What to look out for today
Expect a rise in convincing fake login pages designed to steal Microsoft 365/Google/HR/payroll/CRM logins and then take over accounts. Generative AI is making these pages faster to create, more believable, and more targeted at specific staff and organisations.
Also watch for follow-on scam emails that use real breach news (e.g., from large organisations and their marketing/supplier platforms) to sound credible and push staff into clicking links, sharing codes, or changing details.
Why this matters to smaller businesses
- Email and cloud account takeover often leads to invoice fraud, payroll diversion, and “send me the code” social engineering.
- Once an attacker gets into one inbox, they can use existing email threads to make requests look legitimate.
- Third-party breaches (e.g., through marketing platforms used by partners) can leak enough customer details to make phishing feel “personal” and believable.
Warning signs
- Unexpected “sign-in” or “password expired” emails/messages urging urgent action.
- Login pages that look perfect but arrive via a link in email, SMS, Teams/Slack, or a QR code.
- Requests to share a one-time passcode, approve an MFA prompt, or re-enter MFA codes on a webpage.
- Suppliers/customers contacting you about strange emails “from your team”, odd payment change requests, or new bank details.
- Unusual mailbox behaviour: new forwarding rules, missing emails, or sent items you don’t recognise.
How attackers may exploit the situation
- AI-generated lookalike login portals impersonating Microsoft/Google/payroll/IT helpdesk brands to harvest passwords and MFA codes.
- Session hijacking / token theft style takeovers where attackers aim to bypass login friction after a user has authenticated.
- Breach-themed lures: scammers reference real incidents (such as a large energy provider breach via a marketing platform, or large education-sector exposures) to pressure staff into “confirming” details or logging in to a fake portal.
- Ransomware and disruption pathways: compromised accounts can be used to spread malware internally, access shared files, or reset other passwords.
What to do today
- Tell staff: don’t log in via links in messages. Use bookmarks or type the address directly.
- Make MFA safer: where possible, use number-matching or phishing-resistant methods and reduce reliance on SMS codes.
- Quick admin check: review email forwarding rules and mailbox delegations for key roles (finance, payroll, directors).
- Finance control: enforce call-back verification for any bank detail or payment instruction change (using a known number, not the email signature).
- Prepare for breach follow-ons: if you supply services to the public, remind front-desk/customer teams that scammers may cite well-known breach stories to gain trust.
Ask your IT provider
- Can you show us our current anti-phishing controls for Microsoft 365/Google (link scanning, domain impersonation protection, mailbox rule alerts)?
- Do we have conditional access (e.g., blocking risky sign-ins, new countries, impossible travel) and is it monitored?
- How quickly would we detect and respond to an account takeover (new inbox rules, mass downloads, unusual OAuth/app consents)?
- Are high-risk users (finance, payroll, IT admins) protected with stronger MFA and tighter access controls?
Patch watch - only one short paragraph, and only if relevant
US agencies are warning that the so-called PHP2Shell issues are being exploited in attacks. For SMEs this is a reminder to inventory any internet-facing websites/apps (including those hosted by a third party) and confirm who is responsible for timely updates and monitoring—especially if your site includes contact forms, portals, or custom integrations.
One action today
Send a 2-line staff alert: “Do not sign in from links in emails/texts—use bookmarks. Never share MFA codes or approve unexpected login prompts; report them immediately.”
Related Actions On Cyber resource
CTA: Use the Actions On Cyber “Account Takeover & Business Email Compromise (BEC) – SME checklist”
Sources
- AI-Generated Fake Login Pages Are Making Account Takeovers Easier (The Hacker News)
- Energy giant ENGIE discloses data breach affecting customers (BleepingComputer)
- University of Copenhagen data breach exposes data of 525,000 people (BleepingComputer)
- CISA confirms PHP2Shell vulnerabilities now exploited in attacks (BleepingComputer)
This brief is for general awareness and does not replace advice from your IT provider, legal adviser, insurer or incident response specialist.