Today’s look-out: Supplier incident scams + credential theft (infostealers) + online service disruption (DDoS)
What to look out for today
Three themes to brief your team on today:
- Credential theft (infostealers) is getting smarter: Talos reports an infostealer (“VOLTA”) that steals passwords, browser sessions and crypto wallet data, then uses AI to help attackers prioritise which victims are most valuable.
- Supplier breach follow-on scams: Chainalysis has disclosed a breach exposing customer identity details (names, email addresses, user IDs and roles). Even if you’re not a customer, incidents like this commonly trigger convincing “we’re updating accounts” and “verify access” phishing.
- Disruption risk for online services: Cloudflare reports very high volumes of network-layer and HTTP DDoS activity. SMEs may see website/portal slowdowns, payment/booking issues, or knock-on impact via hosting and SaaS providers.
Why this matters to smaller businesses
- Infostealers often lead to business email compromise (BEC): stolen passwords/sessions can be used to access Microsoft 365/Google accounts, invoicing systems, and file shares—then to impersonate staff and suppliers.
- Supplier breach data helps attackers sound credible: role and organisation details make targeted spear-phishing and “helpdesk” scams more believable.
- DDoS isn’t just a big-company problem: attackers often hit smaller sites and hosted services because they’re easier to disrupt, or as a side-effect of wider attacks.
Warning signs
- Unexpected emails or calls claiming: “your account was accessed”, “reset your password”, “re-confirm MFA”, or “download this security report”.
- Links to shared AI/chat or “document review” pages that request you to log in again, or open in a browser when you normally wouldn’t.
- Staff reporting browser pop-ups, odd extensions, or being logged out of accounts unexpectedly.
- Sudden spikes in failed login alerts, new mailbox forwarding rules, or “new device signed in” notifications.
- Your website, customer portal, VoIP phones, or remote access becoming intermittently unavailable (possible DDoS or upstream disruption).
How attackers may exploit the situation
- Infostealer infections (often triggered by convincing lures) can steal saved passwords and active session cookies/tokens—letting criminals access accounts even when a password isn’t known.
- Breach-themed impersonation: attackers use real names/roles from supplier incidents to send tailored messages (e.g., “Finance Admin: confirm bank details” / “IT Admin: re-validate access”).
- DDoS as cover: disruption can distract teams while attackers attempt fraud (e.g., changing payment details while systems are “down”).
What to do today
- Send a 2-minute staff warning: “Expect breach-themed emails and ‘security verification’ requests. Don’t click login links from emails—go via bookmarks. Report anything urgent about payments or account access.”
- Prioritise account security checks: review recent sign-ins for email and finance systems; look for unfamiliar devices/locations and new forwarding rules.
- Harden payment change processes: insist on call-back to a known number (not the email signature) for any bank detail changes or urgent invoice requests.
- Prepare for disruption: ensure you have a simple “service outage plan” (how to take orders, communicate with customers, and process payments if your site/portal is unavailable).
Ask your IT provider
- Do we have monitoring/alerts for new inbox forwarding rules, suspicious sign-ins, and unusual OAuth/app consent activity?
- Can we quickly force sign-out / revoke sessions for key accounts (finance, admin, senior leadership) if an infostealer is suspected?
- What’s our DDoS and availability plan for our website and critical suppliers (hosting, DNS, email, VoIP)? Who do we call and what are the response time expectations?
- Are we using phishing-resistant MFA (where possible) for admin and finance accounts, and do we have conditional access rules for risky logins?
Patch watch - only one short paragraph, and only if relevant
While today’s main risks are phishing, account takeover and disruption, remote-access edge devices remain a common entry point for ransomware and data theft. If you use Ivanti Connect Secure (often managed by an MSP), ask for confirmation that it’s being actively monitored and that any vendor emergency updates and mitigations have been applied promptly.
One action today
Send a short internal alert to staff today: treat any ‘security verification’, ‘password reset’, or ‘bank detail change’ message as suspicious—don’t use email links to log in, and verify payment changes by calling a known number.
Related Actions On Cyber resource
Actions On Cyber checklist: “Invoice & bank detail change control (anti-BEC) – call-back and approvals”
Sources
- Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealer (Cisco Talos)
- Chainalysis discloses data breach from "offensive agentic techniques" (BleepingComputer)
- Chainalysis Confirms Intrusion Into Internal Tools and Exposure of Customer Identity Data (The Hacker News)
- Cloudflare Reports 18.2 Million Network-Layer DDoS Attacks in Q3, Up 38% (The Hacker News)
- Attackers Chain Three Ivanti Connect Secure Flaws to Gain Unauthenticated Root Access (The Hacker News)
This brief is for general awareness and does not replace advice from your IT provider, legal adviser, insurer or incident response specialist.