What to look out for today
- Ransomware disruption spreading via suppliers: a health organisation reported outages affecting care and operations, and a cloud desktop provider told customers to disconnect/shut down PCs due to a ransomware threat.
- New-style Microsoft/Google-style login phishing: “device code” style sign-in prompts that don’t look like a normal password-stealing page, but can still hand attackers access to a business account.
- E-commerce checkout risk from third-party scripts: a shared analytics script used on online shops was reportedly tampered with to steal payment card details at checkout.
Why this matters to smaller businesses
SMEs and charities often rely on a small number of key systems and suppliers (cloud desktops, online shop plugins, Microsoft 365/Google accounts, MSP-managed IT). When those are disrupted or abused, the impact is immediate: missed appointments, delayed orders, payroll/finance disruption, reputational damage, and time-consuming customer support. These events also commonly trigger copycat scams (fake “urgent security” emails, fake invoices, and fake IT support calls) aimed at staff.
Warning signs
- Emails or calls claiming “urgent shutdown”, “disconnect now”, or “we’ve been hacked”—especially if they push you to click a link, install software, or share MFA codes.
- Staff receiving unexpected sign-in prompts that say enter a code or approve a device, especially if they weren’t actively logging in.
- Unusual activity in cloud accounts: new inbox rules, unexpected forwarding, new “authorised apps”, or login alerts from odd locations.
- Online shop red flags: sudden spike in card-payment complaints, chargebacks, or customers reporting they’ve had card fraud after buying from you.
How attackers may exploit the situation
- Supplier incident scams: criminals mimic genuine supplier notifications (cloud desktop providers, MSPs, even healthcare/education suppliers) to trick staff into handing over credentials, approving MFA, or paying a “restoration fee”.
- Device-code phishing: attackers persuade users to complete a legitimate-looking sign-in flow that ends up granting the attacker access, often bypassing the “classic” fake login page pattern.
- Script supply-chain abuse: attackers alter a third-party script used across many sites, so skimming happens invisibly during checkout—your business may not be the original target, but you carry the fallout.
What to do today
- Send a 2-minute staff warning to treat “urgent shutdown/security incident” messages as suspicious and to verify via a known channel (bookmark/vendor portal/known phone number), not via the email link.
- Check cloud account hygiene: review admin accounts, MFA status, and recent sign-in alerts; remove unknown “authorised apps” and investigate unexpected mail forwarding/rules.
- If you run an online shop: ask whoever manages your website to confirm what third-party scripts are present on checkout pages and whether any were recently changed; monitor chargebacks and customer complaints closely.
- Rehearse the “ransomware morning” plan: who can take systems offline, who contacts the MSP/insurer, and how you continue core operations for 24 hours.
Ask your IT provider
- If our key SaaS provider has a security incident, what is our verification process—how do we confirm messages are real and what steps we’d take first?
- Are we protected against account takeover tactics like device-code phishing (e.g. stronger sign-in policies, limiting risky auth flows, monitoring for unusual token/app consent activity)?
- Do we have alerting for suspicious cloud changes (mailbox forwarding rules, new admin roles, new app consents)? Who reviews those alerts daily?
- For our website/e-commerce: do we have controls for third-party scripts (inventory, change control, monitoring) and a plan to respond to suspected card skimming?
Patch watch - only one short paragraph, and only if relevant
There is reporting of active exploitation of a “Node2Shell” class issue in widely used components. Even if you don’t recognise the name, this is the kind of risk that can sit inside web services and internal tools. Ask your IT/MSP to confirm they are tracking it and prioritising any internet-facing systems and key business applications for urgent remediation where applicable.
One action today
Send a short internal alert: “Do not act on urgent ‘security shutdown’ emails/calls; verify via our known contacts, and report unexpected sign-in/code prompts immediately.”
Related Actions On Cyber resource
CTA: Use the Actions On Cyber ‘Supplier Incident Scam Playbook’ checklist (verification steps, comms template, and who-to-call list).
Sources
- UNM Health ransomware attack disrupts patient care, surgeries (BleepingComputer)
- Japan's GMO urges customers to shut down PCs amid ransomware threat (BleepingComputer)
- American Organizations Under Attack: Skyw4lker Device Code Phishing Campaign Exposed (The Hacker News)
- Hackers hijack Convertr analytics script to steal payment card data (BleepingComputer)
- CISA warns of hackers now exploiting critical Node2Shell flaw (BleepingComputer)
This brief is for general awareness and does not replace advice from your IT provider, legal adviser, insurer or incident response specialist.