The "verify you are human" box that is not
On September 14, attackers used a stolen key belonging to Brevo, an email marketing company whose sign-up forms and chat boxes sit on a great many small business websites. The key let them change what those forms showed. For about five and a half hours, some visitors on Windows computers saw a fake "verify you are human" check.
The fake check gave instructions: press a couple of keys, paste, press Enter. Doing that runs the attacker's program on your computer. Security firm Sansec estimated that more than 100,000 websites were likely affected.
Tell your staff
A real "are you human" check asks you to tick a box or pick pictures. It never asks you to open anything, paste anything, or press Enter. If one does, close the page and call us.
The Microsoft code that hands over your inbox
In September, Microsoft shut down much of a phishing service called EvilTokens, which had broken into more than 12,000 Microsoft email accounts.
The trick is quiet. An email arrives that looks like a shared document or a voicemail. It sends you to a genuine Microsoft page and asks you to type in a short code. You type it, approve the sign-in on your phone like always, and the attacker is now signed in to your email. Your two-step login did its job. It just did it for them.
Tell your staff
A real sign-in never starts with a code someone sent you. If an email or text gives you a code and tells you to go to a Microsoft page and type it in, that is the scam. Codes you ask for yourself while signing in are fine. For many businesses we can also switch this kind of sign-in off entirely.
One password, saved in the wrong place
Florida's driver license agency says its database was broken into using one police department employee's login, which had been saved on a personal device. The group behind it claimed about 200,000 driver records.
No clever break-in. One login, kept somewhere it should not have been.
Tell your staff
Work passwords live in the company password manager, not in a phone's notes app and not on a home computer.
The short version
A fake checkbox, a code typed in good faith, a password saved for convenience. Small things. That is usually how it goes.
If you would like us to switch off code sign-ins for your Microsoft accounts, or check what your website is loading from other companies, get in touch.