05/14/2026
⚠️ WARNING: The "Fake Invoice" Hack Going Around Right Now ⚠️
We are seeing a massive spike in compromised email accounts hitting businesses here in Hay River and across the North right now. If you get an email from a trusted contact, vendor, or friend asking you to click a link to view an "invoice," "secure document," or "overdue payment", stop exactly what you are doing.
Here is the harsh truth about how this attack works. It is not just someone guessing your password.
The Trap: You click the link. It takes you to a screen that looks exactly like your real Microsoft or Google login page.
The Theft: You type in your username and password. You even put in your 2-Factor Authentication (MFA) code from your phone.
The Takeover: Because the fake site sits invisibly between you and the real login, the hackers steal your "session cookie",the digital pass proving you just successfully logged in. They bypass your security entirely and hijack your live session.
The Spread: Automated scripts instantly scrape your contacts and reply to your active, ongoing email threads with the same fake invoice link. It spreads rapidly because the emails are coming from your actual, trusted account.
Do not assume you are too smart to fall for this. The attackers use perfect visual copies of login screens and actively hide their tracks by creating inbox rules that delete replies from anyone asking if you were hacked.
How to Prevent This:
Stop blindly clicking links. If you get an unexpected invoice or document link, pick up the phone and call the person directly to verify. Do not reply to the email to ask.
Scrutinize the URL. The login screen might look exactly like Microsoft or Google, but if the web address bar says anything else, it is a trap.
Use a Password Manager. A password manager will absolutely refuse to auto-fill your credentials on a fake website, saving you before you make a mistake.
Log out. Do not stay perpetually logged into your webmail. Close your sessions when you are done.
Protect your business and your contacts. If you think you clicked something you shouldn't have, change your passwords immediately, revoke your active sessions, and check your email settings for hidden forwarding rules. Feel free to share this to keep our local networks clean.
