📝 Show notes
CyberAware Daily — 2026-10-27
- Threat Deep Dive: fake IT support scams on Microsoft Teams and how to spot them.
- Attackers use Teams messages to trick people into installing remote access tools and malware.
- Always verify IT support requests through a known channel, never through the message itself.
- Over 950 online stores infected with scanner-evading JavaScript, mostly on Magento, targeting payment details.
- Shoppers: check bank and card statements regularly and report anything suspicious.
- PHP releases second Windows security update in five days; relevant only if you run a website.
- DarkWatch: 173,377 captures, 33,311 entities, 2,992 alerts, 11 active targets today.
- One action: if someone claims to be IT support, stop and verify through a trusted number before doing anything.
More at https://cyberawareuk.co.uk
📄 Full transcript
Welcome back to Cyber Aware UK. It's Tuesday, and that means it's Threat Deep Dive Day.
Right, so we're picking one scam type and really getting into the weeds with it.
What are we looking at today?
We're talking about fake IT support scams, specifically ones that start on Microsoft Teams.
There's fresh reporting on this from the last day or so.
Teams, that's the WorkChat app, isn't it? How does a scam work there?
Exactly. You get a message out of the blue from someone claiming to be from IT support.
They say there's a problem with your account, and they need you to install a little tool to fix it.
And that tool is malware?
Often, yes. Or they use it to get remote access to your machine and then deploy ransomware.
The report says attackers are using this to get into company networks.
So this is aimed at people at work, not just families at home.
Mainly work accounts, yes. But plenty of people use Teams on a personal device too, and the same rules apply.
If a stranger messages you claiming to be it, be suspicious.
What should someone do if they get one of these messages?
Don't click anything. Don't install anything.
Hang up, so to speak, and contact your actual IT team through a channel you already know, like the service desk number on your intranet.
That's simple enough. Now there was also news about hacked online stores.
Something like 900 shops infected with sneaky JavaScript.
That's right. Mostly on Mage and Toe, which is a platform lots of online shops use.
The script is designed to avoid being spotted by security scanners, so it can sit there quietly.
What does it actually do?
The report says it's about stealing payment details as people type them in at checkout.
So if you've shopped online recently, it's worth keeping an eye on your statements.
But that's not something a normal person can fix, is it? It's the shop's problem.
It is, yes. The shop owner needs to clean it up.
Your job as a shopper is just to check your bank and card statements and report anything odd straight away.
And maybe use a credit card rather than a debit card for online shopping, if you have the choice.
That's a sensible habit, yes.
Credit cards generally give you stronger protection if something goes wrong.
There was one more headline about PHP getting a second Windows security update in five days.
Should we worry about that?
Not really for most listeners.
It's a fix for a flaw in some server software called PHP.
If you run a website, update it.
If you don't, it's not your problem.
And we should mention the dark web numbers.
Darkwatch is showing just over 173,000 captures and 11 active targets today.
Yes, and there's an active dark web leak site connected to one of the ransomware groups.
But again, that's mainly a concern for businesses, not households.
So what's the one thing people should take away from today?
If someone contacts you out of the blue claiming to be IT support, stop.
Don't install anything they send.
Verify them through a number or channel you already trust.
And if you're shopping online, keep an eye on your statements.
Thanks for listening, everyone.
Stay safe and we'll see you tomorrow.