http://www.kstreetllc.com/, http://twitter.com/k_Streetllc

K_Street Consulting LLC, 1432 k Street, N. W. Suite#1000, Washington D.C., DC (2026)

08/03/2026

The FBI has issued a warning about a new type of phishing attack targeting Microsoft 365 users 😰

And this one's a little bit different…

Normally with phishing attacks, the attacker tries to steal your password.
This time, they’re trying to steal something called an “OAuth token”.

An OAuth token is like a temporary digital pass that proves you’ve already logged in successfully.

It’s what keeps you signed in on certain apps like Outlook, Teams, and OneDrive without needing to re-enter your password every few minutes.

So, If an attacker gets access to that token, they could also access your services as if they were actually you. 🥸

And the phishing emails themselves are becoming incredibly convincing, thanks to AI...

They can appear as shared documents, meeting invites, or even account notifications. And can often lead to real Microsoft login pages.

So, when someone approves the request, it seems perfectly legitimate.

That’s exactly the same trap in which the attacker is effectively getting you to approve access to, on their behalf.

This is a perfect example of exactly why cybersecurity is changing so rapidly right now.

For years, businesses focused heavily on securing passwords and antivirus software. And while those aspects are still important, attackers are increasingly finding successful work-arounds by targeting normal human behavior instead;

A rushed click or an approval without thinking is but a momentary distraction during a busy day; and its often all they need to strike.

Fortunately, there are protections you can put in place behind the scenes, especially around how Microsoft 365 handles authentication requests.

For now, its best to remember that if you receive an unexpected login request, verification prompt, or email asking you to approve access to anything.., 𝘀𝗹𝗼𝘄 𝗱𝗼𝘄𝗻 𝗮𝗻𝗱 𝘁𝗵𝗶𝗻𝗸 𝗯𝗲𝗳𝗼𝗿𝗲 𝗰𝗹𝗶𝗰𝗸𝗶𝗻𝗴 𝗮𝗻𝘆𝘁𝗵𝗶𝗻𝗴!

👉 Have you noticed that phishing emails are harder to spot lately?
Tell us your input!
https://api.mspsites.com/sp/cf2684412c3

07/31/2026

You could say that some of the AI stuff being pushed into Windows 11 lately has been rather annoying. 😅

If there are features you won’t use, it can feel like Microsoft is adding noise rather than value.

But buried under all the hype, there are a few AI ideas that really do make sense.

One of the best features Windows ever added was Clipboard History.

Press 𝗪𝗶𝗻𝗱𝗼𝘄𝘀 𝗸𝗲𝘆 + 𝗩 and you can see everything you’ve copied recently, not just the very last thing. Once you get used to it, it’s hard to live without.

Now imagine instead of pasting what you copied, Windows could help you reformat it for use...

Copied a block of text? Turn it into bullet points.

Copied messy data? Convert it into a table.

Copied an image? Remove the background before pasting.

All this can be done directly from the clipboard, without opening another app.
That’s what Microsoft’s experimenting with.

It’s patented an idea that essentially adds a sort of "𝗮𝗱𝘃𝗮𝗻𝗰𝗲𝗱 𝗽𝗮𝘀𝘁𝗲” to the Windows clipboard, using AI to offer smart options when you paste.

That saves you the arbitrary formatting steps.

This is the kind of AI I like; small, practical help where it already fits naturally into how we work.

It’s still early, but it shows the direction Microsoft could be heading.

And honestly, if AI is going to win people over, it’ll be through features like this; quiet, optional, and genuinely useful.

❓Would you be more open to AI in Windows if it only showed up when it made your work easier?

Tell us your thoughts!
https://api.mspsites.com/sp/cf2684412c3

07/29/2026

If your business website runs on WordPress, here’s a quick check for you 🔎

There’s a popular plugin called Quiz and Survey Master (QSM).

It’s used by more than 40,000 websites to create quizzes, surveys and forms without needing any coding.

Unfortunately, versions 10.3.1 and older were recently found to have a serious security flaw.

The issue is what’s known as an 𝘚𝘘𝘓 𝘪𝘯𝘫𝘦𝘤𝘵𝘪𝘰𝘯 𝘷𝘶𝘭𝘯𝘦𝘳𝘢𝘣𝘪𝘭𝘪𝘵𝘺.

SQL is the language used to talk to a website’s database, the part that stores things like user accounts, submissions, and other important data.

An "SQL injection flaw" means someone can discretly sneak malicious commands into that database using the SQL language.

In this case, any logged-in user, even someone with a basic subscriber account, could potentially inject commands into the system.

That could allow actions like:
🚫 Accessing sensitive data
🚫 Extracting information from the database
🚫 Manipulating content

The vulnerability is tracked as CVE-2025-67987, and it was fixed in version 10.3.2.

The latest version available is 10.3.5, which is the safest bet.

Based on WordPress.org data, just over half of websites using QSM are on version 10.3. Which means that a large number of websites are likely still vulnerable....That’s potentially tens of thousands of sites.

Right now, there’s no confirmed evidence of this flaw being 𝘢𝘤𝘵𝘪𝘷𝘦𝘭𝘺 exploited. But once a vulnerability is public, attackers often start scanning the internet looking for unpatched sites.

👉 𝗜𝗳 𝘆𝗼𝘂𝗿 𝘀𝗶𝘁𝗲 𝘂𝘀𝗲𝘀 𝘁𝗵𝗶𝘀 𝗽𝗹𝘂𝗴𝗶𝗻, 𝘁𝗵𝗲 𝘀𝗼𝗹𝘂𝘁𝗶𝗼𝗻 𝗶𝘀 𝘀𝘁𝗿𝗮𝗶𝗴𝗵𝘁𝗳𝗼𝗿𝘄𝗮𝗿𝗱: 𝗨𝗽𝗱𝗮𝘁𝗲 𝗶𝘁 𝗶𝗺𝗺𝗲𝗱𝗶𝗮𝘁𝗲𝗹𝘆 👈

Overall, this is a reminder of something we often tell business owners: 𝘞𝘰𝘳𝘥𝘗𝘳𝘦𝘴𝘴 𝘪𝘵𝘴𝘦𝘭𝘧 𝘪𝘴𝘯’𝘵 𝘶𝘴𝘶𝘢𝘭𝘭𝘺 𝘵𝘩𝘦 𝘸𝘦𝘢𝘬 𝘭𝘪𝘯𝘬. 𝘐𝘵’𝘴 𝘵𝘩𝘦 𝘱𝘭𝘶𝘨𝘪𝘯𝘴.
Every plugin you install adds functionality but also adds potential risk.

𝗜𝗳 𝘆𝗼𝘂’𝗿𝗲 𝗻𝗼𝘁 𝗮𝗰𝘁𝗶𝘃𝗲𝗹𝘆 𝘂𝘀𝗶𝗻𝗴 𝗮 𝗽𝗹𝘂𝗴𝗶𝗻 𝗼𝗿 𝘁𝗵𝗲𝗺𝗲, 𝗶𝘁 𝘀𝗵𝗼𝘂𝗹𝗱𝗻’𝘁 𝗷𝘂𝘀𝘁 𝗯𝗲 𝗱𝗲𝗮𝗰𝘁𝗶𝘃𝗮𝘁𝗲𝗱, 𝗜𝘁 𝘀𝗵𝗼𝘂𝗹𝗱 𝗯𝗲 𝗱𝗲𝗹𝗲𝘁𝗲𝗱 𝗳𝗿𝗼𝗺 𝘁𝗵𝗲 𝘀𝗲𝗿𝘃𝗲𝗿 𝗰𝗼𝗺𝗽𝗹𝗲𝘁𝗲𝗹𝘆.

Websites aren’t a set and forget asset. They’re part of your digital infrastructure.

If they’re vulnerable, they can become an entry point into your wider systems. Especially if admin accounts reuse passwords across services.

❓ When was the last time someone checked which plugins your website is running and whether they’re fully up to date?

Tell us your input!
https://api.mspsites.com/sp/cf2684412c3

07/27/2026

Here’s something most businesses don’t think about…

You install a plugin on your website.

It works fine and you trust it.

Or maybe it’s been there for years.
Then one day, it updates.

And that update opens the door to an attacker 😱

That’s what’s happened in the WordPress world...

A hacker bought a collection of legitimate plugins (more than 30 of them), and all previously had a solid reputation with thousands of active users.

Then they pushed an update.

Hidden inside that new update was a backdoor (which is a way for someone else to access your website without permission).

In some cases, this gave full control.

What makes this particularly clever is how well hidden it remained.

The malicious code was designed to show spam and harmful content only to search engines like Google, but not to the actual website owner.

So, everything looked normal when you checked your own site.

Meanwhile, your website could be redirecting visitors or damaging your reputation in search results.

𝗠𝗼𝗱𝗲𝗿𝗻 𝗮𝘁𝘁𝗮𝗰𝗸𝘀 𝗮𝗿𝗲 𝗲𝘃𝗼𝗹𝘃𝗶𝗻𝗴. 𝗡𝗼𝘄, 𝗶𝗻𝘀𝘁𝗲𝗮𝗱 𝗼𝗳 𝗯𝗿𝗲𝗮𝗸𝗶𝗻𝗴 𝗶𝗻, 𝘁𝗵𝗲𝘆’𝗿𝗲 𝘄𝗮𝗶𝘁𝗶𝗻𝗴 𝘁𝗼 𝗯𝗲 𝗶𝗻𝘃𝗶𝘁𝗲𝗱 𝗶𝗻.

Plugins, apps, integrations… they’re all helpful, but they also extend access into your systems.

It means it’s more important than ever that they’re managed properly.

👀 Keep an eye on what’s installed.
❌ Remove anything you don’t use.
🤝 Make sure updates are coming from trusted sources.

Because once something like this is in place, it can be very hard to spot.

🧐 When was the last time you reviewed the plugins or add-ons running on your website?

Tell us your input!
https://api.mspsites.com/sp/cf2684412c3

07/24/2026

For years, the advice around logins has been the same:

🔒 Make passwords long
🔒 Make them complex
🔒 Don’t reuse them
🔒 Add another layer like a code sent to your phone

It works, but it’s never been simple.

Now, cybersecurity experts are giving businesses different advice...

Instead of using passwords, you should be using something else entirely;
Passkeys 🔑

If you haven’t utilized them yet, it’s simple; instead of typing a password, your device itself proves that you're who you say you are... using your fingerprint, your face, or the PIN you use to unlock your phone or laptop.

There’s nothing to remember and nothing to type!

Behind the scenes, it uses a pair of digital keys.
One stays on your device, the other sits with the service you’re logging into.

They only work together, which makes them very hard to steal or reuse somewhere else.

Most cyberattacks still start with stolen login details (i.e. a fake website, a phishing email, or a reused password from an old breach).

Passkeys remove that weak point altogether...
There’s no password to guess, steal, or accidentally hand over.
Even if you land on a fake site, the passkey won’t work there.

𝗧𝗵𝗶𝘀 𝗶𝘀 𝗼𝗻𝗲 𝗼𝗳 𝘁𝗵𝗼𝘀𝗲 𝗿𝗮𝗿𝗲 𝗰𝗵𝗮𝗻𝗴𝗲𝘀 𝘁𝗵𝗮𝘁 𝗶𝗺𝗽𝗿𝗼𝘃𝗲𝘀 𝗯𝗼𝘁𝗵 𝘀𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗮𝗻𝗱 𝘂𝘀𝗲𝗿 𝗲𝘅𝗽𝗲𝗿𝗶𝗲𝗻𝗰𝗲 𝗮𝘁 𝘁𝗵𝗲 𝘀𝗮𝗺𝗲 𝘁𝗶𝗺𝗲.

It’s easier to log in, and there’s stronger protection in the background.

And adoption is growing fast, with major platforms building it in by default.

🤔 Given the choice, would you switch to passkeys for everything now? Or would you prefer to stick with passwords for a bit longer?

Tell us your preference!
https://api.mspsites.com/sp/cf2684412c3

07/22/2026

This is one of the more interesting cyberattacks I’ve seen in awhile:

A group (known as UNC6692) has been targeting businesses in a way that nearly feels normal...
It starts by flooding your inbox with spam emails or notifications.

Then, a message arrives through Microsoft Teams from someone claiming to be IT support...and they say they've spotted an issue and can fix it for you.

Now, you’ve witnessed an issue, so this feels helpfully proactive.

If you follow the instructions, you’re taken to a page that looks genuine and asked to log in as part of a quick check.

And just like that- your details go straight to the attacker.

Simultaneously, software can be installed in the background, giving ongoing access to your device without you even noticing...

So, what looks like a quick fix turns into full access willingly given away. 😱

What stands out here is just how believable the whole interaction is.

A problem appears, someone reaches out, and a solution is offered. It mirrors exactly how support would typically work.

And that’s precisely WHY it works.

But this is a 𝘨𝘰𝘰𝘥 𝘳𝘦𝘮𝘪𝘯𝘥𝘦𝘳 𝘵𝘩𝘢𝘵 𝘯𝘰𝘵 𝘦𝘷𝘦𝘳𝘺 𝘵𝘩𝘳𝘦𝘢𝘵 𝘱𝘳𝘦𝘴𝘦𝘯𝘵𝘴 𝘪𝘵𝘴𝘦𝘭𝘧 𝘴𝘶𝘴𝘱𝘪𝘤𝘪𝘰𝘶𝘴𝘭𝘺. Some of them look like help arriving at the right moment.

𝗜𝗳 𝘀𝗼𝗺𝗲𝗼𝗻𝗲 𝗰𝗼𝗻𝘁𝗮𝗰𝘁𝘀 𝘆𝗼𝘂 𝗼𝘂𝘁 𝗼𝗳 𝘁𝗵𝗲 𝗯𝗹𝘂𝗲 𝗼𝗳𝗳𝗲𝗿𝗶𝗻𝗴 𝘁𝗼 𝗳𝗶𝘅 𝗮𝗻 𝗶𝘀𝘀𝘂𝗲, 𝗲𝘀𝗽𝗲𝗰𝗶𝗮𝗹𝗹𝘆 𝗼𝗻𝗲 𝘁𝗵𝗮𝘁’𝘀 𝗷𝘂𝘀𝘁 𝗮𝗽𝗽𝗲𝗮𝗿𝗲𝗱, 𝘀𝘁𝗼𝗽 𝗮𝗻𝗱 𝗰𝗵𝗲𝗰𝗸 𝘄𝗵𝗼 𝘆𝗼𝘂’𝗿𝗲 𝗿𝗲𝗮𝗹𝗹𝘆 𝗱𝗲𝗮𝗹𝗶𝗻𝗴 𝘄𝗶𝘁𝗵 𝗯𝗲𝗳𝗼𝗿𝗲 𝘁𝗮𝗸𝗶𝗻𝗴 𝗮𝗻𝘆 𝗮𝗰𝘁𝗶𝗼𝗻.

That pause is often all it takes to spot what’s going on.

💭 If someone messaged you saying they could fix a problem you’d noticed, would you question it?

Tell us your thoughts!
https://api.mspsites.com/sp/cf2684412c3

07/20/2026

When you’re so focused on not getting caught out by an email scam, you forget that other types of scams even exist.

And one that’s doing the rounds right now starts with a simple phone call;

Someone calls (sounding confident, maybe even a little stressed) and says they can’t get into their account...

They might claim to be traveling, about to join a meeting, or locked out of something important... and they just need a quick password reset.

And that’s where the problem begins😬

It's called “𝘃𝗶𝘀𝗵𝗶𝗻𝗴” (𝘃𝗼𝗶𝗰𝗲 𝗽𝗵𝗶𝘀𝗵𝗶𝗻𝗴), and it’s being used to trick IT support into handing over access.

Attackers 𝗽𝗿𝗲𝘁𝗲𝗻𝗱 𝘁𝗼 𝗯𝗲 𝘀𝗲𝗻𝗶𝗼𝗿 𝘀𝘁𝗮𝗳𝗳 members of a client's company and use real details pulled from places like LinkedIn to corroborate relative information.

In some cases, they’ll call multiple times, changing their voice or story until something works and they get their hypothetical foot in the door.

Meanwhile, the real person they’re impersonating is sitting at their desk, completely unaware.

But once they get in, they don’t stop after accessing only one account.

They move across systems like Microsoft 365; moving through email, file storage, and anything else connected.

And because this isn’t hacking in the traditional sense, no antivirus or firewall can protect you. They won’t stop a conversation.

The only protective precaution here lies in the process.

Take a moment to verify who you’re speaking to. Don’t rush because something feels urgent. Set a simple rule that certain changes can’t be done on the spot without proper checks.

It might feel a bit over the top, but it isn’t.
You're always better off safe than sorry.

👉 If someone called your business today asking for access help, would you know how to verify it’s really them?

Tell us your thoughts!
https://api.mspsites.com/sp/cf2684412c3

07/17/2026

You open your inbox and there’s an email saying your photos are about to be deleted.
There’s a date, a warning, and a big button telling you to fix it.

That’s the kind of message that makes you stop what you’re doing and pay attention.

And if you use iCloud, you might be on the receiving end of a message like this!

Your panic is exactly what these scam emails are designed to trigger; 🚨

They usually say something has gone wrong with your account:
It might be that your storage is full, your payment has failed, or your account has been blocked.

Then they add pressure with a deadline and a quick way to “resolve” the problem.

But really, the link in the email IS the problem.
It takes you to a page that looks very similar to Apple’s login screen, but it isn’t real.

If you enter your details, they go straight to the attacker.

From there, it can lead to access to your files, your email, and potentially other accounts if the same password is used elsewhere.

What makes this difficult to spot is the timing.

These emails arrive alongside genuine notifications about storage or billing, so nothing immediately feels out of place.

But if you take a moment to look closer, there are often small signs:
-The sender address might not match Apple’s usual domain.
-The wording can feel slightly off, and sometimes there are grammar mistakes that a large company wouldn’t normally make.

The safest way to handle this is not to use the link in the email at all!

If you’re unsure, go directly to your account 𝘁𝗵𝗿𝗼𝘂𝗴𝗵 𝘆𝗼𝘂𝗿 𝗱𝗲𝘃𝗶𝗰𝗲 𝘀𝗲𝘁𝘁𝗶𝗻𝗴𝘀 or by typing the official website into your browser.

That way you know you’re in the right place.

Many 𝗮𝘁𝘁𝗮𝗰𝗸𝘀 𝗻𝗼𝘄 𝗿𝗲𝗹𝘆 𝗼𝗻 𝗽𝗲𝗿𝘀𝘂𝗮𝘀𝗶𝗼𝗻 𝗿𝗮𝘁𝗵𝗲𝗿 𝘁𝗵𝗮𝗻 𝘁𝗲𝗰𝗵𝗻𝗶𝗰𝗮𝗹 𝘁𝗿𝗶𝗰𝗸𝘀. They’re built to create urgency and get a quick reaction.

Taking a few seconds to pause and check is often enough to avoid a much bigger problem.

And remind your team to do the same thing. Particularly on company devices in use.

👉 If you saw an email like this, would you recognize it as a scam right away?

Tell us your input!
https://api.mspsites.com/sp/cf2684412c3

07/15/2026

There’s a type of cyberattack that doesn’t get mentioned often...

And it doesn’t present itself like an attack... rather , it looks more like a file.

Someone sends you a "connection file."
You double-click it, and it opens what looks like a typical remote session.

But there’s actually more happening than you can see... something called an "RDP file" comes in.

RDP stands for Remote Desktop Protocol.
It lets you connect to another computer over the internet, as if you were sitting in front of it.

Businesses use it all the time for remote working or accessing servers.

The problem lies in how flexible these files actually are are they can be set up to share things from your computer with the one you’re connecting to. This might include files, clipboard data, or even login methods.

So, if someone sends a malicious version of any one of these file types, opening it can inadvertently grant access to things you didn’t intend.

Microsoft stepped in with some new protections in Windows 11 and Windows 10 to deal with this type of attack...which is a sensible move.

Now, when you open one of these connection files, Windows will stop and show you a clear warning beforehand;

It’ll tell you:
-where you’re connecting to,
-whether the file is from a verified source,
and exactly what parts of your computer it’s trying to access.
..Even better, those shared features are switched off by default.

Instead of everything being open automatically, you must choose what gets shared.

That one change alone removes a lot of the risk.

🚧There’s also an extra warning if the file comes from an unknown source, which makes it much harder to accidentally trust something you shouldn’t.

Phishing emails are getting more creative, and files like this are a good example of how attacks are evolving. While this update doesn’t stop every threat, it does give you a moment to check what’s happening before a connection is made.

And sometimes that pause is all it takes to avoid a problem.

🧐 If you received a file asking you to connect to a system, would you feel confident knowing what it’s really doing?

Tell us your thoughts!
https://api.mspsites.com/sp/cf2684412c3

07/13/2026

If you use a Windows PC every day, there’s one thing you probably open without even thinking about it... File Explorer.

It’s how you find files, move things around, open folders… basically the backbone of getting work done on your computer.

And if it’s slow or glitchy, you notice instantly.

That’s why this update for Windows 11 is more impactful than it sounds...

Microsoft is working on a full tune-up of File Explorer that's centered on speed and reliability.

Early testing revealed that it opens faster, especially when you first launch it after (re)starting your PC.

That aspect alone makes a noticeable difference- because those little delays add up across the day.

But there’s also a fix for something that’s been annoying users for a while...
If you use dark mode, you might have noticed random white flashes when opening folders or switching views. This will be fixed to be prevented altogether.

There are a few practical improvements too....

-You’ll be able to open more types of compressed files (things like ZIP files, but in different formats) without needing extra software.

-File Explorer itself should behave more reliably, especially when closing windows or switching between tasks.

These changes are already being rolled out... so things might already feel a bit quicker, smoother, and a little less frustrating.

And that’s where the real productivity gains emerge.

👉 Does File Explorer feel quick and reliable for you, or is it one of those things you’ve learned to tolerate?

Tell us your input!
https://api.mspsites.com/sp/cf2684412c3

K_Street Consulting LLC

08/03/2026

07/31/2026

07/29/2026

07/27/2026

07/24/2026

07/22/2026

07/20/2026

07/17/2026

07/15/2026

07/13/2026

Address

Telephone

Website

Alerts

Contact The Business

Shortcuts

Share

Category