What to look out for today
- Software supply-chain risk (developer tooling): a malicious npm package (“imgdecode”) has been found hiding a Windows native addon loader as part of a wider campaign. This is a reminder that third‑party packages can be an entry point into business systems via internal apps, websites, or build servers.
- Internet-facing VPN / edge device targeting: researchers report attackers exploiting a Fortinet FortiOS flaw to deliver memory‑resident malware. If you rely on a managed firewall/VPN, this is a “check with your provider” moment.
- Data breach ripple effects: Burger King Japan disclosed a breach affecting millions of customer records. Even if you’re not directly involved, big consumer breaches often trigger copycat phishing (“refund”, “points”, “account verification”) and credential-stuffing attempts.
Why this matters to smaller businesses
SMEs often depend on a small number of suppliers for websites, apps, managed IT, and remote access. A compromised software dependency, a vulnerable edge device, or a breach-driven phishing wave can cause real disruption: account takeovers, payment fraud attempts, ransomware access, or loss of customer trust.
Warning signs
- Unexpected MFA prompts, password reset emails, or “new device signed in” alerts for Microsoft 365, Google, payroll, finance or CRM accounts.
- Staff receiving emails/texts about “refunds”, “loyalty points”, “delivery issues”, or “account verification” linked to a well-known brand breach.
- Unplanned changes in website/app build behaviour (new dependencies, unusual build failures, antivirus alerts on build servers, or unsigned/unknown binaries appearing).
- Remote access/VPN instability, unexplained admin logins, or configuration changes on firewalls/VPNs (especially if managed by an MSP).
How attackers may exploit the situation
- Trojan packages in development pipelines: attackers publish lookalike or “useful” packages that get pulled into projects, then execute unwanted code during builds or on Windows systems.
- Edge compromise as a shortcut: targeting VPN/firewall appliances can give attackers a foothold without needing to phish a user first.
- Breach-themed social engineering: criminals piggyback on public breach news to trick staff/customers into clicking links, entering passwords, or approving payments.
What to do today
- Tell staff one simple rule: don’t click breach/refund/points links from emails or texts—go to the site/app directly and log in there.
- Protect admin and finance accounts: confirm MFA is enabled and review sign-in alerts for key accounts (email, accounting, payroll, cloud admin).
- If you build software or run a web agency workflow: review recent dependency additions/updates and restrict who can approve new packages in production builds.
- If you use a managed firewall/VPN: ask your provider to confirm whether your edge devices are affected by Fortinet exploitation reporting and what monitoring they have in place.
Ask your IT provider
- Do we have any internet-facing Fortinet devices (FortiOS / FortiProxy / FortiPAM / FortiSwitchManager) and are they monitored for suspicious admin sessions and config changes?
- What’s our process for emergency vendor security advisories on firewalls/VPNs (same day checks, logging, and confirmation back to us)?
- Do we have a controlled process for third‑party software dependencies (e.g., allow-lists, approvals, build server hardening, and rollback capability)?
- Can you show us recent sign-in risk events and MFA status for our highest-risk accounts (global admin, finance, payroll)?
Patch watch - only one short paragraph, and only if relevant
If you run a Drupal website (including charity/school sites), Drupal has issued patches for critical remote code execution flaws and warned exploits may emerge soon. If your site is hosted/maintained by a supplier, ask them today to confirm your Drupal instance is covered and when it was last updated.
One action today
Send a short staff note today: “Ignore refund/points/breach emails & texts—don’t click links; go to the official site/app directly and report anything suspicious to IT/management.”
Related Actions On Cyber resource
Actions On Cyber checklist: “Stop phishing and payment diversion fraud (staff script + reporting steps)”
Sources
- MALFEX npm Package 'imgdecode' Hides Shellcode Loader in Windows Native Addon (The Hacker News)
- PEERSTITCH Malware Deployed via FortiOS Flaw Bypasses Checks on Tagged VPN Sessions (The Hacker News)
- Burger King Japan data breach exposes 11 million customer records (BleepingComputer)
- Drupal patches critical RCE flaws, warns exploits may emerge soon (BleepingComputer)
This brief is for general awareness and does not replace advice from your IT provider, legal adviser, insurer or incident response specialist.