What to look out for today
Keep an eye out for phishing and social engineering that aims to install password/credential-stealing malware (often called “stealers”), and for signs that a mobile phone has been compromised (especially for senior staff or people handling payments and sensitive data).
Why this matters to smaller businesses
- Stealer infections can quickly lead to account takeovers (Microsoft 365/Google, payroll, banking, accounting, CRM) and then invoice fraud, data theft, or ransomware later.
- Mobile compromise is not just a “big politics” problem. If a director’s or finance lead’s phone is accessed, attackers may intercept messages, reset passwords, approve MFA prompts, or impersonate the user.
Warning signs
- Unexpected login prompts, MFA push notifications you didn’t initiate, or “your account was signed in from…” alerts.
- Staff reporting unusual attachments/links, especially if they feel rushed or pressured to “open to view”, “enable”, or “verify”.
- New inbox rules/forwarding set up in email, or sent items you don’t recognise.
- On phones: sudden battery drain/overheating, new permissions requests, device restarts/crashes, or odd behaviour around calls/messages.
- Suppliers or colleagues receiving strange emails/texts “from you” asking for urgent actions.
How attackers may exploit the situation
- Use common lures (documents, delivery/HR/finance themed messages) to trick staff into running something that captures passwords and session tokens.
- Target individuals first (personal inbox/phone), then pivot into business accounts where the money and data are.
- After stealing credentials, access cloud services, download data, set up persistence (mailbox rules), and attempt payment diversion or further compromise.
What to do today
- Remind staff: do not open unexpected attachments or “enable” anything in a document. When in doubt, confirm via a known channel.
- Prioritise identity protection: ensure MFA is on for email, finance, payroll and admin accounts; remove old accounts and review who has admin rights.
- Review email security basics: check for suspicious forwarding/inbox rules on key accounts (directors, finance, shared mailboxes).
- Mobile hygiene: ensure device PIN/biometrics are enforced, OS and key apps are up to date, and staff know how to report a suspected compromise quickly.
Ask your IT provider
- Do we have a clear process to detect and respond to account takeover (rapid password resets, token revocation, mailbox rule review, sign-in log review)?
- Which accounts are protected with MFA, and are we using stronger methods for admin/finance (not just SMS where avoidable)?
- Can you produce a monthly list of new email forwarding rules, new mail delegates, and unusual sign-in locations for high-risk accounts?
- What is our mobile device policy (managed vs unmanaged phones), and how do we handle a suspected compromised device?
Patch watch - only one short paragraph, and only if relevant
Not a “patch panic” day from these items, but it’s still worth confirming that Windows/macOS and iOS/Android updates are being applied promptly across staff devices, as attackers commonly rely on out-of-date endpoints and apps to make compromise easier.
One action today
Send a short internal note today reminding staff to report unexpected MFA prompts and to verify any urgent document/link requests via a known channel before opening.
Related Actions On Cyber resource
CTA: Use the Actions On Cyber “Phishing & Invoice Fraud Quick Checks” checklist (share with finance and anyone approving payments).
Sources
- Armored Likho Targets Government Agencies, Power Sector with BusySnake Stealer (The Hacker News)
- European Parliament Member Investigating Spyware Was Hacked With Pegasus (The Hacker News)
This brief is for general awareness and does not replace advice from your IT provider, legal adviser, insurer or incident response specialist.