What to look out for today
1) Microsoft Teams “IT support” chats that aren’t your IT team. Reports describe attackers using Teams external chat to impersonate support and trick staff into actions that lead to malware or ransomware.
2) DreamHost account disruption and forced password resets. If you use DreamHost (website hosting, email, FTP/SFTP), expect password reset prompts and potential service hiccups while the incident is ongoing.
3) Online store infections (Magento-heavy). Nearly a thousand online shops were reported compromised with scanner-evading JavaScript—consistent with payment/data theft style attacks that can be hard to spot.
Why this matters to smaller businesses
- Teams scams hit busy office staff (finance, admin, reception, HR) who are trained to respond quickly to “support” messages.
- Supplier incidents create confusion: real password reset emails and access issues can be used as cover for phishing (“reset here”, “confirm mailbox”, “upload a file”).
- E-commerce compromises can be silent: you may only find out after customer complaints, bank chargebacks, or a sudden dip in trust.
Warning signs
- Unexpected Teams chat from “IT Support”, “Microsoft Support”, or a name you don’t recognise, especially if it’s from outside your organisation.
- Pressure to act fast: “Your account will be disabled in 10 minutes”, “Urgent security fix required”.
- Requests to install software, run a “remote support” session, approve a login, or share a one-time code/password.
- DreamHost users: password reset prompts you weren’t expecting, staff reporting email/FTP access failures, or multiple “reset” messages close together.
- Online shops: unusual checkout behaviour, complaints about fraudulent card use after purchase, or unexplained changes in website templates/blocks.
How attackers may exploit the situation
- Collaboration-tool impersonation: attackers use external chat to reach staff directly, bypassing email filters and appearing “internal-ish”.
- Incident piggybacking: when a supplier forces resets or has disruptions, attackers send lookalike messages to capture new passwords or MFA codes.
- Web shop injections: attackers insert hidden JavaScript that loads additional code only under certain conditions, aiming to steal payment or personal data while avoiding detection.
What to do today
- Set a simple rule for staff: IT will never ask for passwords or MFA codes in Teams chat. If in doubt, staff must phone the known IT/MSP number (not a number provided in the message).
- Teams housekeeping: review whether external Teams chat is needed for all staff; restrict it for high-risk roles (finance/payroll/admin) if possible.
- DreamHost users: reset passwords via your normal, bookmarked login route; enable MFA where available; check who has FTP/SFTP and remove old accounts.
- E-commerce owners (especially Magento): ask your web agency/host to check for unexpected script injections and unauthorised changes to page blocks/templates; monitor for spikes in chargebacks and customer reports.
- Be ready for disruption: confirm you can access domain/DNS, hosting and email admin accounts, and that at least two trusted people can administer them.
Ask your IT provider
- Can you restrict Teams external chat (or limit it to approved domains) and apply it at least to finance/admin users?
- Do we have monitoring/alerting for unusual sign-ins to Microsoft 365 and privileged accounts?
- For DreamHost (if used): what’s our account recovery plan and who owns access to hosting, mail and FTP/SFTP credentials?
- For our website/shop: what file integrity or change monitoring is in place, and how quickly would we detect a malicious JavaScript injection?
- If we suspect a compromise, what is the first-hour plan (containment, customer comms, payment provider contact, evidence capture)?
Patch watch - only one short paragraph, and only if relevant
Some reports today highlight emergency fixes around widely used web components (including Node.js-related tooling). Rather than chasing technical details internally, SMEs should ask their web/IT supplier whether any managed platforms, hosting stacks or e-commerce integrations they run for you require urgent updates, and when those updates will be applied.
One action today
Send a same-day message to staff: “We will never ask for passwords or MFA codes via Teams chat—if ‘IT support’ messages you unexpectedly, stop and phone our known IT number.”
Related Actions On Cyber resource
Actions On Cyber checklist CTA: “Verify-before-you-act” anti-impersonation playbook (Teams/email/phone) for finance and admin teams
Sources
- Attackers Use Microsoft Teams IT Support Scams to Deploy Malware and Ransomware (The Hacker News)
- DreamHost forces password resets in ongoing "incident" (BleepingComputer)
- Hackers Infect 953 Online Stores With Scanner-Evading JavaScript, Mostly on Magento (The Hacker News)
- Critical 'HTTP2Shell' Brotli vulnerability triggers emergency patches (BleepingComputer)
This brief is for general awareness and does not replace advice from your IT provider, legal adviser, insurer or incident response specialist.