doing the work is Browser-in-the-Browser. The target clicks "Continue with Google," and a login window opens on top of the page, address bar and padlock included. It is not a window. It is HTML and CSS drawn inside the page already open, and the address bar is a picture of a trustworthy URL rather than the real one. Checking the address bar is the single habit most security awareness training teaches, and in this campaign the address bar is a drawing of one.
In the more capable versions the operators relay the second factor in real time. The attacker signs in to the genuine service with the submitted password, the fake window mirrors whatever challenge the real service returns, and the victim's one-time code goes straight back to the operator. The kit also screens its own visitors: CAPTCHA gates and reload checks filter out automated traffic, and personal email domains are rejected so only corporate accounts advance, which means a security tool that visits one of these URLs with a consumer address is shown a harmless page.
Marketing staff made up the majority of observed targets, which in a practice means whoever runs the website, the ad account, and the social profiles — often the same person who handles the client list. But the qualifying condition is just a public professional profile and a reason to take a recruiter's call, and that covers most of an office. Note how it ends: the attacker holds an authenticated session, and the victim is redirected to a genuine Calendly page so the whole thing reads as a scheduling hiccup. Nobody reports a scheduling hiccup. Full analysis and hunting indicators: RecruitTrap Phishing Uses Browser-in-the-Browser Popups to Steal Logins.
Ontinue's Cyber Defense Center found a Python malware framework in July that runs most of its command-and-control traffic through Microsoft services your network already permits. Researchers track it as TWINLOOT. Routine tasking runs over SharePoint Online as a file-based dead drop, polling roughly every 15 seconds for new commands and writing results back the same way. Interactive access runs separately, through a reverse SOCKS5 tunnel over Microsoft Teams TURN infrastructure. A third path launches Microsoft Edge in headless mode and issues Graph API calls from inside the browser process, so the network telemetry reads as a legitimate Edge session talking to Microsoft. There is no attacker-owned domain anywhere in the chain, which is the entire design goal: blocklists and domain reputation feeds assume malicious traffic goes somewhere suspicious.
Two details decide how an investigation goes. The implant authenticates to an attacker-controlled Azure tenant rather than yours, so no sign-in event, no consent grant, and no audit record appears in your Entra ID logs — the identity trail an investigator normally starts from is simply absent, and the work falls back to endpoint and network artifacts. And for persistence it creates an NTUSER.MAN mandatory-profile hive offline, which needs no administrator privileges and generates no registry modification event. Alongside that, the malware displays a convincing Windows lock screen filled with the user's real account details, captures the password they type, returns the familiar incorrect-password message, and lets them in. The employee experiences a typo. The help desk never hears about it.
This is the case that survives the standard reflex. If the response to a suspected compromise is to reset the password and run an endpoint scan, the ticket gets closed while the foothold is still there, and there is no registry audit entry to say otherwise. Ontinue reports this as only the second observed case of Teams TURN abuse in the wild and the first to use actual WebRTC DataChannels, so it is early rather than widespread — the reason to read it now is that it shows where the traffic is going to hide. Full breakdown: TWINLOOT Malware Turns Microsoft Cloud Services Into Its Control Channel.
MacSync Stealer is taking credentials off Macs through pasted Terminal commands — the victim is talked into copying a command from a web page or chat window and running it themselves, so there is no exploit and no installer to inspect. It collects Keychain material, saved browser credentials, cookies and session data, SSH keys, and cloud access keys. The Mac in the office is not the exception people assume it is, and what leaves it includes live sessions.
A Mirai-based botnet is turning internet-facing routers into traffic relays — Fortinet has tracked Evooo1Bot since July hitting NETGEAR, D-Link, Tenda, Alcatel and other gateway devices, using both unpatched flaws and an SSH scanner that works through 150 username and password combinations. Default or shared admin credentials are enough on their own. Newer versions reach past routers to cameras, network storage, and firewalls, so the devices to check are every internet-facing gateway, camera, and storage box the office owns.
Experian's 2026 identity and fraud report puts AI-generated deception at the center of account takeover — forged documents, cloned voices, and synthetic identities are now cheap enough to use at volume, and the report names account recovery and high-value payment authorization as the pressure points. The front-office version: a familiar voice on the phone asking to change where a payment goes is not verification, and has not been for a while.
One Thing to Do This Week
Say this out loud at your next staff meeting: "If a message ever gives you a code and asks you to type it into a Microsoft sign-in page, don't — bring it to me first." Real device sign-ins work the other way around, with the code shown on the screen of the device in front of you. Then add the half that matters more: if somebody thinks they already entered one, you need to know that hour, not the next morning. The fix is revoking the active session, which is a different action from changing the password, and changing the password by itself leaves the attacker signed in. Two minutes at the meeting, no help from IT required.
Get the Monthly Briefing
Once a month I pull the threats that actually mattered into one short read — what happened, what it means for firms like yours, and the one thing worth doing about it. Subscribe using the form at the foot of this page.
Brian Sammons has managed IT environments for Ohio professional service firms — medical, dental, legal, accounting, and financial — since 2004. He writes the Weekly Briefing for the owners, administrators, and IT managers responsible for keeping those firms running: what happened in security this week, and what it means for yours.
Questions about how this affects your environment? Schedule 15 minutes and I'll walk you through it.
Page 1 of 2
