A few weeks ago, I received an email from a friend and customer who owns a small business. The email contained a link that I could click. When I followed the link, I was taken to a page that looked very similar to Amazon and prompted me to log in. One problem: the website address was not Amazon.
One interesting detail was that the email passed SPF and DKIM authentication checks. In other words, the message was cryptographically signed by my friend’s company domain and appeared legitimate. This suggested that the message originated from inside the organization, as if his email account had been compromised.
I texted my friend, and we connected the following day. He gave me permission to remotely access his computer while we talked over the phone.
Together, we investigated what had happened.
First, I showed him that the links in the email were tied to a legitimate application platform that allows businesses to run third-party apps and services. Then we reviewed his Google account permissions, specifically the OAuth connections that allow websites and applications to sign in using a Google account.
There it was.
At 7:59 AM, an application had been granted access to his Google account and contacts. Just over two hours later, phishing emails had been sent to everyone in his contact list.
Fortunately, many of the emails bounced because the contact list contained numerous outdated addresses. Unfortunately, throughout the day, my friend and his company received phone calls and text messages from people reporting suspicious emails sent from his address.
At first, my friend wondered whether the incident could have been caused by someone seeking revenge against the business. We considered the possibility of an internal issue. However, after reviewing his browsing history, we discovered that he had been searching for doors that morning. One of the websites led to a fake USPS page, and it is possible that either the shipping site or one of the door-distribution websites had been compromised. Most likely, he accidentally clicked a malicious link.
Our solution was straightforward.
We removed all OAuth application permissions from his Google account and disabled the practice of signing into websites with a Google account whenever possible. Going forward, every website should have its own unique username and password stored in a password manager.
This incident highlights why having a competent technology consultant available before an emergency occurs is so important.
When technology problems arise, you do not want to begin searching for a computer repair provider while you are already experiencing a security incident. Doing so increases the risk of accidentally calling a scam company while trying to recover from another scam.
I often compare technology to healthcare.
You visit your primary care physician for annual checkups so that when you become sick, an established relationship already exists. Likewise, routine dental cleanings help prevent costly problems in the future. Technology works the same way.
It is almost always less expensive to prevent problems than to recover from them.
In my friend’s case, the issue was caught quickly and resolved before serious damage occurred. The next incident may not be so forgiving.
Customers are often understanding the first time a business experiences a security issue. However, repeated compromises can damage customer confidence and a company’s reputation.
Cybersecurity is no longer just a technical issue. It is a business issue.
Being proactive today can prevent a much larger problem tomorrow.
About Duke Nguyen
Duke Nguyen is a technology consultant serving Phoenix, Arizona. Duke helps homeowners, retirees, churches, and small business owners with cybersecurity, cloud services, backups, networking, websites, Microsoft 365, Google Workspace, and computer support.
With an education-first approach, Duke believes technology should simplify life and business, not complicate it. Whether helping a customer select the right computer, recover from a phishing attack, or improve security practices, Duke focuses on practical solutions that provide long-term value.
When he’s not helping clients with technology, Duke can often be found walking neighborhoods, meeting local business owners, writing educational technology articles, and building relationships throughout the community.
Need help with cybersecurity, computers, cloud services, backups, websites, or small business technology? Contact Duke Nguyen to schedule a consultation.