Good afternoon. If there is a thread running through Wednesday and this morning, it is that attackers have stopped buying expensive tools and started renting your trust instead. A fake second authentication step, a poisoned chatbot answer, a plain email with a link in it, and a patch window that has shrunk from weeks to hours. Here are the five stories that matter most if you are running a small or midsize business, or leading its IT.
Researchers have shown how an attacker inside your Microsoft tenant can register a fake authentication provider that quietly captures every password as people sign in. Varonis Threat Labs published the technique, which it calls TrustSink, on Wednesday. Entra can be configured to hand a user off to an external multi-factor provider after the password step, and if that provider returns a valid signed token, Entra treats the second factor as satisfied. An attacker who already holds a Global Administrator or Authentication Policy Administrator account can register their own provider, which then serves a prompt that borrows Microsoft’s fonts, layout and buttons and appears at exactly the moment a user expects another step. The part worth sitting with is the cleanup: resetting the compromised password does nothing, because the rogue provider stays registered in the tenant’s Authentication Methods Policy and simply harvests the replacement the next time that person signs in. This is a good week to ask a plain question of whoever administers your Microsoft 365, in house or outsourced, which is how many accounts actually hold Global Administrator today and whether anyone reviews the authentication methods policy on a schedule. Attacks that require privileged access are not reassuring when the privilege is handed out freely. Read more at BleepingComputer
A critical WordPress flaw was patched on Tuesday and attackers were exploiting it the same morning, which is the real headline. CVE-2026-87902 carries a 9.2 severity score and lets an unauthenticated attacker pull a chosen local PHP file into WordPress template resolution, which can end in remote code execution when the server environment and active theme line up a particular way. Security firm Previdian logged the first exploitation attempt at 11:49 a.m. UTC on September 22, the same day the patch shipped, and has counted 68 attempts since, with Patchstack confirming that the activity moved from harmless probing to actually writing PHP files to disk. Because WordPress auto-updates by default, Previdian expects mass attempts and relatively few real compromises, which is the encouraging half of the story. The discouraging half is the timeline. The gap between a fix being published and being weaponized is now measured in hours, and that reframes what a reasonable patching policy looks like for anything you run that faces the internet. If your marketing site runs on WordPress and nobody owns it, this is the reminder that the site is infrastructure whether you treat it that way or not, and the versions to be on are 7.1.2, 7.0.6, 6.9.9 or 6.8.10. Read more at The Hacker News
August was the worst month for ransomware so far this year, with 1,073 organizations hit worldwide. NCC Group published the figures on Wednesday in its monthly threat intelligence report, a 12 percent jump from the 973 victims logged in July. North America absorbed 44 percent of the total, Europe 26 percent, and the industrial sector alone accounted for almost a third of all incidents, with consumer goods and services at 18 percent and healthcare at 12 percent. Two crews did most of the damage, with 164 attacks attributed to Qilin and 116 to The Gentlemen. Numbers like these are easy to skim past, but the useful way to read them is as a statement about volume rather than targeting. Nobody is picking your company off a list. The economics now favor casting wide, which means the relevant question is not whether you are interesting enough to attack but whether you are cheap enough to compromise. That is a question about patching discipline, backups you have actually tested restoring from, and multi-factor coverage that has no exceptions, and all three are within reach of a business your size. Read more at Infosecurity Magazine
Attackers have found a way to make ChatGPT and Google’s AI answers hand out their fake phone numbers and login pages as trusted facts, and 374 companies are caught in it so far. Vigilance Security detailed the campaign, which it calls Dark Sourcery, on Wednesday. Rather than injecting prompts, the attackers flood the open web with optimized posts, PDFs, reviews and fake support pages, betting that the models will retrieve that content and repeat it. Researchers found tens of thousands of malicious pages carrying bogus support numbers, email addresses, login pages and software update instructions, with Delta, Chase, Bank of America, Airbnb and others among the brands swept up, and they called some of the fake numbers and reached a person happy to help them move a flight or unlock an account in exchange for card details. Vigilance cites a study finding that 91 percent of people never verify what a chatbot tells them, which is the whole attack in one sentence. There are two takeaways depending on which side of this you sit on. If your customers can reach you by phone or a support portal, it is worth occasionally asking a chatbot how to contact your company and seeing what comes back. And if your team uses AI assistants for research, the old habit of checking the source has not gone away just because the answer now arrives in a sentence instead of a link. Read more at Dark Reading
A malware family that used to require a Windows zero-day is now arriving as an ordinary email with a link in it, and it is landing on corporate machines. Huntress documented the shift on Wednesday, tracking DarkMe, a remote access trojan and infostealer previously tied to a group that went after forex traders and crypto users. The email points at what looks like a PNG file, but clicking it downloads image.pif, which modern Windows happily executes as a program no matter what the extension or icon suggests, and two Huntress customers had users who simply double-clicked it. What follows is a chain of loaders that checks the machine against a list of 329 applications, and the interesting detail is that the list includes things like gaming mouse utilities and RGB lighting daemons, which hold nothing of value but prove a real human uses the computer. It is a sandbox check run backwards. Huntress put the business lesson better than I can, which is that adversaries are pivoting from skilled targeted intrusions to high volume, low effort attacks because in 2026 people still click links in unsolicited email, and there is no reason to burn an expensive exploit on a problem a plain message solves. Security awareness training gets mocked as a checkbox, and often it is run like one, but this is the attack it is actually for. Read more at Help Net Security
Follow Up
Follow-up to the September 14 story on Dutch warnings about Check Point VPN flaws issued before anyone had seen an exploit: the attacks arrived, and the federal deadline is Friday. Check Point has confirmed active exploitation of CVE-2026-85102, a pre-authentication remote code execution flaw in the VPN certificate handling of its Security Gateway and Spark firewalls, scored at 9.8. The company disclosed the bug and shipped fixes on September 9, and malicious activity began September 12, with attackers routing through VPNs and proxies to obscure their location and Spark customers targeted globally. CISA added it, alongside a second 9.8 management server flaw, to the Known Exploited Vulnerabilities catalog on September 22 with a remediation deadline of September 25. The fix is LivePatch Take 26 on supported R81.20, R82 or R82.10 gateways, or a fixed Jumbo Hotfix, with Spark firewalls needing R82.00.10 Build 2325 or R81.10.17 Build 4968. The pattern here is worth naming, because it keeps repeating: a national cyber agency warns, a few days pass, and the exploitation shows up. Those advisories are not academic, and treating them as a head start rather than noise is most of the advantage a smaller organization can get. Read more at BleepingComputer
Sponsored by Lucky 13 Solutions
Business in Motion. Tech in Sync. Lucky 13 Solutions is a managed services provider helping small and midsize businesses keep their IT reliable, secure, and well-supported, without needing a full in-house team. Learn more at l13s.com.
If you act on one thing off this list, make it the Global Administrator count in your Microsoft tenant, because two of today’s stories only work once someone already has that key.
Get the Business IT News Roundup in your inbox:
How this gets made: stories come from my own reading and from AI-assisted research and drafting, all reviewed and edited by me before anything goes out. The commentary is mine, sources are linked so you can read the original, and any errors are mine to own. If something looks wrong, reply and tell me.