What to look out for today
1) Supplier breach leading to secret/key misuse: Cloud hosting platform Northflank is warning customers to rotate credentials and secrets after a breach where customers’ AI API keys were abused.
2) “Shared AI link” risk (now fixed, but the tactic will continue): Researchers reported a flaw where a malicious ChatGPT share link could run attacker code in the victim’s logged-in session and expose private chats; OpenAI fixed it.
3) Remote support exposure: TeamViewer fixed a flaw where a malicious/compromised remote computer (the device being controlled) could attack the computer used to control it (the viewer). This is especially relevant for MSPs/outsourced IT supporting many small organisations.
Why this matters to smaller businesses
- API keys and stored secrets are “keys to the kingdom”. If they’re taken from a supplier platform, attackers can run up costs (especially AI usage), access data, or pivot into other systems.
- Supplier incidents trigger impersonation scams. When a breach hits the news, criminals often follow with fake “urgent rotation” emails, fake invoices, or “support” calls.
- AI tools are now business systems. Staff may paste customer info, contracts, or internal plans into AI chats. Anything that exposes conversations can become a data breach.
- Remote support tools are business-critical. If a support session can be turned against your IT team’s machine, it increases the risk of wider compromise across multiple clients.
Warning signs
- Unexpected spikes in AI usage or billing alerts (tokens/credits consumed faster than normal).
- Supplier emails urging immediate action, especially ones that ask you to log in via a link, install something, or share recovery codes.
- New or unusual API keys created, secrets accessed, or configuration changes you can’t explain.
- Staff reporting “helpful” links to shared AI chats, prompts, or summaries that they weren’t expecting.
- IT/support reporting crashes, odd behaviour, or unexpected prompts during remote sessions.
How attackers may exploit the situation
- Abuse stolen API keys to generate costs, access connected services, or test other stolen credentials.
- Follow-on phishing: pretending to be your cloud provider/MSP to “help rotate secrets”, capturing logins and MFA codes.
- Data exposure via AI tools: tricking staff into opening malicious shared links or reusing sensitive chat content in unsafe ways.
- Remote support pivot: compromising a device first, then using remote sessions to target the supporting technician/admin machine.
What to do today
- Inventory and rotate: Identify what secrets/API keys you store in Northflank (and similar platforms) and rotate them. Prioritise keys with broad permissions and any that touch billing, data, or production systems.
- Turn on/verify alerts: Ensure billing/usage alerts exist for AI providers and cloud accounts (so spikes are caught early).
- Communicate a short staff warning: “Don’t click ‘shared AI chat’ links you weren’t expecting; don’t paste customer data into AI; report anything that looks like an urgent supplier reset.”
- Remote support hygiene: Ask your IT/MSP to confirm TeamViewer is updated and that remote support is done from hardened admin devices, not general-use PCs.
- Log review: Check for unusual login locations, new tokens/keys, or mass secret reads in your cloud/SaaS audit logs.
Ask your IT provider
- Do we store any secrets/API keys in Northflank (or similar platforms)? Which ones were rotated, and when?
- What monitoring is in place for abnormal API usage and cost spikes (AI and cloud)? Who gets the alerts?
- Can you show our audit trail for key/secret access and recent changes?
- Are remote-support tools (including TeamViewer) kept current, and are support sessions run from privileged, locked-down devices?
- What is our plan if an admin/support machine is suspected compromised (isolation, credential resets, customer notification steps)?
Patch watch - only one short paragraph, and only if relevant
While today’s priority is supplier/credential fallout, it’s also a good moment to confirm your remote-support tooling is up to date: TeamViewer has fixed a flaw where the machine being controlled could potentially attack the controller’s machine during a session. If you outsource IT, ask for written confirmation that their remote-support estate is updated and managed.
One action today
Rotate any API keys and secrets stored in third-party platforms you use (starting with Northflank) and enable billing/usage alerts to catch abuse fast.
Related Actions On Cyber resource
Actions On Cyber checklist: Supplier incident response (how to verify provider messages, rotate credentials safely, and monitor for follow-on scams)
Sources
- Northflank security breach leads to abuse of customers' AI API keys (BleepingComputer)
- A Shared ChatGPT Link Could Run Attacker Code in Your Session and Read Private Chats (The Hacker News)
- TeamViewer Flaw Lets Remote Computers Attack Users Who Connect to Control Them (The Hacker News)
This brief is for general awareness and does not replace advice from your IT provider, legal adviser, insurer or incident response specialist.