By -- 2023-12-1 in Blog

The holiday season may be the busiest online shopping season of the year – but that also means it’s the busiest for eCommerce and phishing scams. According to Cybersource, phishing ranked as the leading form of eCommerce fraud in 2022, impacting 43% of global eCommerce merchants. Hackers deceive shoppers into revealing their personal or financial information by sending fake emails, messages, and websites.

If you are planning on participating in online sales this holiday season, read through our cyber safety guide to stay informed of best practices:

1. Shop with retailers you trust

It is always safest to shop with brands that are reputable with a proven track record. This doesn’t mean avoiding small businesses and new companies – but do your research first. Read reviews and seek information online from previous buyers. Websites like Trustpilot provide real customer reviews and experiences to vet companies properly.  

2. Stay wary of unbelievable deals

Those unbelievable discounts may seem too good to be true – because they are. Bad actors will lure shoppers with irresistible deals to persuade them into divulging their personal information. The FBI noted a spike in these incidents from paid ads on social media platforms.

Even if the discount comes from a link or an email of a trusted retailer, it is always safest to go directly to the site first. Closely inspect any links or emails you receive and watch for the warning signs.

3. Don’t browse on public Wifi

Avoid using public Wifi while online shopping or accessing private information. It may be tempting to browse your favorite shops while sitting at your local coffee shop, but you never know who may be around you – or what they are capable of.

If you do use public Wifi, protect yourself with a VPN. A VPN prevents cybercriminals from being able to see your device’s activity or from intercepting your personal information.  

4. Pick strong passwords

It may be time to update that password you picked out 10 years ago and have used for everything since. Use a trusted password keeper and log your strong passwords to remember your information. Make it complex and avoid common dictionary words or personal information (this means no more using birthdays or the name of your beloved pet).

5. Pay with a credit card

Credit cards don’t give sellers direct access to the money in your bank account. Plus, most credit cards offer $0 liability for fraud. This means your money is protected even if the worst-case scenario does happen.

The hustle and bustle of the holiday season can be stressful as it is. Avoid additional cyber headaches by staying informed and investing in your network security. Learn more about how our team can protect you and your business today at 703-790-0400 or

By -- 2023-11-27 in Blog

The launch of the Sunbird app, ‘Nothing Chats’, made headlines last week after promising to solve all the current issues users face with Android/iPhone text threads. The app was supposed to allow Phone (2) users to connect their Apple IDs and access iMessage on their Android devices, eliminating low-quality images, videos, and random glitches in group messages. Soon after its launch, however, the app was taken down from the Google Play store, citing privacy and security issues.

While the app and Sunbird advertise the end-to-end encryption of the service, the platforms put user data in jeopardy. This is because they require users to sign into a third-party Mac with their Apple ID. When users connect to Nothing Chats with their Apple ID, they are actually logging into a Mac Mini in a Sunbird server farm in the US or Europe which routes their messages from Android to iOS.

Questions surrounding the safety of the app pointed out that one breach of Sunbird’s servers could expose all of the connected devices and data to vulnerabilities. These concerns over the promised security of the end-to-end encryption for user messages and files turned into reality on the launch date. 9to5Google reports that over 630,000 files of data stored were easily accessible to other users and private messages were downloaded with only a short bit of code. Soon thereafter, Sunbird and Nothing blocked the download of the app from the Google Play store to “fix several bugs.”

The privacy nightmare of Nothing Chats brings forth an important cyber safety lesson. Before giving a third-party app access to personal information, it is important to understand the full extent of the risks involved. An app may offer a service that is functional and helpful, but that does not mean it is worth compromising your data. Always do your research and ask the right questions before giving up your information.

For more cyber safety tips visit Book a free network consultation at or 703-790-0400.

By -- 2023-11-13 in Blog

Did you know that a seemingly trivial act like logging into your personal Google account from your work-managed computer could lead to a massive data breach? According to Okta, an identity and access management provider, a breach of their backend support case management system was caused by an Okta employee logging into their personal Google account from a workplace-managed computer.

The attack took place because the employee logged into their personal account on Google, which saved the company session information into their account.  The hacker most likely got credentials through a phishing technique and was then able to use that session information to login to the Okta services.  The easiest solution to this is to make sure employees don’t access personal accounts using their company laptops.

Unfortunately, it’s too late for Okta employees. The company is now prohibiting all staff from logging into their personal Google accounts from work-managed machines.  

The bottom line is that even the smallest of actions can have a significant impact on the security of your organization’s data. A cyber-attack can happen to anyone, at any time. So always be mindful of your online activities and take appropriate measures to protect your organization’s information.

Learn more about how our team can protect you and your business today at 703-790-0400 or

By -- 2023-11-7 in Blog

Cybersecurity remains a top concern as businesses continue to navigate the digital age. While many companies invest in software and hardware to protect their systems, some overlook the importance of employee cybersecurity testing and training.

Employee cybersecurity testing and training are crucial for businesses to ensure that their employees are aware of potential cyber threats and how to avoid them. By implementing regular training and testing, businesses can minimize the risk of cyberattacks and protect their sensitive data.

One of the most common ways hackers gain access to a company’s network is through employee error. According to a report by Verizon, 94% of malware was delivered via email in 2019, and 33% of all data breaches were caused by phishing attacks. Cybersecurity training can help employees identify these threats and teach them how to avoid them.

Additionally, regular cybersecurity testing can help businesses identify potential vulnerabilities in their systems. By simulating real-world cyberattacks, businesses can discover weak points in their systems and take steps to strengthen them. This proactive approach can help prevent data breaches and other cyber incidents.

Another benefit of employee cybersecurity training and testing is that it can help create a culture of cybersecurity awareness within the company. When employees understand the importance of cybersecurity and how to protect sensitive data, they are more likely to take the necessary precautions to keep the company safe. According to a Ponemon Institute report, companies with a strong security culture have an average of 1.5 fewer data breaches per year than those without.

Employee cybersecurity testing and training are essential for businesses to protect themselves from cyber threats. By investing in regular training and testing, companies can minimize the risk of cyberattacks, identify vulnerabilities in their systems, and create a culture of cybersecurity awareness within the company.

OptfinITy’s employee cybersecurity testing and training programs are designed to simulate real-world cyberattacks, giving employees hands-on experience in identifying and responding to potential threats. Their training programs cover a wide range of topics, including phishing attacks, social engineering, password protection, and network security. To learn more give OptfinITy a call at 703-790-0400 or via email at

By -- 2023-10-11 in Blog

If you’re a Windows user, you may be at risk to a malicious remote access virus called ZenRAT, according to The Hacker News. The malware exists on fake websites claiming association with Bitwarden, an open-source password manager. When downloading links for Linux or macOS on the downloads page, windows users are directed to a different website and it installs a .NET executable, granting threat actors access to sensitive data.

While Windows users are the primary targets of the malicious software, non-windows users are also impacted. Upon visiting the website, they are led to open a duplicate article from, ironically regarding how to secure passwords with Bitwarden.

What happens if the malware is launched? ZenRAT can then access a laundry list of personal information through their operating C2 server: the user’s CPY name, GPU name, operating system, browser credentials, applications and security software.

Information on how the trojanized version of the standard Bitwarden installation software is redirecting users has not yet been acquired.

While the sophisticated tactics of threat actors can be anxiety inducing, there are steps you can take to protect yourself from malicious acts. For one, always download software and applications from trusted sources such as play stores and manufacturer websites. If an application claims to be associated with a popular software, do the research first. Find out where it originated from and what people online have to say about it.

Cybersecurity threats are all around us, even if there are not tangible. Don’t wait for the worst-case scenario to happen to defend your information. We offer a free consultation that informs you of steps your company can take to become more secure.   To get started, call 703-790-0400 or send us an email at

By -- 2023-10-6 in Uncategorized

A recent blog post from Cyber Kendra discusses a new zero-day vulnerability in the WebP image library that may have drastic cybersecurity implications. The bug was initially classified by Apple and Citizen lab as CVE-2023-4863. Upon first reporting it was believed to be tracked specifically to Google Chrome. Unfortunately, a reclassification of the bug as CVE-2023-5129 revealed that the vulnerability impacts any software utilizing the WebP codec through the libwebp library. Within this list includes popular browsers like Mozilla Firefox, Apple Safari, and Microsoft Edge.

Popular applications that Use Webp Code:

  • Discord
  • Obsidian
  • Skype
  • Twitch
  • Slack
  • Microsoft Teams
  • 1Password

In addition, any Android user could be at risk due to the WebP image handling and software projects installed into every Android device. Former Project Zero manager, Ben Hawkes, clarifies the implications for Android users and beyond, “if this bug does affect android, then it could potentially be turned into a remote exploit for apps like signal and WhatsApp.”

What are the ramifications of such a vast security risk? For one, incorrectly distinguishing it as an issue exclusive to Chrome wasted valuable time. Users across the abundant libwebp software applications and platforms were exposed to potential attacks without knowing all of the facts. In the case of any cyber security risk, knowledge is power. Acting quickly and proactively can prevent a loss of data or an invasive security breach.

Thankfully, patches to resolve the security vulnerability have already been created. As long as organizations and developers move quickly to update older versions of the software the extent of damage can be mitigated.

                Some vendors that have issued patches against the bug include:

  • Google Chrome
  • Mozilla
  • Microsoft Edge
  • Tor Browser
  • NixOS

All organizations should have cyber security plans in place for both applications and infrastructure.  If your IT department or provider isn’t working with you on this matter, give OptfinITy a call at 703-7900-0400 or via email at

By -- 2023-10-3 in Blog

Security threats for third-party applications are nothing new. Many businesses have opted to integrate these popular applications (such as Salesforce, Google Workspace, and Microsoft 365) to facilitate important day to day operations.

However, concerns with the security of third-party apps have arisen with the introduction of malicious apps by bad actors. While this strategy has been utilized with simple mobile apps requesting invasive permission sets to data mine the phone, it is new to the software as a service (SaaS) world. The Hacker News reports that threat actors have designed these apps to connect to a SaaS application (such as Google Workspace, Slack, or Zoom), to perform unauthorized activities with a company/employee’s data. The process is dangerously simple. Upon connecting to the core SaaS stack, they request certain scopes and permissions in order to read, update, create, and delete content.

These new sophisticated phishing scams to target core SaaS applications are more difficult to recognize. Oftentimes, the app will appear fully legitimate. An app like Salesforce AppExchange is a prime example of a program that offers functionality in exchange for unreasonable permission scopes.

Malicious apps pose a variety of security threats to businesses. These threats can include:

  • Data Breaches – threat actors can access confidential employee and customer information to publish online or hold for ransom.
  • System Compromise – threat actors can alter settings within the core SaaS app/update access to unauthorized users with the permissions granted to them.
  • Compliance violations – A business’ relationships with clients and partners can potentially be put at risk in the case a data breach results in a compliance violation.
  • Performance – Normal operations can be stalled/thwarted by necessary functions being altered or disabled.

An array of preventative measures can be implemented to protect your data from malicious third-party apps. Learn more about how our team can protect you and your business today at

By -- 2023-07-26 in Blog

While AI has brought about numerous advancements and benefits, it also raises concerns and potential harms. Here are some of the major areas of concern related to the use of AI:

  1. Job Displacement: The automation capabilities of AI can lead to job displacement in certain industries, especially those with repetitive tasks. This can result in unemployment and economic instability for certain segments of the workforce.
  2. Bias and Discrimination: AI systems learn from data, and if the data they are trained on is biased, the AI can perpetuate and amplify these biases. This can result in discriminatory outcomes in areas like hiring, lending, and law enforcement, leading to unfair treatment of certain individuals or groups.
  3. Privacy Concerns: AI systems often rely on vast amounts of data to function effectively. The collection and processing of personal data raise significant privacy concerns, as it could potentially be misused or mishandled, leading to breaches of individual privacy and security.
  4. Safety Risks: AI-powered systems, particularly in robotics and autonomous vehicles, can pose safety risks if not properly regulated and tested. Accidents and malfunctions can have severe consequences, emphasizing the need for responsible development and testing.
  5. Ethical Dilemmas: AI can be used in various applications, including military, surveillance, and decision-making contexts. These uses raise ethical dilemmas, such as the potential for AI to be weaponized or the delegation of crucial decisions to machines without human oversight.

Addressing these concerns requires a thoughtful approach to AI development, including strong ethical guidelines, transparency, and continuous evaluation of the impact of AI applications on society. Striking a balance between the benefits and potential harms of AI is crucial for its responsible and sustainable integration into our lives.

By -- 2023-07-24 in Blog

In today’s technology-driven world, our lives have become increasingly intertwined with the digital realm. From personal communications to professional endeavors, we rely heavily on cloud services to store and access our data. The cloud has undoubtedly revolutionized the way we manage information, providing convenience and flexibility like never before. However, along with these benefits comes the responsibility of protecting our devices’ cloud storage to ensure the safety and privacy of our data. Below you can review more on the importance of securing your device’s cloud and explore the measures you can take to safeguard your digital world effectively.

  1. Data is the New Gold: Data has become the new currency of the digital age. Everything we do online generates data, from social media interactions to financial transactions. Cybercriminals are well aware of this, and they constantly seek opportunities to exploit unprotected data for various malicious purposes. Securing your device’s cloud is essential because it houses a significant portion of your digital life, including sensitive documents, personal photos, and other valuable information.
  2. Protecting Your Personal Privacy: In a world where privacy concerns are growing exponentially, safeguarding your device’s cloud becomes paramount. Cloud service providers utilize various security protocols to keep your data safe during transmission and storage. Using strong passwords, enabling multi-factor authentication, and regularly updating your security settings are just a few steps you can take to enhance your personal privacy.
  3. Guarding Against Cyber Attacks: Cyber-attacks are becoming increasingly intelligent, targeting individuals and businesses alike. Securing your device’s cloud is a crucial line of defense against these threats. By staying informed about the latest security trends and adhering to best practices, you can minimize the risk of falling victim to cyber-attacks.
  4. Ensuring Business Continuity: For entrepreneurs and professionals, the cloud is a lifeline for business continuity and productivity. Losing access to vital data due to a breach or cyber-attack can disrupt operations and cause severe financial losses. By prioritizing the security of your device’s cloud, you can ensure that critical business information remains protected, enabling you to resume operations swiftly in the event of an incident.
  5. Protecting Against Physical Damage: While cloud storage provides a backup solution for digital data, it is essential to remember that it does not protect against physical device damage or loss. Devices can get stolen, damaged, or misplaced, leading to potential data loss. To reduce this risk, ensure that you have a secure backup strategy that includes regular cloud backups and additional physical backups stored in a safe location.

Remember, security is an ongoing process, and being proactive in protecting your cloud is the key to a safer and more resilient digital existence. So, act today, and fortify your device’s cloud against potential risks – your data and your digital life depend on it.


By -- 2023-06-2 in Blog

Atomic Malware has emerged as a formidable force, wreaking havoc on Mac users worldwide. This insidious malware has set its sights on stealing passwords, infiltrating crypto wallets, and causing a wave of concern among security-conscious individuals. This is why it is important to protect your computer passwords and crypto wallets. Here are some essential tips to safeguard your sensitive information and prevent unauthorized access:

  1. Exercise Caution with Downloads: Be vigilant when downloading files or software from untrusted sources. Verify the integrity and legitimacy of the downloads to avoid inadvertently installing Atomic Malware.
  2. Implement Strong Passwords and Two-Factor Authentication: Strengthen your defenses by using unique, complex passwords for each online account. Enable two-factor authentication whenever possible to add an extra layer of security.
  3. Invest in Robust Security Solutions: Consider using comprehensive security software that offers real-time malware protection, firewall capabilities, and proactive threat detection to safeguard your Mac from Atomic Malware and other cyber threats.

Conducting Regular Backups and System Monitoring are also helpful to ensure protection from losing important data. In case of a malware attack, you can restore your files and minimize the impact. Additionally, monitor your system for any unusual activities, such as unexpected network connections or system slowdowns, which could be indicators of malware presence.


Remember, it’s better to be prepared and protected than to suffer the consequences of a malicious attack. Stay safe, stay secure, and enjoy your digital journey without the fear of Atomic Malware lurking in the shadows. If you have any questions about the protection of your personal data, or any general IT inquiries, feel free to reach out to us at