PAconnect

09/29/2026

"That 'security audit' email might be the attack."

A phishing tactic that borrows its credibility from real news: the fake security audit.

You get an urgent email about a required security audit. It references a breach you've genuinely heard about — that's the trick, the headline is real — and asks you to download and run a tool to complete the check. The tool is remote-access malware. Running it hands someone a foothold on your machine.

It works because it arrives dressed as diligence. You're not being asked to click something reckless. You're being asked to be responsible.

**The habit that stops it:** an unexpected email that wants you to download and run anything gets verified through the vendor's official site or a known phone number first — never through a link or attachment in the message itself.

Legitimate security audits don't arrive as a surprise attachment.

` `

09/23/2026

The most expensive sentence in small business IT: "We're too small for anyone to bother with us."

It made sense when attacks were hand-crafted. It doesn't now. The scanning is automated and indiscriminate — nobody picked you, a tool found an opening and the opening was yours. Being small doesn't make you invisible. It usually just means fewer defenses and no dedicated security staff.

And the math after the fact is worse for small companies, not better. A large enterprise absorbs an incident. A 30-person firm absorbs payroll, downtime, notification costs, lost customers, and legal exposure at the same time.

You don't need an enterprise budget. You need the fundamentals actually turned on: MFA everywhere, patching that happens on schedule, backups that are tested, endpoint protection that's monitored by someone, and a team that knows what a scam looks like.

Not sure where you stand? That's what a free assessment is for. 👉 PAconnect.com

` `

09/16/2026

"They go after your backups first."

The uncomfortable thing about modern ransomware: your backup is the first target, not the last resort.

Attackers know the whole game is whether you can restore. So before they encrypt anything, they go looking for backup systems — and in the large majority of incidents studied, they find and hit them. If your backups are reachable from the same network with the same credentials, they aren't a recovery plan. They're another folder.

Three questions worth asking about yours:

• Is at least one copy offline or immutable — where it can't be deleted even with admin credentials?
• When did someone last perform an actual test restore, not just confirm the job ran green?
• Do you know how long a full restore would take? Hours or days changes every decision you'd make in a crisis.

If any of those get a shrug, that's worth a conversation before it's worth an emergency.

` `

09/10/2026

Security awareness training has a bad reputation, and mostly it's earned.

The version most people have sat through: a 45-minute video, once a year, with a quiz at the end that everyone clicks through while doing something else. Nobody remembers it by March.

The version that works looks different. Short. Frequent. Built around what's actually circulating right now — the fake passkey call, the invoice that isn't, the sign-in prompt nobody started. Plus simulated phishing that tells you which departments need help, without turning it into a gotcha.

The goal isn't a compliance checkbox. It's that when the real one arrives, somebody pauses.

That's part of what we do. Ask us what it looks like. 👉 PAconnect.com

` `

09/08/2026

You can buy every security product on the market and still lose to one click.

Industry reporting for 2026 puts roughly two-thirds of small-business phishing breaches on a single untrained staff member. Not a firewall gap. Not an unpatched server. One person, one convincing message, one ordinary Tuesday.

That's not a reason to blame employees — it's a reason to stop treating security awareness as a once-a-year video nobody watches.

The businesses that hold up run short, frequent, specific training: here's the exact scam going around this month, here's what it looks like, here's what to do. Ten minutes beats ninety, if it's ten minutes about something real.

How long has it been since your team had one of those?

` `

09/01/2026

"Never approve a sign-in you didn't start."

Here's a phishing tactic that never touches your password — and slips past most email security scanning.

Researchers are calling it "ghost phishing." The malicious content stays encrypted until it renders inside the victim's browser, so scanners see nothing suspicious. It gets paired with Microsoft's device-code sign-in flow: the user is prompted to approve a sign-in or enter a code, they do it, and the attacker has the account. No password ever gets stolen.

When the security tooling can't see it, the person is the control.

**The habit that stops it cold:** never approve a sign-in request or enter a device code you didn't personally initiate. If a prompt appears and you didn't start it, don't proceed — report it.

One sentence, in a team meeting, closes this entire attack path.

` `

https://paconnect.com/

08/26/2026

"'We need you to register a new passkey.' Hang up."

A tactic worth warning your team about this week, because it starts with something people don't expect: a phone call.

Attackers call an employee, claim IT needs them to "register a new passkey," and walk them through a fake Microsoft login page in real time. While they're on the phone, the attacker captures the password and the MFA code — then quietly enrolls their own passkey on the account. That gives them access that survives a password reset.

It works because everyone's been trained to distrust email links. Almost nobody has been trained to distrust a helpful voice.

**The habit that stops it:** if someone calls asking you to register a passkey or verify security settings, hang up and call IT back on a number you already had. Real IT teams don't enroll credentials for you over the phone.

Worth sharing with your staff today.

` `

08/24/2026

Most break-ins at small businesses don't look like break-ins.

There's no alarm, no crashed server, no ransom note on day one. Someone on your team gets a phone call, or approves a login prompt that looks routine, and the attacker walks in through the front door using real credentials. By the time anything looks wrong, they've been inside for days.

We've been doing IT in Western PA since 1981. What's changed in the last two years isn't the technology — it's that the attacks are aimed at people now, not equipment.

Over the next month we're posting the specific tactics we're seeing hit businesses like yours, and the habits that stop each one. No sales pitch. Just the things we'd want you to know.

Follow along. 👉 PAconnect.com

` `

08/20/2026

"Microsoft just exposed 'MacSync Stealer' — malware that tricks Mac users into pasting a fake 'fix' command into Terminal, then quietly steals Keychain passwords, browser data, SSH keys, and AWS credentials. Mac ≠ immune. Never paste commands from a website you don't trust. 🍎🔐 "

Microsoft links 30+ domains to MacSync Stealer, tracing recurring ex*****on and chunked exfiltration of credentials and sensitive data.

08/18/2026

AI agents are getting plugged into more business systems every month — and security researchers are warning that many of these integrations store credentials in plain text with way too much access. If your team is adopting AI tools, "set it and forget it" isn't a security strategy. Least privilege still applies.

MCP servers can leak enterprise secrets through plaintext config files or prompt injection. Learn the main risks and how to secure them.