What to look out for today
- Fake “ChatGPT” / “Claude” desktop apps being used to install unwanted software (including crypto-miners) via lookalike downloads and fake repositories.
- Malicious Chrome extensions at scale (hundreds of extensions, millions of installs reported) hijacking searches and routing traffic via tracking/redirect infrastructure.
- Cisco SD-WAN controller compromise: reports of attackers exploiting an authentication-bypass flaw to plant malware (“KeyDrift”) intended to steal encryption keys used to protect site-to-site traffic.
Why this matters to smaller businesses
SMEs often rely on browsers, extensions, and “quick utility” downloads to get work done. That makes them a prime target for low-effort compromise that can still cause real disruption: slower devices, lost productivity, account takeover attempts, and knock-on risk to finance and client data.
If you use a managed network provider, MSP, or have SD-WAN equipment managed by a third party, compromise at the network edge can be hard for a small internal team to spot—yet it can undermine trust in connections between sites, branches, and cloud services.
Warning signs
- Staff report they installed a “ChatGPT/Claude app” from an unofficial source, or IT sees new “AI” apps appearing unexpectedly.
- Sudden browser behaviour changes: searches redirecting, new toolbars, homepage changes, or persistent “recommended extension” pop-ups.
- Devices running hot/slow with high CPU usage (possible miner activity), especially soon after installing an app or extension.
- Unexplained login prompts, repeated MFA requests, or sessions being logged out across services (possible follow-on credential/token theft attempts).
- For multi-site businesses: unusual VPN/SD-WAN alerts, unexplained config changes, or connectivity behaving oddly across locations.
How attackers may exploit the situation
- Brand impersonation: pushing “desktop AI assistants” that look legitimate to get staff to run software outside normal procurement.
- Browser-as-a-target: weaponising extensions to redirect traffic, capture browsing data, and set up future phishing/credential theft opportunities.
- Network edge footholds: exploiting weaknesses in SD-WAN controllers to install malware designed to steal encryption keys, potentially weakening confidentiality of traffic between sites.
What to do today
- Send a quick staff note: only use AI tools via approved web links (or company-managed app stores) and do not install “ChatGPT/Claude desktop apps” unless IT has approved them.
- Do a browser extension sweep: remove anything non-essential; block installation of unapproved extensions where possible; review new extensions added in the last 30 days.
- Check endpoint health: investigate machines with sustained high CPU usage and any recent unauthorised software installs.
- If you use SD-WAN: confirm who manages it (internal/MSP/telecom) and ask for evidence they have reviewed exposure and controller logs in light of the reported exploitation.
- Reinforce download hygiene: discourage “quick installs” from search results, ads, and unofficial code repositories.
Ask your IT provider
- Can you provide a list of approved browser extensions and confirm we can restrict installs to that list?
- What is our current control for unauthorised software (application allow-listing, device management, EDR), and how quickly would we detect a crypto-miner?
- Do we operate or depend on Cisco SD-WAN controllers (directly or via a managed service)? If yes, what checks have you done for suspicious access/config changes, and what is the remediation plan?
- How are we monitoring for browser-based data leakage (extensions, token/session theft indicators, risky redirects)?
Patch watch - only one short paragraph, and only if relevant
If your business (or your network provider) uses Cisco Catalyst SD-WAN controllers, treat this as a priority supplier/edge-risk check: reports describe exploitation of an authentication-bypass issue (CVE-2026-20127) to deploy malware. The key action for SMEs is to confirm ownership (who patches it) and get written assurance the platform has been reviewed and brought up to date.
One action today
Today, review and remove any non-essential Chrome extensions across staff browsers (or ask your IT provider to enforce an approved extension allow-list).
Related Actions On Cyber resource
CTA: Use the Actions On Cyber “Phishing & safe downloads” staff mini-checklist (what to install, what to avoid, and how to report suspicious prompts).
Sources
- Hackers exploit Cisco SD-WAN flaw to deploy custom KeyDrift malware (BleepingComputer)
- Hackers Exploited Cisco SD-WAN Flaw to Plant Malware Built to Steal Encryption Keys (The Hacker News)
- Fake ChatGPT and Claude Apps Abuse Signed Executables to Deploy Crypto Miners (The Hacker News)
- Chrome extensions with 13.4 million installs caught hijacking searches (BleepingComputer)
This brief is for general awareness and does not replace advice from your IT provider, legal adviser, insurer or incident response specialist.