Aug 20, 2026
Article Summary: Windows 10 reached the end of Microsoft support on October 14, 2025, which means it no longer gets security updates. The computers still work, but any new flaw found in Windows 10 will never be fixed, which makes them easier to attack and can cause problems with compliance and cyber insurance. You have three options: upgrade eligible PCs to Windows 11 for free, pay for Extended Security Updates as a short-term bridge, or replace machines too old to upgrade.
Microsoft stopped supporting Windows 10 on October 14, 2025.
If your business is still running it, and plenty are, your computers aren’t getting security updates anymore.
Everything still turns on and works like normal, which is exactly why it’s easy to put off doing anything about it. The trouble is, the longer you stay on Windows 10, the more security holes pile up that nobody is ever going to fix.
So what does it mean for your business, and what are your options?
There are three: upgrade to Windows 11, pay for extended updates to buy some time, or replace the machine.
Let’s go through what you’re dealing with first.
What “end of support” means
When Microsoft ends support for a version of Windows, the updates stop. That includes the monthly security patches that fix newly found flaws.
Microsoft has confirmed that since October 14, 2025, Windows 10 gets no more security fixes, quality updates, feature updates, or technical support.
Your PCs don’t stop working. Nothing switches off the moment support ends. What’s different now is that Microsoft has stopped fixing Windows 10’s security flaws.
Attackers and security researchers keep finding new ones, and now nobody’s patching them. So every new flaw that turns up is another way into your computers, and it never gets fixed.
Why this is a real risk for your business
This is about more than an old, slow computer.
- They’re an easy target. Attackers go looking for computers running software that doesn’t get fixed anymore, because they know the flaws will just sit there. The UK’s National Cyber Security Centre points out that holes in unsupported products stay exploitable, often by fairly low-skilled attackers.
- You can fall out of compliance. If you handle card payments, health records, or personal data, rules like PCI DSS and HIPAA expect you to run supported, patched software. Windows 10 no longer counts, which can put you out of compliance.
- It can hit your cyber insurance. Insurers are asking more and more whether your systems are supported and patched. Running an unsupported operating system can push your premium up, shrink your coverage, or give the insurer a reason to fight a claim.
- Your other software will drop it. Over time, browsers, accounting tools, and other programs stop supporting Windows 10, so the apps you rely on every day can stop updating, or stop working altogether.
CISA puts running supported, updated software on its short list of basic security steps for businesses.
<H2>Your three options</H2>
You’ve really got three options, and most businesses end up mixing them across their computers.
1. Upgrade to Windows 11(free, if the hardware qualifies)
If you bought the PC in the last few years, upgrading to Windows 11 is free, and it’s usually the right move. The catch is the hardware. Windows 11 needs a supported processor, TPM 2.0, and Secure Boot, and that rules out a lot of older machines. To check whether a particular PC qualifies, run Microsoft’s free PC Health Check app.
2. Buy Extended Security Updates as a bridge
If a PC can’t move to Windows 11 yet, Microsoft will sell you Extended Security Updates (ESU) to keep the security patches coming for a while longer.
For businesses, that’s $61 per device for the first year, and it doubles every year after that, up to three years.
Keep one PC on Windows 10 the whole time and you’re looking at around $427 over those three years.
Home users get a much cheaper deal. A one-time $30 payment covers up to 10 devices with security updates through October 12, 2027, and it’s free if you sync your PC settings.
ESU gives you security patches and nothing else. No new features, no real tech support. It’s there to buy you time while you sort out the upgrade or a new machine.
3. Replace the PC
Some machines are just too old for Windows 11 and not worth paying ESU on year after year.
For those, buying a new PC that already runs Windows 11 usually works out cheaper, once you add up the ESU fees and the cost of keeping an old machine going.
How to plan the move
You don’t have to do all of this at once, but you do need a plan. A sensible order looks like this:
- Make a list of every computer still on Windows 10.
- Check which ones can move to Windows 11, using the PC Health Check app or your IT provider.
- Upgrade the ones that qualify. It’s free, and it keeps your files and programs in place.
- For the rest, choose between ESU to buy time or replacing the machine, depending on how old it is and what it’s used for.
Your IT provider can run that inventory quickly and tell you the best option for each machine.
Frequently Asked Questions
Is Windows 10 still safe to use after October 2025?
It still works, but it’s not getting security updates anymore, so the risk creeps up as new flaws are found and left unpatched. If you’re going to keep using it, either enroll in Extended Security Updates or plan your move to Windows 11.
What happens if I keep using Windows 10 and do nothing?
Your PCs will keep running, but they turn into an easier target for attackers, can put you out of compliance with payment and privacy rules, and may cause problems with your cyber insurance. And over time, the apps you depend on will start dropping Windows 10 too.
How much does Windows 10 ESU cost for a business?
For businesses, it’s $61 per device for the first year and doubles each year after that, up to three years, which comes to about $427 per device in total. Home users get a better deal: a one-time $30 payment covers up to 10 devices through October 12, 2027, or it’s free if you sync your PC settings.
Can my PC upgrade to Windows 11 for free?
If it meets the hardware requirements, yes. Windows 11 needs a supported processor, TPM 2.0, and Secure Boot. The PC Health Check app will tell you whether a specific machine qualifies, and PCs from the last few years usually do.
Should I just buy a new computer?
If a PC can’t run Windows 11, a new one is often cheaper than paying escalating ESU fees for years on top of running aging hardware. If it can upgrade, start with the free Windows 11 upgrade.
—
Featured Image Credit
This Article has been Republished with Permission from The Technology Press.
Aug 15, 2026
Article Summary: AI note-takers join your meetings, transcribe everything said, and save the recording and summary to the vendor’s servers. Who can see that recording depends on the tool. Some keep your data inside your own Microsoft or Google environment and never use it for training, while others store it on their own servers and may use it to improve their AI. Some also auto-join meetings from your calendar without anyone pressing record. Before you let one into a client or staff meeting, it’s worth knowing where the recording goes and getting everyone’s consent.
AI note-takers have become normal in a short time.
You start a Teams, Zoom, or Google Meet call, a bot joins to record the conversation, and minutes later everyone gets a tidy summary with action items.
It saves real time, which is why staff often adopt these tools on their own, before anyone has asked where the recording ends up.
The problem is, every word of the meeting, including the parts you would never put in writing, gets captured, stored somewhere, and read by whoever has access. Few business owners have stopped to ask who that includes, or what happens to the recording afterward.
What an AI note-taker actually does
An AI note-taker is a tool that joins a meeting, records the audio and sometimes the video, turns the speech into a written transcript, and produces a summary. Common ones include Microsoft 365 Copilot in Teams, Otter, Fireflies, and Fathom.
Most connect to your calendar so they can join automatically, and some will sit in on any meeting on your schedule unless you turn that setting off.
The recording and transcript do not disappear when the call ends.
They are saved, usually in the cloud, where they can be searched, shared, and exported later.
Where they are saved, and who can reach them, depends on which tool you use.
Who can see the recording?
Start with the obvious group: anyone the meeting organizer shares the summary with.
Many note-takers email the transcript to every attendee by default, and some send it to people who were invited but never joined. When the meeting covered a sensitive topic, that distribution list matters.
Then there is the tool’s own access.
With a cloud note-taker, the recording sits on the vendor’s servers, which means the vendor’s systems, and in some cases its staff, can reach it under the terms you agreed to.
If the tool auto-joined from someone’s calendar, the recording may live on an account you do not control, belonging to whichever employee connected the bot.
A law firm publication on the legal risks of AI note-takers warned that letting a note-taker vendor access or use your transcripts for its own purposes can even risk waiving attorney-client privilege for businesses that handle legal matters.
Does the tool use your meetings to train its AI?
This is where tools differ the most, and it is worth checking before you choose one.
Microsoft states that Copilot in Teams does not use your prompts, responses, or meeting content to train its AI models, and that the data stays inside your organization’s Microsoft 365 environment.
Microsoft’s privacy documentation says this directly, and notes the content is processed within the Microsoft 365 service boundary rather than on the public version of the AI.
Third-party note-takers vary widely.
Some store your recordings on their own servers and, depending on the terms you accept, may use that data to improve their models.
Others say they do not train on customer data at all. The only way to know is to read the specific tool’s privacy terms, because two tools that look almost identical can treat your data very differently.
The consent question
Recording a meeting is not always yours to decide alone, and the rules change depending on where you and the other people are.
In around a dozen U.S. states, and in most Australian states, everyone in a conversation has to agree to being recorded.
Federal U.S. law, most other states, and the UK allow recording when one participant consents.
On top of that, the UK and Europe treat recording people as handling their personal data, so under GDPR you generally have to tell participants you are recording, explain why, and have a proper reason for doing it.
That’s why the safest way to go about this is to tell people the meeting is being recorded, explain why, and give them a chance to object before the bot starts.
For client meetings, HR conversations, and anything covered by confidentiality, that matters even more, and in some cases you should check with a lawyer before recording at all.
How to use AI note-takers safely
You don’t have to ban these tools to use them responsibly.
Do this instead:
- Pick an approved tool and say so. Decide which note-taker your business uses, and ask staff not to connect others to company meetings. This keeps your recordings in one place you control.
- Turn off auto-join. Set the tool to join only when someone chooses to record, rather than automatically for every meeting on a calendar.
- Announce recording and get consent. Make it normal to say a meeting is being recorded at the start, and to skip recording when someone objects.
- Prefer tools that keep data in your environment. A note-taker that stores recordings inside your own Microsoft or Google tenant, and does not train on your data, is easier to control than one that holds everything on its own servers.
- Control who gets the summary. Check the default sharing setting so transcripts are not emailed to everyone, including people who missed the meeting.
- Keep bots out of sensitive meetings. For legal, HR, financial, and confidential client conversations, the default should be no recording unless there is a clear reason and everyone agrees.
If you use Microsoft 365, an administrator can control whether Copilot and transcription are allowed in Teams meetings. That gives you one place to set the rule, instead of relying on each person to get it right.
Frequently Asked Questions
Is it legal to record a meeting with an AI note-taker?
It depends on where everyone in the meeting is. Around a dozen U.S. states and most Australian states require everyone to consent. The UK, federal U.S. law, and most U.S. states allow it with one person’s consent, though in the UK and Europe you also have to inform people and have a valid reason under data-protection law. The safe approach everywhere is to announce the recording and let people object before it starts.
Does Microsoft Copilot use my meeting data to train its AI?
No. Microsoft states that Copilot in Teams does not use your meeting content, prompts, or responses to train its foundation AI models, and that the data stays within your organization’s Microsoft 365 environment.
Can an AI note-taker join a meeting without me knowing?
Yes. Many tools connect to a user’s calendar and can auto-join meetings, sometimes ones the user isn’t even attending. You can turn auto-join off so the bot only records when someone chooses to start it.
Where are AI note-taker recordings stored?
In the cloud. With Microsoft Copilot, the data stays inside your Microsoft 365 tenant. With many third-party tools, recordings sit on the vendor’s own servers. Where they live and who can reach them depends on the tool, so check its terms.
Should we let staff use Otter or Fireflies for work?
You can, with rules in place. Choose one approved tool, turn off auto-join, announce recording and get consent, check how the tool handles your data, and keep it out of legal, HR, and confidential client meetings.
—
Featured Image Credit
This Article has been Republished with Permission from The Technology Press.
Aug 10, 2026
Article Summary: Email spoofing is when a scammer sends a message that appears to come from your domain, often to trick your clients or staff into paying a fake invoice or changing banking details. Three DNS records (SPF, DKIM, and DMARC) prove that a message really came from you and tell receiving mail servers to reject the ones that didn’t. The catch is that DMARC only protects you once it’s set to “quarantine” or “reject,” and a lot of businesses leave it on “none,” which monitors but does not block.
Right now, with no special tools, someone could send an email that looks like it came from your company.
The From line would show your domain, your logo could be pasted into the message, and it could ask one of your clients to pay an invoice or update banking details. This is called email spoofing, and it is one of the most common ways fraud against your clients and suppliers begins.
There are three settings you can add to your domain that make this much harder to pull off.
They’re called SPF, DKIM, and DMARC.
Most businesses have one or two of them set up and the third missing.
That’s usually all it takes to let a spoofed email through. This post explains what each one does, the setting most businesses get wrong, and how to check your own domain.
Why scammers can send email in your company’s name
Email was built in a more trusting time.
The system that delivers mail does not, on its own, check that the sender is who they claim to be. The From address on an email is about as trustworthy as the return address handwritten on an envelope. Anyone can write anything there, and the mail still gets delivered.
Spoofing takes advantage of that.
A scammer puts your domain in the From field, sends the message, and unless your domain is set up to prevent it, the receiving mail server has no reason to question it. The message lands in your client’s inbox looking like it came from you. The UK’s National Cyber Security Centre publishes anti-spoofing guidance for exactly this reason.
The three records that stop email spoofing
Three DNS records work together to prove an email really came from your domain. You add them once, at your domain registrar or DNS host, and receiving mail servers check them on every message you send.
SPF (Sender Policy Framework)<
SPF is a list of the mail servers allowed to send email for your domain, published as a DNS record. When a receiving server gets a message claiming to be from you, it checks whether the sending server is on that list. If a server that isn’t on the list tries to send as your domain, SPF flags it.
DKIM (DomainKeys Identified Mail)
DKIM adds a tamper-proof signature to every message you send. Your mail server signs outgoing email with a private key, and the matching public key sits in your DNS. The receiving server checks the signature to confirm two things: the message really came from your domain, and nobody altered it along the way.
DMARC (Domain-based Message Authentication, Reporting and Conformance)
DMARC ties the other two together and tells receiving servers what to do when a message fails the check. It also confirms that the domain in the visible From address matches the domain SPF and DKIM verified, which is the part that stops someone forging your exact address.
And it sends you reports showing who is sending email using your domain, including the senders who shouldn’t be.
The DMARC setting most businesses get wrong
DMARC has three policy settings, and choosing the wrong one is a common mistake.
- p=none tells receiving servers to do nothing when a message fails. It only monitors and sends you reports. Your domain can still be spoofed.
- p=quarantine tells them to send failing messages to the junk folder.
- p=reject tells them to block failing messages before they ever arrive.
A lot of businesses set up DMARC at p=none, watch the reports come in, and never move past it. At p=none, you get reports but your domain still isn’t protected.
Real protection only starts at quarantine or reject.
Microsoft’s own guidance is to work toward p=reject once you’ve confirmed your legitimate mail passes.
What SPF, DKIM, and DMARC don’t stop
These records stop someone from forging your exact domain.
There are two things they don’t catch, though, and both are worth knowing about.
- Lookalike domains. A scammer can register a domain that resembles yours, like yourcompany-invoices.com, or yourcompany.co instead of .com, and send from that. Your records protect your real domain, not a different one the attacker owns.
- Display-name spoofing. The name shown in the From line can read “Your Company Accounts” while the real address behind it is a random Gmail account. DMARC checks the domain, not the display name.
For those, you still need the habits that catch any phishing attempt: check the full email address rather than just the display name, and verify any request to change payment details by calling a known number, not one from the email.
Why this matters even if you don’t send bulk email
The first reason is protection.
These records stop scammers from impersonating your domain to your clients, your suppliers, and your own staff.
The second is deliverability.
The major mailbox providers now require these records from anyone sending in volume.
Since February 2024, Google and Yahoo have required bulk senders, meaning those sending more than 5,000 messages a day, to use SPF, DKIM, and DMARC.
Microsoft began applying similar requirements to Outlook.com and Hotmail in 2025, routing non-compliant high-volume mail to junk and then rejecting it.
Even below those thresholds, a domain with proper authentication is more likely to reach the inbox than the spam folder.
How to check and fix your domain
You can get a rough sense of where you stand without any technical work.
Several free DMARC and SPF checkers let you type in your domain and see which records exist. That tells you whether the records are present, though not whether they’re configured correctly.
Fixing them properly is a job for whoever manages your IT or your domain.
The records live in your DNS, and a mistake can send your own legitimate email to spam, so the rollout is done in stages:
- Publish SPF and DKIM so all of your real mail sources are covered.
- Add DMARC at p=none and read the reports to confirm your legitimate mail passes.
- Move DMARC to p=quarantine, then to p=reject, once the reports look clean.
Microsoft recommends this same gradual path, starting at none and working toward reject, so you protect the domain without blocking your own mail on the way.
Frequently Asked Questions
What is email spoofing?
Email spoofing is when someone sends a message with your domain in the From address to make it look like it came from your company. It’s used to trick your clients, suppliers, or staff into paying fake invoices, changing banking details, or handing over information.
What are SPF, DKIM, and DMARC in simple terms?
SPF is a list of servers allowed to send email for your domain. DKIM is a signature that proves a message came from you and wasn’t altered. DMARC ties the two together, tells receiving servers to reject messages that fail, and reports who is sending email as your domain.
Does DMARC stop all email impersonation?
No. DMARC stops someone forging your exact domain. It does not stop lookalike domains (like yourcompany-invoices.com) or display-name spoofing, where the sender’s name says your company but the address behind it is different. Those still need staff awareness and payment-verification habits.
Will setting up DMARC block my own emails?
Not if you roll it out gradually. Starting at p=none lets you watch the reports and confirm your legitimate mail passes before you move to quarantine and then reject. Skipping straight to reject without checking first is what causes problems.
Do I need these records if I don’t send many emails?
Yes. They protect your domain from being spoofed regardless of how much email you send, and they help your messages reach the inbox. Google, Yahoo, and Microsoft now expect proper authentication, and mail without it is more likely to be filtered.
—
Featured Image Credit
This Article has been Republished with Permission from The Technology Press.
Aug 5, 2026
Article Summary: A QR code scam, sometimes called quishing, hides a malicious web link inside a QR code. Because the link is buried in an image instead of written as text, it slips past the email filters that normally catch bad links, and scanning the code usually moves the victim onto a personal phone that sits outside the company’s security. Microsoft reported a 146% rise in QR code phishing during the first quarter of 2026.
QR codes are part of normal business now.
You scan them to see a menu, pay for parking, connect to Wi-Fi, or open a shared document.
Attackers know that, and they have started hiding malicious links inside QR codes to get past the security tools that would normally catch a bad link in an email.
The technique has a name, quishing, and it works because a QR code is just an image.
Your email filter reads text, so a link encoded into a QR code can pass straight through. When you scan it, you usually do so on your phone, which sits outside most of the protection your work computer has.
This post covers what a QR code scam is, why it gets past your security, what the common ones look like, and the habits that protect your business.
What is a QR code scam?
A QR code scam is a phishing attack that uses a QR code in place of a written link.
Instead of a clickable URL your email security can inspect, the attacker encodes the web address into a square image.
You scan it with your phone camera, your phone opens the link, and you land on a page built to steal your login or your payment details.
The page on the other end is the same kind of fake you would see in any phishing attack, a login screen made to look like Microsoft 365 or a payment form that copies your bank. The QR code is only the delivery method that gets you there.
Why QR code scams get past your security
Two things make these scams effective.
First, the malicious link is hidden inside an image.
Most email security tools scan the text of a message for known bad links. A QR code is a picture, so the link inside it is not text the filter can read.
The UK’s National Cyber Security Centre points out that not all phishing-detection tools scan images, which is the reason criminals started using QR codes to disguise their links in the first place.
Second, scanning a code moves you onto your phone.
Your work computer probably has web filtering, endpoint protection, and DNS controls that block known bad sites.
Your personal phone usually has none of that. So the moment you scan, you step outside the protection your business pays for, often without realizing it happened.
How common are QR code scams?
The volume is climbing fast. In its report on email threats for the first quarter of 2026, Microsoft said it detected around 8.3 billion email-based phishing threats in those three months.
QR code phishing rose 146% across the quarter, from 7.6 million attacks in January to 18.7 million in March.
By the end of the quarter it had reached its highest monthly volume in at least a year.
Microsoft also found that most of these attacks arrived as PDF attachments, growing from 65% of QR code attacks in January to 70% in March.
The QR code sits inside a PDF, the PDF is attached to an email, and the whole thing looks like an ordinary document until someone scans it.
What QR code scams look like
These are the QR code scams that come up most often.
- A “security” email. You get a message that looks like it is from Microsoft or your IT team, telling you to scan a code to re-enroll your multi-factor authentication or keep your account active. The code leads to a fake login page.
- A shared document. An email says a colleague or client has shared a file, and you need to scan the code to view it. The page asks you to sign in first.
- A fake invoice. A PDF invoice includes a QR code “to pay faster.” The code routes your payment to the attacker.
- A delivery notice. A text or email about a missed package asks you to scan a code to reschedule. The US Federal Trade Commission has warned about this exact scam.
- A sticker in the real world. Attackers print QR code stickers and place them over legitimate ones on parking meters, posters, and payment terminals. You think you are paying for parking, and instead you are handing your card details to a stranger.
How to protect your business from QR code scams
Protecting yourself against Quishing comes down to a few habits:
- Be suspicious of QR codes in emails. A code that arrives by email, especially one that asks you to log in or pay, deserves the same caution as a strange link. The NCSC’s advice is to be wary of scanning QR codes inside emails, even though codes in places like restaurants are usually fine.
- Check the web address before you act. When you scan a code, your phone shows the link before it opens. Read it. If the address is not the official site you expected, close it.
- Go direct instead of scanning. If an email says your Microsoft account needs attention, open your browser and type the address yourself, or use a bookmark. Don’t rely on the code to take you to the right place.
- Watch for urgency. Messages that threaten account closure or a fine “within 24 hours” are trying to rush you past your own judgment. That pressure is itself a warning sign.
- Use phishing-resistant MFA. If a scam does capture a password, phishing-resistant multi-factor authentication (a passkey, a hardware key, or number-matching in an authenticator app) makes that password much harder to use.
- Check physical codes for tampering. Before scanning a code on a parking meter or payment terminal, look for a sticker placed over the original.
- Tell your team. Most people have never been warned about QR code scams. Send your staff a short message with a real example so they know what to watch for.
What to do if someone already scanned one
If you or someone on your team scanned a QR code and entered details on the page that opened:
- Change the password for that account right away, along with any other account that used the same password.
- Confirm multi-factor authentication is turned on for the account.
- Tell whoever manages your IT, so they can check for unusual sign-ins.
- If card or banking details were entered, call the bank and watch the account closely.
Acting quickly limits what an attacker can do with the details they captured.
Frequently Asked Questions
Are QR codes safe to use?
Most QR codes are safe. A code on a restaurant table or an official payment terminal is usually fine. The risk comes from codes sent in unexpected emails or texts, and from stickers placed over real codes in public. Treat those with caution.
What is quishing?
Quishing is phishing that uses a QR code instead of a written link. The word combines “QR” and “phishing.” The goal is the same as any phishing attack: to get you onto a fake page that captures your login or payment information.
Can antivirus or email filters stop QR code scams?
Not always. Many email security tools scan the text of a message for bad links, and a QR code hides its link inside an image, so it can slip through. Some products now scan images for codes, but you should not assume the scam will be caught before it reaches you.
Why is a QR code in an email more dangerous than a normal link?
A written link can be inspected by your email security and opened on a managed work computer. A QR code hides the link from those tools and pushes you to scan with your phone, which usually has far less protection than your work device.
What should I do if I scanned a scam QR code but didn’t enter anything?
If you closed the page without typing anything, the risk is low. Close it, don’t go back, and let your IT contact know so they can keep an eye out. If you did enter a password or payment details, follow the recovery steps above.
—
Featured Image Credit
This Article has been Republished with Permission from The Technology Press.
Jul 30, 2026
Small businesses are the most common ransomware target by volume of incidents, even though many small business owners assume hackers focus on larger organizations. A 22-person company has enough revenue to be worth attacking, no dedicated security team to defend it, and a publicly traceable footprint that takes about an hour to research.
What follows is a step-by-step walkthrough of how a small business gets attacked, written from the attacker’s side. The company in this account is composite, but the methods are accurate to current threat intelligence reporting. After the walkthrough, you’ll see five specific points where the attack would have been stopped by controls that come bundled with security tools most small businesses already pay for.
Monday: how I picked you
I work regular hours and run a small volume operation. My spreadsheet has about 40 prospects per month, and I prefer businesses between 10 and 50 staff. The reason for that range is economics. Large enterprises have security teams, incident response contracts, and lawyers who make recovery expensive on my end. At the other end of the scale, sole traders rarely have enough at stake to bother with. A 22-person commercial services company sits in the right zone: payroll, customer database, project files, supplier relationships, and an owner who will pay to get the lot back. The return per hour is better at this size than at either extreme.
I did not find you through a breach or a tip. I found you on a public business records portal. State business registries, federal contract awards, and county-level licensing databases publish enough detail for me to identify your company, look up your name, estimate your revenue, and pick the most useful person inside the business. One search told me your company name, your registered agent, the contract value of a recent municipal job, and the named contact on the submission.
The fact that nothing has gone wrong at your company yet is the strongest signal I get. It tells me your credentials are probably still valid, your staff has not been trained to spot anything, and nobody has had a reason to change a password. A clean record is the first indicator I look for.
Tuesday: building your org chart for free
I spend about 40 minutes researching your company today using only a browser.
LinkedIn gives me eight of your current employees with their job titles listed. Your office manager has been there for six years and lists “accounts payable, payroll, and supplier invoicing” in her profile summary. Your second admin joined 14 months ago. You list yourself as director, with a sparse profile and a low connection count, which tells me you are unlikely to notice when someone unusual starts engaging with your profile or your company’s social media.
Public business filings confirm your registered business name and your full legal name. A “meet the team” post from two years ago on your Facebook page lists first names and photos, including someone described as helping out in the office a couple of days a week. One of the commenters shares your surname.
I now know who handles your money, what their name is, how long they have been there, what software they probably use (I will check your job ads on Indeed for the phrase “experience with QuickBooks or Sage”), and who in your business has the authority to approve a payment without a second signature.
That last person is my primary target. You are harder to reach and probably more cautious. Your office manager has system access, handles supplier payments, and is busy enough that one more email in her inbox does not get scrutinized the way it might if she had nothing else to do.
I have not spent a dollar yet.
Wednesday: I bought your credentials for $14
Stealer logs are credential packages harvested by infostealer malware that infected someone’s personal device, often months or years earlier. The malware records every username and password typed into the machine, then bundles the data for sale. Marketplaces on Telegram channels and forums let buyers search these logs by company email domain.
I search for your company’s email domain. Two results come back. One is your office manager’s work email, with a password that looks like it was saved in her browser. The other is a personal Gmail address that appears to belong to a family member of yours, probably from a device that shared a home network.
I pay $14 for the package. It takes four minutes.
Your office manager’s password follows a common pattern: a pet or child’s name combined with a year and an exclamation mark. I check it against HaveIBeenPwned, which is the same free database security professionals use, and find that it appeared in a credential dump from a retail loyalty program breach three years earlier. The password has not been changed since.
Your family member’s credentials are more interesting than they look at first. The same password, with minor variations, shows up across a streaming service, a gaming account, and your company’s Microsoft 365 login. The password works. The only thing standing between me and the inbox is the second factor.
Total spend so far: $14.
Thursday: getting past your MFA
Multi-factor authentication stops a lot of attacks, but the implementation matters more than the checkbox.
Simple push-notification fatigue does not work against your office manager’s account. Microsoft enabled number matching by default for all Microsoft Authenticator push notifications in May 2023, which means she would have to type a code from her login screen rather than just tap approve. Push bombing fails against that configuration.
What still works is adversary-in-the-middle (AiTM) phishing. I send your office manager an email designed to look like a routine Microsoft 365 password reset notification, citing the breach that her password appeared in (the same breach I found her credentials in earlier in the week). The link in the email takes her to a page that mirrors the real Microsoft sign-in screen. That page is a proxy I control.
When she enters her password and approves her MFA prompt, my proxy forwards both to the real Microsoft login server. Microsoft validates the credentials, completes the MFA challenge, and issues a session token back to my proxy. I capture the token. She sees a normal login experience on what she thinks is the real Microsoft site, then a “password updated successfully” message.
I am now signed in as her. The MFA prompt succeeded, and the session token sits in my browser instead of hers. Microsoft sees a valid authenticated session and treats my activity as legitimate.
I had a backup plan in case the email did not get clicked. Earlier in the day, I called your office posing as your IT support company, using a name I found in a Google review you had left 18 months earlier. I told your receptionist that we were seeing unusual login activity on the office manager’s account and that I would need her to approve a verification push in the next few minutes. She said the office manager was not at her desk. I said no problem, I would try again later. The call cost me nothing.
By Thursday night, I am inside your office manager’s Microsoft 365 account. I set up an inbox forwarding rule so her emails copy to an address I control without notifying her, then I wait.
Friday 2:47pm: why I waited 36 hours before encrypting
I spend 36 hours reading email before I encrypt anything. That dwell time is how I size the ransom correctly.
In those 36 hours, I find your cyber insurance policy attached to an email from your broker, with a cyber liability sub-limit of $250,000. A bank reconciliation your office manager sent you two weeks ago shows your business account at around $180,000 at month end. Your customer list sits in a quote template she emailed to herself, and a message thread with a municipal project manager mentions a job starting in three weeks with a hard deadline you cannot afford to miss.
I set my ransom at $65,000 in cryptocurrency. That figure is low enough that you will pay rather than fight it, high enough that it is worth my time, and well within what I know you can access. Ransoms set above 10 percent of visible liquid assets tend to get contested. The figure I picked sits below that line.
I deploy the encryption payload at 2:47pm on Friday. The timing is deliberate. Your bookkeeper finishes at 3pm on Fridays, which I know from an out-of-office reply I saw in the forwarded emails. You are on a job site, with your calendar synced to the shared inbox. The person most likely to notice something wrong and call for help is already gone, and the person with the authority to make decisions is unreachable.
By the time anyone understands what has happened, it is a Friday evening, every file on your shared drive is encrypted, and a ransom note sits on every screen in your office.
Total cost to me: $14 for credentials and about six hours of work spread across the week.
Five places this attack would have died
The attack on your business worked because five ordinary things were not in place. None of them were expensive. Most were already bundled into security tools you already pay for.
1. The credential purchase on Wednesday.
HaveIBeenPwned is free. Microsoft Entra password protection can detect and block reused or commonly-compromised passwords across your accounts. Enforcing unique passwords per account, through a password manager and through Entra’s policies, makes a stolen credential purchase useless for me.
2. The MFA bypass on Thursday night.
Microsoft already blocks the simpler push-bombing attack, because number matching has been enabled by default for all Microsoft Authenticator push notifications since May 2023. The current dominant credential-based bypass is adversary-in-the-middle phishing. Defenses include phishing-resistant MFA (FIDO2 hardware keys, passkeys, or Windows Hello for Business), Conditional Access policies that require a compliant or hybrid-joined device, and anti-phishing protection in Microsoft Defender for Office 365. Any one of these would have either prevented the session token capture or made the captured token unusable from my IP address.
3. The inbox forwarding rule.
Microsoft 365 allows admins to block external email forwarding rules at the tenant level. With that block in place, the inbox forwarding rule I used to read 36 hours of email would not have worked. I might have encrypted anyway, but I would have been guessing on the ransom size.
4. The 36-hour dwell time.
Microsoft Defender for Business, included in Microsoft 365 Business Premium, generates an alert when a new inbox forwarding rule is created. If anyone had been watching those alerts, or if the alerts had been routed somewhere visible, I would have been detected on Thursday night. The most impactful change for a business your size is rarely a new product purchase. The improvement comes from someone reviewing the security alerts that the tools you already pay for are already generating.
5. The public business records.
You cannot unpublish a state contracting registry or a federal contract award. That data will stay public. What you can control is what your team chooses to post about their specific responsibilities. Your office manager’s LinkedIn profile listed her financial responsibilities in enough detail to make her the obvious target. That detail is worth a conversation with your team, framed as practical security awareness rather than a rule about what people can post.
Three questions to send your IT provider
These three questions cover most of where the example attack failed. Each one corresponds to a control that comes bundled with security tools you most likely already pay for.
- Are we using phishing-resistant MFA (FIDO2 keys, passkeys, or Windows Hello for Business) for finance, admin, and executive logins?
- Is external email forwarding blocked at the tenant level?
- Are our security alerts going somewhere, and is someone reviewing them?
Frequently asked questions
Do hackers target small businesses?
Yes. Most ransomware operations target small and mid-sized businesses because the ratio of payout potential to defensive resources is higher than at either extreme of company size. The volume sweet spot is roughly 10 to 50 staff, where there are assets worth encrypting but no dedicated security team to defend them.
What is adversary-in-the-middle (AiTM) phishing?
AiTM phishing is a technique where the attacker hosts a proxy page that mirrors a real login screen, such as Microsoft 365 or Google Workspace. When the user enters credentials and approves the MFA prompt, the proxy captures the resulting session token. The legitimate service treats the login as successful, but the session token ends up in the attacker’s browser. AiTM has become the dominant credential-based attack vector against Microsoft 365 tenants after the default rollout of number matching ended simpler push-bombing attacks.
What is a stealer log?
A stealer log is a package of credentials harvested by infostealer malware from an infected personal device. The logs include browser-saved passwords, session cookies, and stored authentication tokens, and they are sold on underground markets for $10 to $20 per package. The malware that creates them typically infects personal computers through pirated software or malicious browser extensions.
How much does it cost an attacker to compromise a small business?
In the example walkthrough above, the total spend was $14 for stolen credentials and about six hours of work. Costs vary, but the threshold to attempt the kind of attack described in this post sits well below $100.
Are there free tools that would have stopped this attack?
Several of the controls referenced in the walkthrough come bundled with Microsoft 365 Business Premium licenses that businesses in this size range typically already hold. External forwarding restrictions and Defender for Business alerts are configuration changes rather than new purchases. HaveIBeenPwned is a free check available to anyone. Phishing-resistant MFA hardware keys are a small per-user cost compared with the cost of a successful ransomware incident.
Sources and further reading
If any of this walkthrough sounded uncomfortably similar to your environment, the three questions above are a good starting point. Your IT provider should be able to confirm what is in place and what is not within an hour or two. And if you don’t have an IT provider, feel free to reach out to us and we’ll help you sort it.
—
Featured Image Credit
This Article has been Republished with Permission from The Technology Press.
