The Tuesday Briefing — Oct 20, 2026

The Big Picture

For about $5,000 in AI usage fees, one hacker reportedly broke into more than 100 company websites, which works out to roughly $50 per break-in. The same week, attackers swapped cloud provider OVHcloud's official software download for a password-stealing fake, and attackers who hijacked a trusted backup vendor's connection reached the Microsoft 365 accounts of 173 organizations, with no software bug involved. The lesson for small teams: attackers are getting cheaper and faster, and they increasingly get in through things you already trust.

Correction, Oct 20: An earlier version of this summary said thousands of businesses were affected by the ConnectWise breach; Huntress counted 173 organizations. It also called OVHcloud a security company; it is a cloud provider.

This Week's Top 5

1. One Hacker, AI Helpers, and $50 Per Break-In

What happened: A security researcher traced a lone attacker who used automated AI programs, run through exposed control panels, to attempt more than 1,200 break-ins. More than 100 company websites were reportedly compromised, including some well-known brands. The whole campaign reportedly cost about $5,000 in AI usage fees.

Why it matters to your business: Attacks that once took a skilled team weeks now cost a few dollars per target, so small businesses are worth attacking too. Most of the break-ins reportedly succeeded through basic weaknesses like exposed passwords and forgotten, unprotected systems.

What to do: Ask your IT provider for a list of every website, login page, and online tool your business has that is reachable from the internet, and have them remove or lock down anything nobody uses.

2. A Software Vendor Was Hacked and 173 Businesses' Microsoft 365 Accounts Were Reached

What happened: ConnectWise paused its cloud backup product after attackers took over the digital "keys" the product used to connect to customers' Microsoft 365. Security firm Huntress saw unauthorized logins at 173 organizations. No software bug was involved, and the attackers got past passwords and two-step login by pretending to be the trusted backup app.

Why it matters to your business: Every app you connect to Microsoft 365 (backup tools, scheduling tools, email add-ons) can act as a side door. Small businesses that depend on an outside IT provider are especially exposed because they rarely see which apps have been approved.

What to do: Ask your IT provider to review which outside apps are connected to your Microsoft 365 account, and remove any you no longer use.

3. Your AI Tool Logins Are Now a Target

What happened: A password-stealing program called Aoki was found hunting for saved logins from AI assistants like Claude, ChatGPT, Cursor, and Copilot on employee computers. Separately, a criminal forum is advertising an attack tool that runs on other people's stolen AI accounts, so the victims pay the bill. A popular AI coding tool called OpenCode also had a breach that exposed some customers' stored AI account keys, which were then used to run up charges.

Why it matters to your business: A stolen AI account key can mean surprise bills, leaked company data, or your account being used to attack someone else. These keys often sit in plain files on a laptop.

What to do: Check the billing and usage page of every AI service your team uses for spending you do not recognize, and set a monthly spending limit where the service allows it.

4. Hackers Hijacked Official Downloads of a Cloud Company's Tool

What happened: Attackers took over a developer's account at cloud provider OVHcloud and swapped the official downloads of its command-line tool for a version that steals passwords. The bad files were blocked within 94 minutes after a customer reported them. Meanwhile, a separate campaign called GhostAction reportedly planted password-stealing automation into about 30,000 code repositories on GitHub.

Why it matters to your business: Even downloads from the official site can be poisoned. Anyone who installed the bad versions should assume their saved passwords and keys are exposed.

What to do: If your developers or IT provider use OVHcloud tools, ask them to confirm which version they installed and to change the passwords and keys on any computer that downloaded an affected release.

5. Remote-Support Software Was Exploited for Seven Weeks Before Anyone Knew

What happened: Attackers reportedly used an unknown flaw in BeyondTrust Remote Support, a tool IT providers use to log into customers' computers, starting around late August. The fix and the public warning came weeks later. U.S. government deadlines to patch it have now passed.

Why it matters to your business: If you rely on an outside IT company, the tools they use to reach your computers are a doorway into your business. Companies that host the software themselves must install the fix by hand.

What to do: Ask your IT provider whether they use BeyondTrust, and if so, whether it was updated and whether they checked for signs of a break-in going back to late August.

Quick Hits

• A recent Kaspersky survey found that 86% of companies with fewer than 500 employees had at least one cyber incident in the past year; customer data was the most commonly targeted asset.

• Stolen company logins let attackers into Microsoft 365 mailboxes where they hide email rules; Coalition expects fraud claims from fake-invoice emails to climb sharply by 2027.

• Researchers warn that invisible hidden text in the settings files of AI coding tools can quietly steer the AI; ask developers to review those files like code.

• Palo Alto, Cisco, and Ivanti all had security holes that attackers were already using; if you run their products, ask your IT provider whether those fixes are in.

• A WordPress booking plugin called LatePoint (version 5.7.4 and older) has a serious login-bypass flaw; update it if your site uses it.

• Test AI programs reportedly wandered outside their testing environment and touched real websites; if you pilot an AI agent, give it fake data and no spending access.

• Italy opened grants covering up to half of eligible security spending (up to €20,000) for small businesses; EU-based readers should check their eligibility.

• Be cautious with consumer-grade security software: some low-priced antivirus products are sold for home use and may not allow business use or central management.

One Thing to Do This Week

Review the outside apps connected to your Microsoft 365 or Google Workspace account. This week's ConnectWise breach got past passwords and two-step login because the attackers acted as an app the business already trusted. In Microsoft 365, an administrator can open the admin center, go to the list of "Enterprise applications," and look at what has been approved. Remove anything you do not recognize or no longer use, and write down who owns each remaining one. If you do not have an administrator, ask your IT provider to send you the list and explain what each item does. The review should take under an hour and shrinks the number of side doors into your accounts.

Worth Reading

• The Hacker News: ConnectWise suspends Cloud Backup - What happened in the Microsoft 365 app takeover and how it bypassed two-step login.

• Cybersecurity News: OVHcloud supply chain attack - How official downloads were swapped for a password-stealing version.

• GBHackers: Aoki infostealer targets AI tools - Which AI assistant files and logins the malware goes after.

• Insurance Business: AI phishing kits make micro-businesses worth attacking - Why very small companies are now profitable targets for fake-invoice scams.