Filed under: Cybersecurity • Phishing • July 2026

What happened

Since April 2026, a criminal crew that researchers track as “Pink” has been calling employees at small and mid-sized companies, posing as Microsoft or internal IT and claiming a “security upgrade” is required. On the phone, they walk the victim through a fake Microsoft 365 login and passkey-enrollment page in real time, capture the password and the MFA approval, sign in to the real account, then quietly register their own passkey so they keep access even after the victim changes their password. There is no software bug here — the attackers simply abuse the legitimate passkey feature Microsoft turned on in May. Security firm Okta detailed the campaign on July 8, 2026.

Why it matters to your business

Passkeys and multi-factor authentication are exactly what we tell every client to turn on — and this attack is built to defeat both by fooling a person on the phone instead of breaking any software. Once the crooks plant their own passkey, they own that mailbox and can silently read and download everything in SharePoint and OneDrive: your invoices, client records, tax documents, and banking details. For a Phoenix small business, one convincing call to a receptionist or bookkeeper can turn into wire fraud or a reportable data breach.

What to do this week

Tell every employee plainly: MicroOne (or your IT provider) will never phone you and walk you through adding a passkey or approving an MFA prompt — if you get that call, hang up and call us back on a number you already have. In the Entra admin center, review each user’s registered sign-in methods (Users > select the user > Authentication methods) and remove any passkey or authenticator you don’t recognize. Then tighten who can enroll: Entra ID > Security > Authentication methods > Passkey (FIDO2), and restrict registration to trusted devices. Finally, turn on a Conditional Access rule that blocks sign-ins from countries you don’t do business in.

The bigger picture

The lock on your accounts is only as strong as the person who can be talked into opening it, and attackers have simply moved from email to the phone. Coaching your team to recognize the pitch is now as important as any software setting. → Phishing Attacks: Why SMBs Are Prime Targets and How to Fight Back

Not sure who could add a passkey to your Microsoft 365 accounts right now? Book a free consult → https://micro1tech.com/contact/

Filed under: Cybersecurity · Phishing · July 2026

What happened

Attackers have refined a trick called “ConsentFix,” an evolution of the “ClickFix” scam, that steals Microsoft 365 accounts without ever grabbing a password. The victim gets a real-looking Microsoft sign-in screen and is coached to drag a small “localhost” link into their browser, which quietly hands the attacker a live session token. Because the token is already an approved, signed-in session, it sails right past the account password and multi-factor authentication (MFA). Step-by-step instructions, working code, and video tutorials for this attack were posted to Russian cybercrime forums back in March, so it is no longer limited to skilled hackers.

Why it matters to your business

For most Phoenix small businesses, the Microsoft 365 mailbox is the crown jewels — it holds invoices, banking details, client files, and the password-reset links for everything else. Attackers scout targets on LinkedIn first, then send a tailored lure through trusted services like Dropbox or DocSend, so the message looks routine. One employee dragging one link can give a stranger full access to email, and MFA won’t save you because it was never challenged. From there it’s a short step to fake invoices, wire-transfer fraud, and messages sent to your clients in your own name.

What to do this week

Lock down who can approve apps: in the Microsoft Entra admin center (entra.microsoft.com), go to Identity → Applications → Enterprise applications → Consent and permissions → User consent settings, and set it to “Do not allow user consent” (or allow only verified publishers with low-impact permissions). Turn on the admin consent workflow on that same screen so approval requests route to you instead. Then tell your team the plain rule: Microsoft never asks you to drag or paste a link into your browser bar to log in — if a sign-in prompt does, stop and report it. Finally, in the Entra sign-in logs, spot-check for logins from unexpected cities or countries over the past two weeks.

The bigger picture

MFA is essential, but it is no longer a finish line — today’s attacks skip the password fight entirely and go after the human and the session token. Training your team to recognize the lure is now just as important as the technical controls behind it. → Phishing Attacks: Why SMBs Are Prime Targets and How to Fight Back

Not sure whether your Microsoft 365 is set up to block this? Book a free consult — https://micro1tech.com/contact/

Filed under: Cybersecurity · Network Security · July 2026

What happened

Researchers investigating “FortiBleed” — a massive credential-theft operation against Fortinet FortiGate firewalls — have now tied it directly to the INC and Lynx ransomware gangs. The attackers planted a traffic-sniffing tool on compromised firewalls to intercept VPN usernames and passwords as employees logged in, harvesting credentials from more than 73,000 devices; the operation targeted over 430,000 firewalls worldwide. Roughly 11,000 devices are believed to still be compromised, and investigators found backdoor admin accounts named “adminin” left behind on affected systems. This is confirmed real-world activity, not a proof of concept.

Why it matters to your business

FortiGate firewalls are common in small offices, often installed by a vendor years ago and rarely touched since. If yours was compromised, the passwords your staff use to connect remotely are sitting in a criminal database — and the groups holding them are ransomware operators whose business is getting into networks and encrypting everything. A firewall that was “fixed” by only changing passwords can still be compromised: if the sniffer is still on the device, new passwords get stolen too.

What to do this week

If your office firewall is a Fortinet: update it to the latest FortiOS firmware for your model, then — in that order — reset every VPN and admin password, since credentials changed before patching may already be captured. Check System → Administrators for any account you don’t recognize (especially “adminin”) and remove it. Turn on multi-factor authentication for VPN logins, and make sure the management interface isn’t reachable from the internet. Not sure what brand your firewall is or who manages it? Find out today — that answer shouldn’t be a mystery.

The bigger picture

Stolen credentials are the raw material of ransomware: gangs don’t need to hack your network if they can simply log in. Once they’re inside, recovery gets expensive fast — prevention is the only plan that reliably works. → Why the Only True Recovery from Ransomware Is Prevention

Who last checked what’s running on your office firewall — and when? Book a free consult → https://micro1tech.com/contact/

Filed under: Cybersecurity · Cloud Account Security · July 2026

What happened Between June 12 and 26, attackers hammered Microsoft 365 accounts with more than 81 million login attempts, using username-and-password combinations leaked in old data breaches. Security firm Huntress confirmed 78 accounts compromised across 64 organizations — most of them small and mid-sized businesses. The twist: the attackers logged in through an automated back route (a legacy sign-in method called ROPC) that never shows an MFA prompt. Many victims had MFA turned on — it just wasn’t configured to cover this path.

Why it matters to your business If anyone at your company has ever reused a password that later showed up in a breach, that password may still open your Microsoft 365 door. “We have MFA” isn’t the same as “MFA covers everything” — common gaps include policies that apply only to admins, only to certain apps, only from “untrusted” locations, or that were left in report-only test mode. Once inside a mailbox, attackers read invoices, redirect payments, and phish your customers in your name.

What to do this week In the Microsoft Entra admin center (entra.microsoft.com → Protection → Conditional Access), confirm your MFA policy applies to all users and all cloud apps — not a subset — and that it’s set to “On,” not “Report-only.” Block legacy authentication with the built-in Conditional Access template. Then review Sign-in logs for waves of failed logins over the past three weeks, and reset any password that’s been reused across sites.

The bigger picture Old passwords never really die — they get sold, and eventually someone tries them on your front door. Strong account hygiene and correctly enforced MFA are the difference between a failed attempt and a hijacked mailbox. → [The First Line of Defense in Employee Data Misuse]

When did someone last actually check your MFA settings — not just confirm they exist? Book a free consult → https://micro1tech.com/contact/