A phishing attack response starts with staff training and URL verification after Microsoft and Health-ISAC disrupted a billion-message cybercriminal network targeting 75,000+ organizations. Small business owners must assume some phishing messages still reach inboxes and train employees never to enter passwords on links received via email.
Billion Phishing Messages Blocked, VPN Site Scam Steals Logins, and Critical Ivanti Flaw Under Attack
In today's cybersecurity update for October 14th, 2026, small business owners face several critical threats requiring immediate attention:
BILLION-MESSAGE PHISHING NETWORK DISRUPTED: Microsoft and Health-ISAC, working with law enforcement, disrupted a massive cybercriminal ecosystem that sent over 1 billion phishing messages targeting 75,000+ organizations across 150 countries. The operation seized domains powering three Chinese-language phishing marketplaces (YAM Store, CoGUI, and Iron Man) that sold phishing kits and tools enabling attacks with minimal technical skill. While spam filters should see reduced activity, businesses must maintain staff training on identifying suspicious emails and never entering passwords on pages reached through email links.
FAKE WATCHGUARD VPN DOWNLOAD SITE: Attackers created a convincing fake WatchGuard VPN download website that steals credentials before delivering the legitimate, digitally signed VPN installer. A browser pop-up collects VPN server address, username, and password, supposedly for verification. Businesses should always download software directly from official vendor sites by manually typing the URL, never through search results or email links. If compromise is suspected, immediately change all VPN passwords and review access logs.
IVANTI CONNECT SECURE ZERO-DAY EXPLOITATION: CISA issued an urgent warning about CVE-2026-104935 (CVSS 8.6), an authentication bypass flaw in Ivanti Connect Secure VPN appliances being actively exploited since at least October 1st. The vulnerability allows attackers to create VPN sessions without passwords, granting direct internal network access. Honeypots logged 105 exploit attempts within days. Organizations using these appliances must update immediately or take systems offline until patching is complete.
HIRUDO ANDROID BANKING MALWARE: New Android malware replaces legitimate banking apps with modified versions that disable built-in security checks while appearing and functioning identically to the real apps. Currently targeting Indonesian banks, the technique captures usernames, passwords, and security codes. Malware spreads through phishing and malicious websites, not official app stores. Businesses should enforce app installation only from official stores, maintain current Android security updates, and educate staff about app reinstallation requests.
META GITHUB REPOSITORY BREACH: Meta disclosed that stolen employee credentials led to unauthorized access to a GitHub repository, exposing software code and personal information for approximately 1,500 U.S. employees. The incident demonstrates that credential theft affects organizations of all sizes. Small businesses should enforce multi-factor authentication universally, regularly review system access permissions, and monitor for unusual login patterns.
Sources: BleepingComputer, SecurityWeek, Cyber Security News, The Hacker News, GBHackers Security
Why is phishing attack response urgent for small manufacturers and service firms?
The disruption of YAM Store, CoGUI, and Iron Man (three Chinese-language phishing marketplaces) removed these specific platforms from operation. These marketplaces sold phishing kits and tools that required minimal technical skill, lowering the barrier for attackers with no coding background to launch campaigns. For a small business, the immediate risk is that attackers will shift tactics and target new entry points. The single most important action: mandate that all staff verify sender email addresses, never click links in unsolicited messages, and always navigate to banking or vendor sites by typing the URL directly into the browser instead of following email links. Pair this with a password manager to eliminate manual credential entry on untrusted pages.
Key takeaways
- Microsoft and Health-ISAC seized domains powering three phishing marketplaces. Always download software directly from vendor websites, never through search results or email links.
- Attackers created a fake WatchGuard VPN download site harvesting credentials before delivery. If compromise is suspected, immediately change all VPN passwords and review access logs.
- CVE-2026-104935 (CVSS 8.6) in Ivanti Connect Secure allows password-less VPN access. If your firm uses Ivanti appliances, patch immediately or offline the system until patching is complete.
- Android banking malware replaces legitimate apps with modified versions that appear identical. Require staff to install apps only from official stores and enable automatic OS updates.
Frequently asked questions
Our staff got phishing emails from the disrupted networks. What do we do now?
Delete the messages. The domains are seized, so links no longer work. Focus on teaching staff to spot phishing red flags (urgent language, requests for passwords, mismatched sender addresses) and verify any request for credentials by calling the supposed sender directly using a number you find independently.
An employee may have entered their password on a fake website. What's the immediate action?
Force a password reset for that employee immediately. If they used the same password elsewhere, reset those accounts too. Check VPN access logs and system login history for unauthorized sessions from new IP addresses during and after the incident. If you find evidence of unauthorized access, alert your IT provider and consider notifying law enforcement.
Do we need to update our Ivanti VPN appliance right now?
Yes. CVE-2026-104935 is actively exploited and allows attackers to bypass password authentication entirely. Patch immediately or disconnect the appliance until you can apply the update. Check your access logs for unauthorized VPN sessions created on or after October 1st and revoke any suspicious accounts.
How do we prevent staff from installing malware disguised as banking apps?
Enforce a policy requiring all mobile app installation only from official stores (Apple App Store, Google Play). Require staff to enable automatic Android and iOS security updates. Teach them never to reinstall apps after an unexpected request or message, and to contact their IT team if an app behaves oddly.
The Meta breach exposed 1,500 employee credentials. Should we worry?
If your business uses any Meta services (Facebook, Instagram business accounts, or integrations), review your account access and check for suspicious login attempts. Enable multi-factor authentication on every account, not just email. This breach shows that credential theft can affect any organization size. Audit who has access to your critical systems and disable unused accounts.
Keep reading
Produced with AI from TC3's daily cyber briefing video. Not individually reviewed before publishing; questions go to a human at [email protected].