11/4/26 Email

Cyber threats are becoming faster, more sophisticated, and increasingly difficult to recognize. Attackers are using artificial intelligence (AI), social engineering, stolen credentials, and compromised legitimate accounts to create attacks that can look and sound authentic.

According to the Microsoft Digital Defense Report 2026, people and identities remain major targets. Attackers continue to rely on phishing, impersonation, malicious user actions, and abuse of legitimate accounts, while AI is allowing attacks to be created and executed with greater speed and scale. [microsoft.com], [microsoft.com]

A message that looks legitimate is not necessarily safe.

🚨 CURRENT CYBERSECURITY THREATS

🤖 AI-Powered Phishing & Impersonation
AI can help criminals create highly convincing emails, texts, Teams messages, and other communications that imitate legitimate organizations and trusted individuals. Microsoft reports that AI is increasing the speed, scale, and personalization of social-engineering attacks. [microsoft.com], [microsoft.com]

🔐 Password, Identity & MFA Attacks
Attackers continue to target user accounts, credentials, privileged access, and trusted identities. Microsoft identifies identity as a primary security control point and recommends strong identity hygiene and phishing-resistant MFA. [microsoft.com]

Never approve an MFA request you did not initiate. DENY IT and contact IT immediately.

👤 Compromised Accounts & Trusted Communications
Attackers may use a legitimate but compromised account to send malicious messages. An email or Teams message coming from someone you recognize should not automatically be considered safe, particularly when the request is unexpected or unusual. Microsoft reports that valid-account abuse and trusted access continue to play prominent roles in cyberattacks. [microsoft.com], [microsoft.com]

💰 Executive, Payroll & Financial Impersonation
Be suspicious of unexpected requests involving:

• Payments or wire transfers
• Gift cards
• Banking or direct-deposit changes
• Payroll information
• Passwords or MFA codes
• Sensitive employee or organizational information
• Changes to vendor payment information
• Requests for account or system access

Always independently verify financial or sensitive requests using a known phone number or trusted contact method.

Do not use the phone number, link, or contact information provided in the suspicious message to perform the verification.

🖥️ Fake Security Alerts & ClickFix Attacks
Be cautious of webpages, pop-ups, emails, or messages claiming that something is wrong with your computer and instructing you to copy and paste commands, open PowerShell or another command window, or run a "fix." Microsoft specifically identifies ClickFix-style social engineering as an ongoing way attackers trick users into executing malicious actions themselves. [microsoft.com]

Never run commands or install software because a webpage, email, or unexpected caller tells you to do so. Contact IT.

🦠 Ransomware, Malware & Data Extortion
Ransomware remains a significant threat. Current research shows attackers increasingly combine credential theft, data exfiltration, remote-access tools, and extortion, meaning an attack may involve stealing information even when files are not encrypted. [sed-cms.broadcom.com]

⚠️ Actively Exploited Vulnerabilities
Attackers continue to target known vulnerabilities in exposed and unpatched systems. CISA recommends prioritizing vulnerabilities based on exposure, inclusion in its Known Exploited Vulnerabilities (KEV) Catalog, potential for automated exploitation, and technical impact. [cisa.gov]

🛑 STOP. VERIFY. REPORT.

STOP
Before clicking a link, opening an attachment, responding to an unusual message, sending money, entering credentials, running a command, granting remote access, or approving an MFA request.

VERIFY
Confirm unusual or sensitive requests using a known phone number or trusted communication method.

Do not rely on the phone number, link, reply address, or contact information contained in the suspicious message.

REPORT
If something looks suspicious, unusual, or simply does not feel right, contact IT immediately.

📞 REPORT A SECURITY CONCERN

IT Help Desk

📧 [email protected]
📞 TGC: 205
📞 Direct extension from Goodwill Locations: 50205
📞 Direct: 302-504-1739

🚨 ALREADY CLICKED OR RESPONDED?

If you have already:

• Clicked a suspicious link
• Entered your username or password
• Provided an MFA verification code
• Approved an unexpected MFA request
• Opened an unexpected attachment
• Downloaded or installed something
• Ran a command provided by a webpage, email, text, or caller
• Granted someone unexpected remote access to your computer
• Provided sensitive, financial, payroll, or organizational information

Contact IT immediately. Do not wait to see if something happens.

The sooner IT is notified, the sooner we can investigate and take steps to protect your account, device, and the organization.

⚠️ IT WILL NEVER ASK YOU TO:

• Provide your password
• Provide your MFA verification code
• Approve an unexpected MFA request
• Purchase gift cards
• Provide banking or credit-card information
• Change payment information without appropriate verification
• Run an unexpected PowerShell or command-line instruction
• Grant unexpected remote access without verification

🛡️ WHEN IN DOUBT: STOP. VERIFY. REPORT.

You will never be penalized for reporting something that turns out to be legitimate. It is always better to report a potential threat than to ignore one.

Cybersecurity is everyone's responsibility. Taking a few seconds to STOP and VERIFY can prevent an account compromise, financial loss, ransomware incident, or data breach.

 

12/15/25 Email

Hello Team,

Cyber threats are evolving rapidly—your vigilance is essential. Here’s what you need to know:

🚨 Current Threats

• React2Shell (CVE-2025-55182): Critical vulnerability in React/Next.js exploited by attackers for remote code execution.
• China-linked threat actors: Rapid exploitation of new vulnerabilities within hours of disclosure.
• Scattered Spider: Social engineering attacks via SMS (“smishing”) and phone scams (“vishing”) targeting credentials.
• Phishing Surge: AI-crafted emails and multi-stage scams are on the rise.
• Qualcomm Chipset Flaws: Secure boot vulnerabilities could allow persistent malware.

✅ What You Should Do

• Patch Promptly: Update systems and devices immediately.
• Stay Alert: Don’t click suspicious links or share sensitive info.
• Verify Requests: Confirm unusual requests through trusted channels.
• Report Incidents: Email [email protected] or call 302-504-1739.

📘 Best Practices

• Use MFA (Multi-Factor Authentication) everywhere.
• Keep software updated.
• Be skeptical of urgent messages.

Your vigilance protects our organization. Thank you for staying alert!

 

 

Please review this Happy Fox Article to see past security Updates.

 

Thank You,

Jim

09/08/25 Email

 

Hi Team,

 

Scammers are always looking for new ways to trick people. Here are a few quick tips to help you stay safe:

🚩 Watch Out for These Scams

• Fake emails or calls pretending to be banks, the government, or IT asking for urgent action.
• Requests for unusual payments like gift cards, wire transfers, Zelle, or crypto.
• “Too good to be true” deals or strangers asking you to send money back after an “accidental payment.”

✉️ Spot Phishing Fast

• Check for typos, odd language, or email addresses that look slightly off.
• Don’t click unexpected links or open suspicious attachments.
• When in doubt, verify through a trusted phone number or website.

🛡️ Protect Yourself & Goodwill

• Never share passwords, gift card codes, or account info over email/text.
• Use strong passwords and enable MFA wherever possible.
• If you get a suspicious email, forward it to IT at [email protected] right away.

🔗 Helpful Resources:

• FBI – Common Scams & Crimes
• Chase Security Center
• NSA Cybersecurity Advisories
• Goodwill IT Security Articles

 

Stay alert and cautious, your awareness is one of our best defenses.

 

 

04/11/25 Email

 

 

📘 🚨   🚨 📘

 

The IT Team wants to bring to your attention a growing cybersecurity concern affecting organizations across Europe: an increase of targeted attacks by a threat group known as Scattered Spider.

📌 What You Need to Know

1. Scattered Spider Threat Group

• Scattered Spider is a sophisticated cybercriminal group known for social engineering tactics and targeting employees through SMS phishing (“smishing”) and phone-based scams (“vishing”).
• They have been active in Europe, compromising corporate networks by gaining access to credentials and escalating privileges to execute ransomware attacks or data theft.

🚨 How to Stay Safe

• Think before you click. Do not open unexpected attachments or click on suspicious links.
• Verify requests. If an email or message asks for sensitive information, confirm it through a known and trusted channel.
• Report incidents immediately. If you suspect a phishing or social engineering attempt, contact the IT/security team right away.
• Use strong, unique passwords. Enable multi-factor authentication (MFA) wherever possible.

📘 Learn More

We recommend staying informed by reading [internal security bulletins] or attending one of our upcoming cybersecurity awareness sessions (details to follow).

Your vigilance is key to protecting our organization from cyber threats. Thank you for staying alert and practicing good security hygiene.

 

 

📘 Best Practices for Internet Security & Phishing Awareness

🎯 Purpose

To educate and guide users on identifying phishing threats, staying secure online, and applying leading cybersecurity protocols — including recommended practices from the NSA (National Security Agency) and other credible institutions.

 

🛡️ GENERAL INTERNET SECURITY BEST PRACTICES

🔐 Password Hygiene

• Use long, complex, and unique passwords for each account.
• Enable multi-factor authentication (MFA) wherever possible.
• Use a reputable password manager to store and generate secure credentials.

🌐 Safe Browsing Tips

• Only visit HTTPS-secured websites.
• Be cautious with pop-ups and fake "support" pages.
• Never download files or software from unknown sources.

📥 Software & System Updates

• Regularly update operating systems, browsers, and antivirus tools.
• Enable automatic updates for critical software.
• Remove unused applications and browser extensions.

 

🧑‍💻 PHISHING AWARENESS

🎣 What is Phishing?

Phishing is a form of cyberattack where criminals impersonate legitimate entities to steal sensitive information — such as login credentials, banking info, or personal details.

🚩 How to Spot a Phishing Email or Message

• Sender's address is slightly off (e.g., [email protected])
• Spelling and grammar mistakes
• Urgent language (“Your account will be closed!”)
• Suspicious links (hover to preview before clicking)
• Unexpected attachments or payment requests

 

📱 COMMON SPAM TEXT SCAMS

Here are examples of spam text messages to watch for:

 

🚨 Example 1: Fake Toll Service Scam

“EZ-Toll Notice: Your unpaid toll of $12.48 has been reported. Pay immediately at www.tollclearance-now.com to avoid fines.”

🚫 Tip: Legitimate toll agencies don’t send texts like this with links. Always verify via the official state toll site.

 

🚨 Example 2: Fake Package Delivery

“FedEx: Your package couldn’t be delivered. Click here to reschedule: fedex-updateinfo.com”

🚫 Tip: Never click unsolicited links. Go to the official website and input your tracking number.

 

🚨 Example 3: Bank Alert Scam

“Chase Alert: Unusual activity detected. Verify your identity at chaseverifynow.com”

🚫 Tip: Banks do not ask for info via text or email links. Contact them through the official app or website.

 

🔒 NSA-RECOMMENDED SECURITY PRACTICES

The NSA publishes regular guidance to help protect both government and civilian users. Key recommendations include:

✅ Mobile Device Best Practices

• Turn off Bluetooth and Wi-Fi when not in use.
• Don’t connect to public charging stations (use data-blocking cables).
• Use mobile device management (MDM) in organizations.

✅ Secure Communications

• Use end-to-end encrypted messaging apps (like Signal).
• Avoid discussing sensitive topics on untrusted platforms.
• Be cautious with metadata — even encrypted content can leak context.

✅ Network & Device Hardening

• Use VPNs to encrypt traffic on public networks.
• Disable unused ports/services on devices.
• Apply zero trust principles — no device/user is automatically trusted.

You can read the latest NSA Cybersecurity Advisories here.

 

📎 QUICK CHECKLIST FOR USERS

✅ Don’t click suspicious links or attachments
✅ Use MFA everywhere possible
✅ Keep software and systems updated
✅ Don’t share sensitive info via email or text
✅ Use a VPN on public Wi-Fi
✅ Be skeptical of unexpected messages with urgency
✅ Report phishing emails or texts to your IT team or service provider

 

🆘 What To Do If You’re a Victim

1. Disconnect from the internet
2. Change passwords immediately from a secure device
3. Notify your bank or credit card provider
4. Scan your device for malware
5. Report phishing attempts to:
   • Contact the IT Team: Call 302-504-1739 or Email, [email protected]
   • Submit a Help Desk Ticket: Login - Goodwill Delaware Help Desk