Microsavvy

Where is your incident response plan right now?

If the answer is "in a folder on our network", it may be useless when you need it most.

Cyber attacks don't just lock files. They can take down email, computers, phones, and the very systems you rely on during an emergency.

When that happens, the most valuable document in your business might be a single printed page.

What if your boss called and told you to transfer $40,000 today?

Would your team know it wasn't really them?

AI can now clone a person's voice from just a few seconds of online audio. A LinkedIn video, webinar, or podcast clip is often all it takes.

The scam sounds real. The urgency feels real. The financial loss is very real.

If an email asks you to download a tool to "view a document," stop and verify before clicking.

A growing attack pattern is tricking employees into installing real IT software on their own machines.

The software is called RMM (Remote Monitoring and Management), and it lets IT companies remotely control computers for support purposes.

Tools like ConnectWise ScreenConnect, Datto RMM, SimpleHelp, N-able, and LogMeIn are all legitimate and digitally signed by reputable vendors.

That's exactly why attackers love them. Antivirus software doesn't flag them as malicious because they aren't malicious. They're just being installed by the wrong person.

In February 2026, Microsoft documented a campaign that hit 29,000 users across 10,000 organizations.

The lure was a fake "IRS Transcript Viewer" email. The download was actually a repackaged ScreenConnect installer.

Once an employee ran it, the attacker had full remote control of their machine.

The same trick is being used with fake Zoom invites, fake Teams calls, and fake DocuSign emails.

A few things you can do:

▶️ Ask your IT provider to maintain an allow-list of approved RMM tools. Anything outside that list gets blocked from installing automatically.

▶️ Train your team that "download this viewer to see your document" is almost always a phishing attempt. Real documents don't require a new program.

▶️ Audit your endpoints for RMM software your IT provider didn't install. If you see something unfamiliar, flag it.

If you're not sure what RMM tools are running on your team's computers right now, that's the first thing to check this week.

Hackers are already exploiting new Microsoft Defender vulnerabilities before many businesses have applied updates.

In today’s threat landscape, prevention alone is no longer enough. Rapid detection and response are becoming critical for limiting damage.

The businesses recovering fastest are the ones prepared beforehand.

Researcher drops two more Microsoft Defender zero-days, all three now exploited in the wild - Help Net Security The researcher who earlier this month published a PoC exploit for a zero-day LPE vulnerability in Microsoft Defender is back with two more.