What to look out for today
1) Microsoft 365 account takeovers that bypass “normal” MFA prompts via stolen sign-in sessions (token replay). This can lead to mailbox access, email forwarding rules, and payment diversion scams.
2) GitHub token theft leading to leaked secrets (API keys, cloud credentials, signing keys) by abusing GitHub Actions logs. This is especially relevant if you use developers, agencies, DevOps contractors, or CI/CD.
3) Ongoing cryptocurrency “investment” scams (often started via social media, messaging apps, or friendly introductions) which can also be used as a pretext for business payment fraud.
Why this matters to smaller businesses
- Email compromise is still the fastest route to invoice fraud: attackers read threads, learn who approves payments, then impersonate suppliers or directors.
- M365 compromise can become a wider breach: password resets, shared files, Teams chats, and customer data may be accessible depending on permissions.
- GitHub secrets leakage can be a business outage: stolen API keys can mean unexpected cloud spend, service disruption, or data exposure—often before anyone notices.
- Third parties increase risk: outsourced IT, web developers, or agencies may have access to your M365 tenant, your GitHub org, or your DNS/website hosting.
Warning signs
- Users report being unexpectedly logged out of Microsoft 365, then later see “sent” emails they didn’t send.
- New or changed inbox rules (e.g., auto-forwarding, moving emails to RSS/Archive, marking as read).
- Unusual sign-ins for key accounts (finance, directors, shared mailboxes) at odd hours or from unfamiliar locations/devices.
- Supplier bank details “suddenly changed”, or urgent requests to pay to a new account.
- In GitHub: unexpected workflow/activity, runs appearing and disappearing, or staff receiving unexpected requests to re-authorise access.
- Developers/IT mention “secrets” being rotated, or unexplained failures connecting to cloud services/payment gateways.
How attackers may exploit the situation
- Adversary-in-the-middle sign-in pages can trick users into logging in, then capture the session so attackers can access M365 without repeatedly triggering MFA in the expected way.
- Once inside email, attackers commonly monitor conversations, then time a payment diversion (“new bank details”) to match real invoices.
- With stolen GitHub tokens, attackers can extract repository secrets and then use those credentials to access cloud hosting, storage, or customer environments.
- Crypto scams can be used to pressure quick transfers and can also be a cover story to normalise unusual payments.
What to do today
- Tell staff (especially finance) today: never accept bank detail changes by email alone; verify using a known phone number from your records (not from the email).
- Check Microsoft 365 for risky mailbox rules on finance/director accounts and shared mailboxes (forwarding, hidden rules, “mark as read”).
- Review sign-in activity for privileged users (global admins), finance users, and anyone with access to payments.
- Lock down GitHub access: ensure tokens are not long-lived where avoidable, remove old contractor access, and confirm who can manage Actions/workflows.
- Rotate exposed secrets quickly if anything looks suspicious (API keys, webhooks, cloud keys) and document what was rotated and why.
Ask your IT provider
- How are we detecting token-replay / suspicious session sign-ins in Microsoft 365, and what’s our response playbook for suspected mailbox compromise?
- Do we have alerts for new inbox forwarding rules, unusual OAuth/app consent, and anomalous sign-in patterns on privileged and finance accounts?
- Which accounts have admin rights in Microsoft 365, and do we use separate admin accounts (not daily-use mailboxes) for administration?
- For GitHub (or our developer suppliers): who can create/modify workflows, who can view Actions logs, and how do we protect/rotate secrets used in CI/CD?
- If a developer token is stolen, what is the containment plan (access removal, secret rotation, audit of deployments)?
Patch watch - only one short paragraph, and only if relevant
There is reporting of active exploitation of two PHP remote code execution flaws referred to as “PHP2Shell”. If you run a PHP-based website/app (or use a web agency/host), ask them to confirm whether any affected components are in use and what monitoring/mitigation is in place—prioritising anything internet-facing that could lead to website compromise or downtime.
One action today
Phone-verify any supplier bank detail change request today using a known number from your records (not from the email), and remind finance staff to treat “urgent” payment changes as suspicious.
Related Actions On Cyber resource
CTA: Use the Actions On Cyber “Invoice & Bank Detail Change Verification Checklist” for finance teams and approvers.
Sources
- Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizations (The Hacker News)
- Gheist Uses Stolen GitHub Tokens to Steal Private Repository Secrets via Actions Logs (The Hacker News)
- Chinese man extradited for role in $36 million cryptocurrency scam (BleepingComputer)
- PHP2Shell security flaws now sucessfully exploited in the wild (BleepingComputer)
This brief is for general awareness and does not replace advice from your IT provider, legal adviser, insurer or incident response specialist.