If you think security threats only affect Gmail users, think again. All email platforms—including Microsoft Outlook—are frequent targets for cyberattacks. In fact, many of the tactics used by threat actors are the same across platforms, particularly when it comes to malicious attachments.

Microsoft has recently announced an important security update: Starting in early July, Outlook Web and the new Outlook for Windows will block two specific file types that have been used in recent email-based attacks. However, you shouldn’t wait for the update to roll out before taking action.

What’s Changing?

Microsoft will add .library-ms and .search-ms to its list of blocked file types in the default OwaMailboxPolicy. This move is part of their ongoing effort to strengthen protection for Outlook users.

For those who do send or receive these types of files, Microsoft warns that users will no longer be able to open or download them once the block goes into effect.

Why These Files?

The .library-ms extension, which relates to Windows Library files, was part of a known cyberattack earlier this year where hackers used it to expose NTLM password hashes. The .search-ms extension has also been flagged as a risk. Both are now being recognized for their potential to be weaponized in phishing or malware distribution campaigns.

What Should You Do Now?

Don’t wait for the policy update to protect yourself. Until the block is officially in place, these risky file types could still reach your inbox.

• Do not open any email attachments ending in .library-ms or .search-ms.
• Educate your team about the risks associated with these files.
• Review your organization’s email policies and consider proactively blocking these extensions in your own security tools.

Final Thoughts

Email-based threats are evolving, and even less commonly used file types can be turned into dangerous tools by cybercriminals. Microsoft’s proactive blocking of these file types is a step in the right direction—but user awareness is still your first line of defense. Stay alert, stay updated, and never assume your inbox is risk-free.

Your email and phone are under constant attack—and it’s only getting worse. Most users are still relying on outdated security methods like passwords and two-factor authentication (2FA). Google warns that this simply isn’t enough anymore. 61% of email users have been targeted by scams, and almost every American phone user has experienced scam attempts via text.

On top of that, more than half of U.S. users have experienced a data breach in the past year.

Many people haven’t taken the step to upgrade to stronger and more secure alternatives like passkeys or social sign-ins (e.g., “Sign in with Google”), which offer enhanced protection across your entire digital life—not just Gmail.

What Makes Passkeys Better?

Passkeys are emerging as a powerful replacement for passwords. Unlike passwords, which can be guessed, reused, stolen, or phished, passkeys are stored on your device and unlocked with something you already use—like your fingerprint, face ID, or device PIN.

Here’s why they matter:

• They can’t be phished – There’s no password to steal.
• They’re simple to use – No remembering or changing passwords.
• They work across devices – You can log in with your phone even on another device.
• They’re hardware-tied – Your device becomes your secure digital key.

The FIDO Alliance and tech giants like Google and Microsoft agree: passkeys are phishing-resistant, secure by design, and a much-needed upgrade in the fight against cybercrime.

What You Should Do Now

Here are immediate steps you can take to improve your digital security:

1. Add a passkey to your Google account – It’s quick and easy, and protects you from phishing.
2. Stop using SMS-based 2FA – Switch to device-based authentication like Google Prompts or Authenticator apps.
3. Avoid reusing passwords – Even for non-critical accounts.
4. Be skeptical of unsolicited messages – Especially those with links or asking for credentials.
5. Access sites directly – Don’t trust links sent via email or text.

If that isn’t reason enough to take action, remember: once someone has your credentials, they often don’t need to hack anything—they just log in.

OptfinITy keeps our clients safe and protected from the latest threats. Interested in learning more? Reach out to us today at 703-790-0400 or sales@optfinity.com for a complimentary consultation.

Cybersecurity experts are warning about a new phishing attack that’s tricking financial professionals—like CFOs and executives at banks, energy companies, and insurance firms—into installing real software used in a harmful way.

What’s Happening?

One example pretends to be from Rothschild & Co., offering a “strategic opportunity.” It includes what looks like a job offer or important attachment—usually a PDF—but when clicked, it secretly sends the user to a fake website.

From there, the attacker:

• Creates a hidden user account
• Turns on remote desktop access
• Makes sure the tool stays active even after the computer restarts
• Hides any evidence so the victim won’t know anything happened

Why This Matters to You

Even if you’re not in the financial industry, this kind of phishing attack can target anyone in your organization. And cybercriminals are now using legitimate, trusted tools to avoid getting caught.

Plus, these scams are part of a much larger trend:

• Fake job offers
• Fake invoices from Apple Pay or Microsoft
• Phishing websites disguised to look like Google or Notion
• Malware hidden in documents or images

And behind it all? A growing market of Phishing-as-a-Service (PhaaS)—where scammers can literally subscribe to easy-to-use phishing kits (just like signing up for Netflix) that come with tech support, updates, and dashboards to run scams.

What You Can Do

Here are 5 quick tips to stay safe from these kinds of attacks:

1. Pause before you click – Unexpected emails about job offers or urgent invoices? Don’t rush. Double-check with the company directly (not using info in the email).
2. Avoid opening ZIPs or links from unknown senders – These files may look harmless but can quietly install malware.
3. Be suspicious of CAPTCHA challenges in unexpected places – It could be a trick to bypass filters.
4. Look closely at email addresses – A message from “company@nifty.com” might seem legit, but always verify the domain.
5. Report suspicious messages – Let your IT or security team know immediately. Early reporting can stop a wider attack.

Final Thoughts

Today’s phishing attacks are no longer just clumsy emails with spelling mistakes—they’re well-designed, use real tools, and are hard to detect.

Worried about threats to your organization’s network? Contact us today for a free consultation at 703-790-0400 or sales@optfinITy.com.

The Threat: Smishing & Vishing Campaigns

The FBI has issued an alert that cybercriminals are using text messages and AI-generated voice recordings to impersonate senior U.S. government figures. The goal? To build trust and then trick recipients into clicking malicious links or revealing sensitive data.

These actors often claim to be transitioning to a different messaging platform—perhaps a common excuse like “Let’s move this to Signal/WhatsApp”—before sending a malicious link. Once clicked, the attackers can steal login credentials or install malware to gain access to personal or official accounts.

Even more dangerous, once attackers compromise one account, they often use it as a launching pad to impersonate the victim and reach out to others in their contact list.

Smishing, Vishing & Spear Phishing — What’s the Difference?

• Smishing: Phishing attempts via text messages (SMS/MMS). Scammers often use fake numbers or impersonate familiar contacts.
• Vishing: Phishing through voice calls or messages, increasingly using AI-generated voices to sound like trusted individuals.
• Spear Phishing: Highly targeted email scams that often precede or accompany smishing and vishing efforts.

What makes these attacks especially dangerous is their personalized and convincing nature, often leveraging public data and social engineering tactics.

How to Spot a Scam

Cybercriminals are getting smarter, but there are still red flags you can look for:

• Unfamiliar Numbers: Always verify the identity of the sender or caller using a trusted source.
• Unusual Language or Requests: Is the tone off? Are they asking for urgent help or money? Be skeptical.
• Suspicious Links or Attachments: Never click or download anything unless you’re absolutely sure it’s legitimate.
• Visual/Audio Inconsistencies: Look for distorted images or strange voice characteristics—like unnatural tone, lag, or incorrect phrases.

Steps to Protect Yourself and Your Team

1. Verify Before You Trust
   Double-check requests—even from people you know—via a trusted method or contact.
2. Don’t Share Sensitive Info
   Never share login credentials, verification codes, or personal data through unverified messages.
3. Enable Multi-Factor Authentication
   And never share your MFA codes. If someone’s asking for them, it’s likely a scam.
4. Set Up a Family/Friend Verification Phrase
   Create a “safe word” to confirm identities in case of suspicious contact.
5. Be Cautious with Downloads and Links
   Avoid clicking links or downloading files from unknown or unverified sources.

Next Steps

Worried about threats to your organization’s network? Contact us today for a free consultation at 703-790-0400 or sales@optfinITy.com.

If you use Google Meet, you may be at risk to a new malicious pop-up attack.

A newly identified scam, ClickFix, is a stark reminder that social engineering tactics are still alive and thriving. This threat doesn’t need AI to work; it just needs your trust and a few keyboard shortcuts.

What Is ClickFix?

ClickFix is a pop-up attack that mimics a technical issue, often pretending to be a problem with your microphone in Google Meet. The goal? To convince you to copy and paste a line of PowerShell code into your Windows Run dialog. Once executed, this code silently downloads malware onto your device.

The attack typically begins with a fake Google Meet invite, often including terms like “google” and “join” to appear convincing.

But there’s a catch: Instead of asking for a login, the page displays a fake error like “Microphone Permission Denied” and instructs you to fix the issue by copying a block of code and running it manually. The steps are usually:

1. Click a button to copy a “fix.”
2. Open the Run command (Win + R).
3. Paste the code (Ctrl + V).
4. Hit Enter.

How to Stay Safe

Fortunately, avoiding ClickFix and similar scams is easy — if you know what to look for:

• Never run commands from untrusted sources. If a website tells you to open the Run box and paste in text, it’s a scam. No legitimate tech support or app will ask you to do this.
• Check the invite details. Watch out for strange URLs, especially those that mimic well-known services but aren’t hosted on official domains.
• Use security tools. Up-to-date antivirus and browser protection can catch some of these threats — but not all. Awareness is your best defense.
• Report suspicious emails or links. If you’re unsure, forward the message to your IT team or security provider for review.

Final Thoughts

Remember: If you ever see an error message telling you to open Run and paste in code — back out immediately. Close the tab, delete the email, and move on.

Worried about threats to your organization’s network? Contact us today for a free consultation at 703-790-0400 or sales@optfinITy.com.

Google’s new AI Overviews feature is designed to give quick, AI-generated answers to your search queries. While it might seem helpful, it also raises some serious data privacy concerns.

How It Works

When you search with Google while signed into your account, AI Overviews use your query to generate a summary. But here’s the catch: unless you change your settings, Google saves your searches, the AI responses, your feedback (thumbs up/down), and other data like location and device info—for up to 18 months.

Your Data Footprint Grows

Because this feature is tied to your Google account, it could access:

• Your Gmail content
• YouTube watch history
• Google Maps check-ins
• And more

This creates a deeply personalized profile—which could be vulnerable if your account is hacked, subpoenaed, or if data leaks.

Can You Turn It Off?

You can’t fully disable AI Overviews yet, but there are ways to limit them:

• Use a Chrome extension like Hide Google AI Overviews
• Add &udm=14 at the end of Google search URLs to get only regular results
• Switch to private search engines like DuckDuckGo or Brave

Final Thoughts

AI Overviews may save time, but they come at the cost of your data privacy. If you’re concerned about how much Google knows about you, it might be time to adjust your settings—or consider a different search engine. Have any questions? Reach out to us today at 703-790-0400.

It might surprise you to hear this, but your email, social media, and bank passwords could be floating around the dark web right now—and criminals can buy them for less than the cost of a dinner out.

Yep, just $81 a week is all it takes for cybercriminals to subscribe to a stream of stolen passwords and other sensitive data, and they’re using it to break into personal accounts like yours.

How Are Hackers Getting Your Info?

It’s not always some big, sophisticated hack. Often, it starts with a sneaky piece of malware called an infostealer—software designed to silently collect your saved passwords, credit card details, and even those special codes you get when using two-factor authentication (2FA). All of this gets sold on shady websites or private messaging groups like Telegram.

What does this mean for you? If you’ve ever reused a password or saved one in your browser, you could be a target without even knowing it.

It Costs Them Little—but Can Cost You a Lot

While hackers are spending just a few bucks a week, the damage they cause can be massive. Once they have your info, they can:

• Empty your bank account
• Lock you out of your email or social media
• Use your identity to scam others
• Access your work systems, putting your job at risk

It only takes one bad click or weak password to open the door.

How to Protect Yourself

Here’s the good news: you can fight back. Here’s how:

Stop using passwords when possible – Many services (like Google, Microsoft, and Apple) now offer something called passkeys, which are way more secure and can’t be stolen like traditional passwords.

Use a password manager – Let it create and store strong, unique passwords for you. No more repeating the same one everywhere.

Turn on two-factor authentication (2FA) – This adds a second layer of security even if someone has your password.

Think before you click – Be extra cautious with unexpected emails, texts, or links.

Bottom Line

Hackers don’t need millions of dollars to pull off a cyberattack—they just need a few stolen passwords. But by changing the way you protect your accounts, you can stay one step ahead. Reach out to us today at 703-790-0400 or sales@optfinity.com to discover how OptfinITy can keep your network secure.

We’ve all been there—you delete a file, thinking you don’t need it, only to realize minutes (or days) later that it was actually important. The good news? If you’re using a Windows PC, there’s a good chance you can get that file back. Here’s a step-by-step guide to help you recover accidentally deleted files in Windows.

Check the Recycle Bin First

The Recycle Bin is your first line of defense. When you delete a file, it usually goes there instead of being permanently erased.

To recover from the Recycle Bin:

• Double-click the Recycle Bin icon on your desktop.
• Find the file you want to restore.
• Right-click on it and select Restore.
  The file will be returned to its original location.

Tip: Use the search bar in the Recycle Bin window if you’re having trouble finding the file.

Use the ‘Undo Delete’ Shortcut (If You Act Fast)

If you just deleted a file a second ago, hit Ctrl + Z to undo the delete action. This only works immediately after deletion and before taking any other action.

Restore Previous Versions of a Folder

Windows sometimes saves older versions of your files and folders—especially if you have File History or System Restore turned on.

To restore a previous version:

• Navigate to the folder that used to contain the file.
• Right-click on the folder and choose Restore previous versions.
• Browse the list of available versions and click Restore to recover it.

 Note: This only works if File History or restore points were enabled before the file was deleted.

Use Windows File Recovery Tool (Advanced)

If the file is not in the Recycle Bin and no restore points exist, Microsoft offers a free command-line tool called Windows File Recovery.

To use it:

• Download it from the Microsoft Store.
• Run it via Command Prompt with specific parameters to search for and recover lost files.

⚙️ Example command:

winfr C: D: /n \Users\YourName\Documents\ImportantFile.docx

This tells the tool to search the C: drive and recover to the D: drive.

Pro Tips to Prevent Future Loss

• Turn on File History in Settings > Update & Security > Backup.
• Use cloud storage like OneDrive or Google Drive for auto-backup.
• Regularly create restore points and backups using Windows Backup.

Final Thoughts

Losing files doesn’t always mean they’re gone forever—especially in Windows. Whether you use the Recycle Bin, File History, or a recovery tool, acting quickly improves your chances of getting those files back.

OptfinITy can help your organization with regular backups. Reach out today to learn more: 703-790-0400.

A new and serious threat to Android users has been uncovered, and it’s spreading fast. According to a recent report by Integral Ad Science, as many as 2.5 million malicious Android apps are being installed every month, tricking users and hijacking their devices in the background — all while appearing perfectly safe.

What’s Happening?

This threat, dubbed “Kaleidoscope” for its constantly shifting nature, is a sophisticated form of ad fraud that targets Android users in a sneaky way. Here’s how it works:

• Benign apps are uploaded to the Google Play Store without any malicious code.
• Replica apps, modified with malicious software, are then distributed via third-party app stores or direct downloads.
• Users are often lured into installing these malicious versions through ads, messaging apps, or social media links.
• Once installed, the apps display aggressive, full-screen ads — even when you’re not using them — and send fake ad interactions to generate revenue for cybercriminals.

These apps impersonate legitimate applications and use a dangerous Software Development Kit (SDK) to camouflage their true intent, making them harder to detect and remove. The SDK is being updated and even inserted into older apps that were previously caught, making a return under a new name.

Why This Matters

Not only are these apps intrusive, they also slow down your phone, drain battery life, consume data, and violate your privacy — all while profiting off your device without your knowledge.

If left unchecked, this kind of threat doesn’t just impact individuals. It damages the advertising ecosystem and erodes trust in mobile apps.

What You Can Do

The good news? Protecting yourself is simple, if you’re cautious:

Avoid third-party app stores unless absolutely necessary. Stick to the Google Play Store whenever possible.

Don’t download apps through links sent in text messages or social media ads — especially those promoting “too good to be true” offers.

Check reviews before downloading any app. If something seems off or inconsistent, trust your instincts.

Use a reputable mobile security app to scan your phone for malicious activity.

Review the list of known infected apps and delete any you recognize immediately. (Check the latest list from Integral Ad Science or cybersecurity news sources.)

Final Thoughts

Kaleidoscope is the latest reminder that mobile security matters. Even when an app looks safe, it might be hiding something dangerous underneath — especially when downloaded outside of trusted sources.

Cybercriminals are evolving their tactics — but so can you. Stay alert, stay informed, and take control of your mobile device’s security.

If you’re planning to fly within the U.S. or visit a federal building, starting May 7, 2025, you’ll need a REAL ID or another acceptable form of identification. But as that deadline approaches, scammers are on the move.

Here’s what you need to know to stay safe.

What is a REAL ID?

The REAL ID is a special version of your driver’s license or state ID that meets new federal standards. If your ID has a star in the top corner, you’re probably good to go!

Without a REAL ID (or a valid passport or other approved ID), you won’t be allowed through TSA security checkpoints for domestic flights starting next May.

Scammers Are Taking Advantage

Cybersecurity experts are warning that scammers are using the REAL ID deadline to trick people into handing over personal information.

Here’s how they do it:

• Fake emails or texts that look like they’re from your state DMV
• Phone calls offering to “expedite” your REAL ID for a fee
• Fake websites that ask for your Social Security number, address, and more

Your DMV will NEVER:

• Call, text, or email you out of the blue asking for payment
• Ask you to click on links to provide personal info
• Offer “express” REAL ID services through third parties

If you get one of these messages, do not click and do not respond. Instead:

• Report it to the FBI’s Internet Crime Center
• Tell the FTC at reportfraud.ftc.gov
• Check your state’s DMV website directly for updates

How to Protect Yourself

To stay safe, follow these simple tips:

1. Go straight to the source – Only trust information from your official state DMV website (ends in .gov).
2. Don’t pay anyone online unless it’s through the official site.
3. Look out for spelling mistakes or odd email addresses – they’re signs of a scam.
4. If something feels off, trust your gut and double-check before clicking or replying.

What if I Don’t Have a REAL ID Yet?

Don’t worry! You can still fly with a valid U.S. passport, a military ID, or another TSA-approved document. And even after May 7, 2025, you can still go to your DMV to get a REAL ID.

Final Tip

As the deadline gets closer, it takes a few minutes to:

• Check your current ID for the REAL ID star
• Visit your state’s DMV site to make an appointment (if needed)
• Remind your family and friends to be cautious of scams

Being prepared — and informed — is the best way to protect yourself.