What to look out for today
Today’s theme is attackers getting into businesses by abusing legitimate tools and trusted sessions (especially Microsoft 365) so activity looks “normal”. At the same time, certificate trust changes and device security updates can cause unexpected access or sign-in issues if your environment is behind on updates.
- Microsoft 365 session abuse: logins that look valid, followed by mailbox rules, MFA prompts, file sharing changes, or new devices being registered.
- Use of legitimate IT/admin tools: remote access and scripting used to blend in with normal IT activity.
- Certificate trust disruption: Windows trust changes can affect secure connections, app installs, and signed components in some environments.
- Mobile device risk: iPhones/iPads on older versions may still be in use in SMEs (execs, sales teams, BYOD) and targeted attacks can start with a crafted file.
Why this matters to smaller businesses
SMEs often rely on Microsoft 365, a small number of admin accounts, and outsourced IT. That makes “quiet” takeovers dangerous: attackers can change bank details, steal invoices, access payroll/HR data, or use your email to scam customers and suppliers—without tripping obvious malware alarms.
Separately, certificate/trust changes and delayed device updates can create business disruption (staff can’t sign in, apps break, VPN/remote tools fail) at exactly the moment you need reliable access.
Warning signs
- Repeated MFA prompts, or staff reporting “I didn’t request this” approvals.
- New mailbox rules (e.g., auto-forwarding, deleting messages, hiding alerts) or unexpected “Inbox is empty” reports.
- Unexpected sharing links created in OneDrive/SharePoint, or lots of downloads at odd hours.
- New devices appearing in your Microsoft 365/Entra device lists, or admin role assignments changing.
- Customers/suppliers saying they received odd payment requests “from you”.
- Sudden TLS/certificate errors on Windows machines or line-of-business apps after updates (or because updates haven’t been applied).
How attackers may exploit the situation
- Stolen sessions/credentials to get into Microsoft 365 without “breaking in” (then change email rules and file permissions).
- Living-off-the-land: using tools your IT team already uses (remote management, PowerShell-like activity, admin portals) to avoid detection.
- Invoice/payment diversion: monitor email threads, then jump in at the right time with “updated bank details”.
- Targeted mobile compromise: older iOS/iPadOS devices can be used as an entry point to access email, MFA prompts, files and chats.
What to do today
- Tell staff: never approve unexpected MFA prompts; report them immediately.
- Check Microsoft 365 basics: review recent sign-ins for finance/admin users; look for new forwarding rules and suspicious mailbox rules.
- Finance control: reinforce call-back verification for any bank detail changes (use a known number, not the email thread).
- Device hygiene: ensure iPhones/iPads used for work are updated and managed (or at least required to have a passcode + latest OS).
- Prepare for disruption: if you see certificate warnings or sign-in failures, treat it as an IT incident (don’t bypass security prompts to “get work done”).
Ask your IT provider
- Do we have alerting for suspicious Microsoft 365 sign-ins (impossible travel, new device, unusual locations) and mailbox forwarding/rule creation?
- Which accounts have admin roles, and are they protected with stronger controls than normal user accounts?
- Can we quickly invalidate sessions and force sign-out if we suspect a takeover?
- Do we have a documented process for investigating “MFA spam” reports?
- Are Windows devices receiving the relevant trust/certificate updates reliably (including machines that don’t get automatic trust updates)?
- What is our BYOD stance for phones accessing Microsoft 365 (minimum OS level, device encryption/passcodes, remote wipe)?
Patch watch - only one short paragraph, and only if relevant
Keep an eye on Windows out-of-band trust changes (certificate distrust updates) and ensure work iPhones/iPads—especially older devices—are updated, as Apple has backported fixes for an exploited issue to older models. Treat unexpected certificate warnings or sudden access failures as a signal to involve IT, not something to click through.
One action today
Today, have finance/admin users review their Microsoft 365 account activity and mailbox rules, and remind all staff to report unexpected MFA prompts immediately.
Related Actions On Cyber resource
Actions On Cyber checklist: Microsoft 365 account takeover quick checks (mailbox rules, forwarding, sign-ins, MFA prompts) and payment-change verification
Sources
- The Huntress Tragic Quadrant: Ranking Threats Hitting Businesses Hardest (BleepingComputer)
- Microsoft releases Windows OOB updates to distrust eMudhra certificates (BleepingComputer)
- Apple Backports Fix for Exploited CoreGraphics Flaw to Older iPhones and iPads (The Hacker News)
- Apple backports CoreGraphics zero-day patches to older iPhones (BleepingComputer)
This brief is for general awareness and does not replace advice from your IT provider, legal adviser, insurer or incident response specialist.