Researchers identified 19 Chrome and Edge extensions containing wallet-stealing and...
Weekly Briefing • August 15, 2026
Three of the incidents we tracked this week have the same shape: the systems involved did exactly what they were built to do, and nobody got an alert. Ransomware ran on a server whose endpoint protection was installed, licensed, and correctly configured — Windows simply never started it. Hundreds of thousands of automated emails carrying credentials and personal details were delivered perfectly, to a stranger, because the sending domain belonged to somebody else. And a healthcare practice that spotted an intrusion in March finished telling its patients at the end of June.
None of these required a clever exploit. Here's what happened, and what each one is asking of your firm.
Huntress investigated an Akira ransomware intrusion that began with credential spraying against an internet-facing SonicWall SSL VPN. About seven minutes passed between the first failed login attempts and a successful sign-in — to an account that did not have multi-factor authentication enabled. Two hours later the operator was on the domain controller over RDP. Files from mapped shares were archived with WinRAR and copied out to attacker-controlled cloud storage, all of it finished before any encryption was attempted.
Then came the part worth understanding. The operator installed AnyDesk for persistent access, added AnyDesk to the Windows Safe Boot registry configuration so their own tool would still run, forced the server to reboot into Safe Mode with Networking, and launched the ransomware there. Safe Mode loads only essential drivers and services, and third-party security products are excluded from that set by design. Huntress's own agent and Microsoft Defender's real-time protection were not switched off or tampered with. They were never started. Defender did later identify the ransomware binary sitting on disk, but could not act on it until the machine was booted back into normal Windows.
Key Insight
The endpoint protection on that server was installed, licensed, and correctly configured, and it produced no telemetry at all — because Windows never loaded it. A control that isn't running doesn't fail loudly. It just goes quiet.
Two unglamorous things would have changed this story. The first is MFA on that VPN account: no SonicWall vulnerability was involved and no CVE was exploited — seven minutes of guessing found an account where a password alone was enough. The second is an alert when a server boots into Safe Mode without a change ticket behind it. Servers do not reboot into Safe Mode during normal operations, which makes it one of the cleaner alarms you can set. One footnote worth keeping straight: the encryption in this case actually failed, on virtual memory errors. Huntress is explicit that this was a coincidence of resource limits, not a defense. Full chain and detection guidance: Akira Ransomware Reboots Windows Into Safe Mode to Knock EDR Offline.
Researcher Cory Solovewicz owns noreply.net and noreply.us — addresses that look like throwaway placeholders but are real, registrable domains that somebody can simply buy. Since December 2024, one of them has taken in 401,796 messages, by his own count around 700 a day, from more than 14,000 distinct sending addresses across roughly 6,200 root domains. Of the noreply.net messages, 28,365 arrived with attachments. What lands there is ordinary business mail: account-setup messages from a school platform, injury reports from a city government, Zoom invitations from a UK government agency, credentials from test and QA systems.
A second researcher, Mike Sheward, registered deleteduser.com for about fifteen dollars. Three organizations emailed it within the first hour, and he has since received unintended mail from at least a hundred of them. The cause sits in application code rather than in anyone's mail server. A developer needs a sender address, picks something that looks obviously fake, and happens to choose a domain that is real and available. Or a system replaces a departed employee's address with a placeholder instead of removing the record, and every workflow attached to that account keeps firing. Nothing in email checks that the domain in a From or Reply-To field is one the sender actually owns, so delivery succeeds and no alert is generated on either end. We made the point in the last briefing that a real email isn't automatically a safe email; this is the same lesson pointed the other direction, at the mail your own systems send.
For a practice, the systems worth checking are the obvious ones: practice management, your EHR, appointment reminders, the client or patient portal, e-signature and intake tools. If any of them is configured to send from a domain you don't own, then every activation link, temporary password, and appointment detail it has mailed went somewhere you can't see. Details and the full checklist: Researcher Buys noreply.net and Companies Start Emailing Him Secrets.
Texas Hearing Institute, a pediatric audiology provider operating as The Center for Hearing and Speech, notified 29,744 patients after the Interlock ransomware group took files from its network. Interlock claims 540 GB. The data included names, Social Security numbers, diagnosis and treatment information, and financial account information. Interlock runs as a ransomware-as-a-service operation and works by double extortion: copy the files first, encrypt second, and charge separately for the decryption key and for not publishing what was taken. The ransom went unpaid, so the data was published.
The ransomware isn't the instructive part. The calendar is. Suspicious network activity was spotted on March 20, 2026. Forensic work confirmed the scope on or around April 22. The list of affected individuals was finalized on June 19, and notification letters went out on June 26 — roughly three months from "something is wrong on our network" to patients learning their records were involved. Most of that time goes into answering one question: whose data was actually in those 540 GB.
That answer is only as fast as your logging. If you can't show what was accessed and when, it has to be reconstructed from whatever evidence survived, and the clock runs the entire time. HIPAA's Breach Notification Rule allows 60 days from discovery for breaches affecting 500 or more people, which also pulls in HHS's Office for Civil Rights and, above that threshold, the media. When "discovery" legally occurred is exactly the kind of question that gets argued afterward, which is a good reason not to be in a position to argue it. The question worth putting to your own team: if this happened here on a Friday, how many days until we could produce a defensible list of exactly whose records were touched? Full breakdown: Interlock Ransomware Attack on Texas Hearing Institute Hits 30,000 Patients.
Microsoft patched 398 vulnerabilities this month, 42 of them critical — managed environments absorb this through the normal patch cycle without anyone thinking about it. The machines worth worrying about are the ones nobody manages: the personal laptop somebody uses for remote work, the old workstation in the back office that never got replaced.
Fake CCleaner downloads deliver the GhostDesk trojan — it hijacks Chrome to steal session cookies along with credentials and screenshots. Stolen session cookies matter because they hand over an already-authenticated session; nobody gets prompted for a second factor on a session that is already signed in.
A banned AI Sidebar Chrome extension is back in the Web Store carrying an affiliate-fraud payload — a browser extension can read every page the person using it opens, which includes your practice management system. Removal from the store isn't permanent, and a familiar name in the listing isn't a safety check.
One Thing to Do This Week
Open the last automated email one of your systems sent a patient or client — an appointment reminder, a portal invitation, a signature request — and look at the From and Reply-To addresses. You are checking one thing: is the domain after the @ one your practice owns? An address like
Brian Sammons has managed IT environments for Ohio professional service firms — medical, dental, legal, accounting, and financial — since 2002. He writes the Weekly Briefing for the owners, administrators, and IT managers responsible for keeping those firms running: what happened in security this week, and what it means for yours.
Questions about how this affects your environment? Schedule 15 minutes and I'll walk you through it.
Weekly Briefing • August 11, 2026
Three of the threats we tracked this week share one detail: nothing in them looked fake. A phishing kit that sends victims to Microsoft's genuine login page. A malware campaign that installs the same remote-support software legitimate IT departments use. Malicious attachments arriving inside real email conversations your staff were already having. The old advice — look for the misspelled domain, the odd logo, the suspicious link — doesn't cover any of these.
Here's what happened, and what it means for how your firm operates.
A toolkit tracked as Kali365 is running device code phishing against US companies — healthcare among the targeted sectors — and sandbox provider ANY.RUN records more than 80 public sessions tied to the campaign every week. The lure impersonates a service your staff already trust: SharePoint, OneDrive, or DocuSign. But instead of a counterfeit login page, the victim is redirected to Microsoft's real device login portal and asked to enter a code the attacker generated.
When the victim approves that code, Microsoft issues access and refresh tokens to the attacker's session. Those tokens grant continued access to Microsoft 365 email, documents, and cloud resources. No password was stolen, so a password reset doesn't help until the tokens themselves are revoked.
Key Insight
Nothing about the login page is fake. The victim signs in at Microsoft's genuine portal — and by approving a code the attacker generated, hands over working access to the company's Microsoft 365 tenant without a password ever changing hands.
The defense is procedural, not visual: nobody in your firm should ever type a device code they didn't generate themselves, moments earlier, on their own screen. If an email or document asks you to "verify" by entering a code at microsoft.com, stop and call IT. Full analysis and containment steps are in our Threat Intelligence Center: Kali365 Toolkit Weaponizes Microsoft Authentication Against US Companies.
Securonix documented an active campaign, tracked as SMOKE#SCREEN, that uses fake Adobe and Zoom update prompts to install ConnectWise ScreenConnect — a legitimate, signed remote-access product that IT teams use for help-desk sessions. The attackers install the real client and point it at their own servers, which gives them an interactive remote desktop that survives reboots and blends in with sanctioned IT software.
The lure works because it mirrors something your staff are told to do constantly: apply the update, close the vulnerability, move on. That instinct is correct — the delivery channel is what's wrong. In our managed environments, updates come through managed patching, not through a browser popup. A website telling you to update Adobe or Zoom is not how updates arrive, ever. Details: Fake Adobe and Zoom Updates Install ScreenConnect for Persistent Remote Access.
This is what real updates look like — N-Sight managed patching across one of our managed environments, 71 endpoints, running in the background. No popup ever asks your staff for help.
Gen Threat Labs tracked malware campaigns through the first half of 2026 that didn't imitate trusted senders — the messages came from corporate mailboxes the attackers had already taken over, riding inside genuine conversations. Because the mail leaves through authorized infrastructure, SPF and DKIM authentication checks can still pass. The lures matched what recipients already expected: shipment notices, invoices, scanned documents.
This particular campaign concentrated on Central and Eastern Europe, so it's the technique, not the specific actor, that matters for Ohio firms: sender authentication and "does this look legitimate?" both return the wrong answer when the account itself is compromised. It's the same reason we told you in the last briefing that payment-detail changes get verified by a phone call to a number already on file — the email being real doesn't make the request real. Analysis: Hijacked Email Threads Deliver GepyS, Remcos RAT and XWorm in H1 2026.
Pass-ta-key attacks against Google-synced passkeys — Unit 42 showed malware on an already-compromised Windows machine can abuse synced passkeys. Passkeys remain far stronger than passwords; this is a reason to keep endpoints clean, not a reason to abandon them.
HollowFrame loader evades Microsoft Defender — documented by Blackpoint Cyber in an attack chain targeting a law firm. Defender alone was not enough; layered monitoring caught it.
"Poison Claude" resells discounted AI access through a proxy that reads every prompt — if anyone in your firm uses AI coding or writing tools, the discount route can mean an anonymous operator sees your client data.
One Thing to Do This Week
Tell your staff this one rule: software updates never come from a web page. Any popup, banner, or site that says Adobe, Zoom, or your browser needs updating gets closed and reported — not clicked. In a managed environment, updates arrive through patching that runs in the background, and anything asking for your help is the attack. One sentence at your next staff meeting covers it.
Brian Sammons has managed IT environments for Ohio professional service firms — medical, dental, legal, accounting, and financial — since 2002. He writes the Weekly Briefing for the owners, administrators, and IT managers responsible for keeping those firms running: what happened in security this week, and what it means for yours.
Questions about how this affects your environment? Schedule 15 minutes and I'll walk you through it.
Weekly Briefing • June 08, 2026
Brian here. SonicWall released their 2026 Cyber Protect Report this month, and the findings line up with what we see across the practices we manage in Ohio: the firms that get breached aren't failing because of sophisticated attacks. They're failing because of predictable, preventable gaps.
SonicWall makes the firewalls we deploy in every managed environment. Their data comes from the same class of hardware sitting in your server room right now. So when their report identifies the most common ways businesses get compromised, it's directly relevant to how your network is protected — and where the gaps tend to hide.
Cysurance — the warranty provider behind the coverage that comes with your managed services — reports that 98% of their claims are from business email compromise and funds transfer fraud. Not ransomware. Not data breaches. Someone gets a convincing email, updates payment details, and money goes somewhere it shouldn't.
Key Insight
98% of cyber insurance claims are business email compromise and funds transfer fraud — not ransomware, not malware. Just someone deceived into sending money to the wrong account. — Cysurance, via SonicWall 2026 Cyber Protect Report
In many of those cases, no system was actually compromised. No credentials were stolen. No malware was deployed. An employee was simply deceived into wiring money to the wrong account. Cysurance is now seeing employees lose their jobs over authorizing these payments — people who were acting in good faith, following what looked like legitimate instructions.
The fix costs nothing: any change to payment information gets verified by a phone call to a known number. Every time. No exceptions. Not by email. Not by chat. A voice call to a number you already have on file — not the number in the email.
If your firm handles client funds — trust accounts, escrow, patient billing, vendor payments — this is the conversation you need to have with your staff this week.
SonicWall's data shows that identity, cloud, and credential compromise account for 85% of actionable security alerts. The most common way attackers get into environments isn't through some exotic vulnerability. It's a stolen password.
Two numbers from the report frame the problem. Exploits appear within 48 hours of a vulnerability becoming public in 61% of cases. But the average organization takes over 100 days to patch a high-severity vulnerability. That gap — hours on the attacker's side versus months on the defender's — is a process failure, not a technology failure.
What we see in practice is simpler than a sophisticated attack. End users suspend or disable Windows updates because restarting in the middle of the workday is inconvenient. And that's just the operating system — BIOS, drivers, firmware, and peripheral updates almost never get touched at all. Every one of those is a door left unlocked, sitting open for months.
The report also found that 66% of small and mid-size businesses globally haven't implemented multi-factor authentication at all. We enforce MFA on every admin account, every remote access connection, and every cloud application across our managed environments — no exceptions. The SonicWall data shows exactly why that policy exists.
Ransomware was involved in 88% of small business breaches in 2025, compared to 39% at large enterprises. Small businesses aren't safer because they're small. They're more exposed because they've traded complexity for convenience — flat networks, broadly shared admin credentials, and VPN connections that grant access to everything once someone logs in.
Automated scanning tools don't filter by company size. They filter by vulnerability. SonicWall measured over 36,000 vulnerability scans per second across the internet in 2025. If your systems are exposed, you're a target regardless of your revenue or your headcount.
The SonicWall report found the same pattern in post-incident reviews of compromised SMB environments: a single admin account was the entry point, and from there, the attacker moved without resistance. Default credentials on network devices, shared admin passwords, and accounts that hadn't been reviewed in years gave attackers immediate, broad access.
Almost every client we onboard arrives with a flat network and shared admin credentials. Network segmentation has never come up — not because anyone made a bad decision, but because it never made the priority list. And if they have a firewall at all, it usually hasn't been updated since the day it was installed, along with most of the other devices on the network.
SonicWall found that 32% of ransomware incidents in 2025 started with an exploited vulnerability — making it the single most common technical cause, ahead of compromised credentials and phishing. The Log4j vulnerability, discovered four years ago, was still targeted over 825 million times last year.
Old vulnerabilities don't retire. They accumulate. Every unpatched system is a door that attackers already have the key to — they just need to find it, and automated tools make that search almost instantaneous.
This is why patch management isn't a quarterly project in our managed environments. N-Sight runs automated patching on a continuous cycle, prioritizing internet-facing and critical systems. The window between "vulnerability disclosed" and "patch applied" is where breaches happen, and our job is to keep that window as small as possible.
A live view from one of our managed environments — patch status, device monitoring, and unmonitored-device tracking across 71 endpoints. Continuous patching keeps the disclosure-to-patch window as small as possible.
One Thing to Do This Week
Talk to your office manager or bookkeeper and establish one rule: any request to change payment information — whether it comes from a vendor, a partner, or an internal email that looks like it came from leadership — gets verified by a phone call to a number you already have on file. One conversation. One rule. It addresses the single largest category of financial loss that the warranty provider backing your coverage sees across their entire book of business.
Brian Sammons has managed IT environments for Ohio professional service firms since 2002. He writes the Weekly Briefing to help practice managers understand what's happening in cybersecurity and what it means for their firms.
Questions about how this affects your environment? Schedule 15 minutes and I'll walk you through it.
