Technology Visionaries LLC

One of the biggest myths about cybersecurity is that malicious apps always look malicious 👀

A lot of the time they don’t.

In fact, some of the most successful scams are built around things that appear completely boring and harmless 😰

Researchers recently uncovered a huge operation involving hundreds of fake Android apps that looked like ordinary tools people use every day.

Things like PDF readers, utility apps, and similar downloads you probably wouldn’t think twice about installing.

The apps worked properly. That’s what made them convincing.

The problem started afterwards.

Once installed, users would see a message saying the app needed an update.

But the “update” downloaded something completely different.

From there, the device started loading hidden adverts that no human ever saw.

The aim wasn’t to spy on people or steal passwords. It was ad fraud.

The attackers were generating fake advertising activity to siphon money from advertising platforms and businesses paying for online ads.

And the scale of it was huge.

Researchers say these apps were downloaded more than 24 million times 📱

What stands out to me here is how normal the whole thing sounds.

People simply installed tools that looked useful.

Employees install apps onto phones and tablets all the time without thinking of them as a security risk.

Especially when the app appears to do exactly what it promises.

Google has removed the identified apps from the Play Store, but stories like this are a good reminder that app stores are not perfect filters.

Harmful apps can still slip through.

You need to be cautious with what gets added to company devices.

Especially if an app suddenly asks you to install updates or software outside the official app store process.

💭 When was the last time you checked what apps are installed on your business devices?

For years, the advice has been simple: “Be careful what you click on in Google.”

Now we might need to start saying the same thing about AI 🤖

Microsoft has warned that cybercriminals are finding ways to manipulate AI tools into recommending fake software downloads.

And honestly, it makes sense when you think about how people use the internet now.

A lot of us don’t search the way we used to anymore 🔦

Instead of typing something into Google and scrolling through websites, people are asking AI questions directly…

“What’s the best tool for checking PC temperatures?”
“Where can I download this app?”
“What software should I use for…?”

The problem is that attackers are adapting to that behavior.

Researchers found criminals creating fake websites pretending to be popular tools.

Somehow, they’re managing to get these malicious sites recommended by AI systems.

Instead of tricking search engines, they’re now trying to trick AI.

And if someone trusts the recommendation and downloads the file, malware gets installed on the device.

In some cases, that malware gives the attacker remote access to the computer. They can then explore the network and steal data.

They may even install something called a “crypto jacker”.

That’s software which uses your computer’s power to mine cryptocurrency for the attacker.

Your machine slows to a crawl while somebody else profits from your electricity bill 💸

The bigger point here is that cybercriminals follow behavior.

If people move from search engines to AI, attackers move there too.

That means we need to treat AI recommendations with the same level of caution we’d use for search results or emails ⚠️

Helpful doesn’t always mean safe.

AI is an incredible tool, but it doesn’t “fact check” the internet in the way many people assume.

It can still surface bad information, fake sites, or manipulated recommendations.

So, if you’re downloading software, especially business software, you should still check the source properly before clicking install.

💭 Have you started using AI instead of Google for searches yet?

The FBI has issued a warning about a new type of phishing attack targeting Microsoft 365 users 😰

And this one is a little different…

Normally with phishing, the attacker tries to steal your password.

This time, they’re trying to steal something called an “OAuth token”.

A what?!

An OAuth token is like a temporary digital pass that proves you’ve already logged in successfully.

It’s what keeps you signed into apps like Outlook, Teams, and OneDrive without needing to enter your password every few minutes.

If an attacker steals that pass, they can potentially access those services as if they were you 🥸

The phishing emails themselves are becoming incredibly convincing, thanks to AI.

They can look like document shares, meeting invites, or account notifications. And they often lead to real Microsoft login pages.

So, when someone approves the request, it feels legitimate.

That’s the trap 🪤 The attacker is effectively getting you to approve access on their behalf.

This is why cybersecurity is changing so much right now.

For years, businesses focused heavily on passwords and antivirus software, and those are still important.

But attackers are increasingly finding ways to work around them by targeting normal human behavior instead.

A rushed click, an approval without thinking, a moment of distraction during a busy day. That’s often all they need.

Fortunately, there are protections you can put in place behind the scenes, especially around how Microsoft 365 handles authentication requests.

And remember, if you receive an unexpected login request, verification prompt, or email asking you to approve access to something, slow down and think before clicking anything 🔎

Even if it looks genuine.

👉 Have you noticed that phishing emails are harder to spot lately?

Where your files are stored shapes how your business runs.

It affects who can access them, how easily your team can work together, and what happens if something goes wrong.

If everything still lives on individual devices, think about what that really means day to day, or when things don’t go to plan…

Here’s something most businesses don’t think about…

You install a plugin on your website.

It works fine and you trust it.

Maybe it’s been there for years.

Then one day, it updates.

And that update opens the door to an attacker 😱

That’s what’s happened in the WordPress world.

A hacker bought a collection of legitimate plugins, more than 30 of them, all with a solid reputation and thousands of active users.

Then they pushed an update.

Hidden inside that update was a backdoor, which is a way for someone else to access your website without permission.

In some cases, this gave full control.

What makes this particularly clever is how it stayed hidden 🫥

The malicious code was designed to show spam and harmful content only to search engines like Google, not to the website owner.

So, everything looked normal when you checked your own site.

Meanwhile, your website could be redirecting visitors or damaging your reputation in search results.

Modern attacks are evolving. Now, instead of breaking in, they’re waiting to be invited in.

Plugins, apps, integrations… they’re all helpful, but they also extend access into your systems.

It means it’s more important than ever that they’re managed properly.

👀 Keep an eye on what’s installed.

❌ Remove anything you don’t use.

🤝 Make sure updates are coming from trusted sources.

Because once something like this is in place, it can be very hard to spot.

🧐 When was the last time you reviewed the plugins or add-ons running on your website?

For years, the advice around logins has been the same:

🔒 Make passwords long
🔒 Make them complex
🔒 Don’t reuse them
🔒 Add another layer like a code sent to your phone

It works, but it’s never been simple.

Now, cybersecurity experts are giving businesses different advice.

Instead of using passwords, you should be using something else entirely.

Passkeys 🔑

If you haven’t come across them yet, it’s simple.

Instead of typing a password, your device proves it’s you.

That might be your fingerprint, your face, or the PIN you use to unlock your phone or laptop.

There’s nothing to remember and nothing to type 🥳

Behind the scenes, it uses a pair of digital keys. One stays on your device, the other sits with the service you’re logging into.

They only work together, which makes them very hard to steal or reuse somewhere else.

Most cyberattacks still start with stolen login details. A fake website, a phishing email, or a reused password from an old breach.

Passkeys remove that weak point 🔐

There’s no password to guess, steal, or accidentally hand over.

Even if you land on a fake site, the passkey won’t work there.

This is one of those rare changes that improves both security and user experience at the same time.

It’s easier to log in, and there’s stronger protection in the background.

And adoption is growing fast, with major platforms building it in by default.

🤔 Given the choice, would you switch to passkeys for everything now? Or would you prefer to stick with passwords for a bit longer?