Push-bombing: when the MFA prompt is the attack
Three clients in a fortnight have had staff approve a sign-in they did not start, because the phone would not stop buzzing. Here is what it looks like and the one setting that ends it.
Office printers with their admin pages open to the internet
During assessments this quarter, one office in five had a multifunction printer reachable from outside, default password intact, address book full of staff email addresses.
The invoice that was almost paid
A supplier emailed to say their bank details had changed. The email was real, from the real mailbox, in the real thread. The supplier had not sent it.