8 Cybersecurity Threats This Week: AI Scams, Firewall Breach, and Scammers Coming to Your Door
Cybercriminals stole nearly $2 billion this week — and they used artificial intelligence to do it. That's just one of eight cybersecurity threats that broke in a single seven-day span. From a massive firewall credential leak affecting 74,000 businesses worldwide to a vulnerability in Microsoft 365 Copilot that can drain your entire business with one click, this was a heavy week for cyber threats. And one of these threats doesn't even require a computer — scammers are now sending real people to victims' front doors to collect cash.
If you're a business owner, office manager, or home user in Florida's Treasure Coast, Space Coast, or South Florida, this roundup is essential reading. Here's everything that happened — and what you need to do about it.
Story 1 — FBI Shuts Down AI-Powered Scam Operation Behind $2 Billion in Losses
The FBI, working alongside Google and Black Lotus Labs, dismantled a Chinese cybercrime organization called Outsider Enterprise in what authorities are calling the biggest consumer cybercrime takedown of 2026. This group used artificial intelligence to mass-produce fake websites and phishing text messages at an unprecedented scale: 2.5 million phishing texts sent in just two weeks, 9,000 fake websites, and over a million fraudulent links.
The result: 3.8 million stolen credit card numbers and nearly $2 billion in losses.
The FBI operation — dubbed Operation Riptide — seized servers, cryptocurrency wallets, and a Telegram channel the group used to coordinate attacks. If you received a text in May that appeared to come from AT&T, T-Mobile, or Verizon asking you to verify your account, that text may have originated from this group.
The FTC also released new fraud figures this week: Americans lost a record $16 billion to fraud in 2025, with imposter scams alone tripling over five years to $3.5 billion.
The takeaway: Never click a link in a text message from your phone carrier, your bank, or any company asking you to verify something. Go directly to their website, or call them using the number listed on their official site.
Protect yourself from phishing scams!
Story 2 — FortiBleed: 74,000 Firewalls Had Their Passwords Exposed
Security researchers discovered a massive credential leak they're calling FortiBleed — valid usernames and passwords for nearly 74,000 Fortinet firewalls and VPN devices across 194 countries were exposed and made available to anyone who wanted them.
Think of your firewall as the security guard at the front door of your business network. Now imagine someone published that guard's name and password on the Internet for the world to see. Attackers don't need to hack anything — they just log in.
The list of affected companies includes Chevron, AT&T, Samsung, Toyota, Mercedes-Benz, and numerous government agencies. CISA issued an emergency advisory ordering every Fortinet customer to change their credentials immediately.
If your business uses Fortinet firewalls or VPN devices, act today — not next week.
Not sure if your network is protected? Schedule a free cybersecurity audio today!
Story 3 — Scammers Are Now Sending People to Your Door to Collect Cash
This is the threat that stopped us in our tracks.
You know how banks have gotten better at flagging suspicious wire transfers? Scammers have found a workaround: they send actual human couriers to victims' homes or public meeting spots to physically collect cash.
Here's how the scheme works. The scammer — usually running a pig butchering scheme, a tech support scam, or a government impersonation — convinces the victim they owe money. When the bank blocks the wire transfer, the scammer reassures the victim and offers to send someone to pick up the cash in person. They use specific dollar bill serial numbers or code words to make the exchange feel legitimate.
The FBI warns this scam primarily targets seniors, though it is spreading to anyone caught up in these schemes.
Please talk to the older adults in your life. No legitimate company, government agency, or investment platform will ever send a courier to collect cash. Ever. This threat doesn't require a computer to destroy someone's life — but it started with one.
Story 4 — Microsoft 365 Copilot "Search Leak" Vulnerability: One Click Exposes Your Entire Business
Researchers at Varonis discovered a critical vulnerability in Microsoft 365 Copilot they're calling Search Leak. In plain English: if someone sends you a malicious link and you click it while Copilot is active, that link can silently use your Copilot permissions to search through your emails, OneDrive files, SharePoint documents, and calendar — and send all of it to the attacker.
One click. That's all it takes.
Microsoft has assigned this a critical severity rating and has released a patch. But if your business uses Microsoft 365 Copilot and you haven't updated recently, you may still be exposed. This is the new reality of AI productivity tools: they're powerful, but they open new doors into your data that didn't exist before.
Story 5 — Texas Parks and Wildlife Data Breach: 3 Million Records Stolen
The Texas Parks and Wildlife Department disclosed that hackers breached a third-party licensing vendor's system and stole personal information on more than 3 million people. If you've ever purchased a hunting or fishing license in Texas, your driver's license information, passport numbers, email address, phone numbers, and home address may now be in the hands of criminals.
The good news: Social Security numbers and financial data were not taken. The bad news: everything else was — and that's more than enough for identity thieves to open accounts in your name, target you with convincing phishing emails, or sell your data on the dark web.
If you think you're affected, place a credit freeze with all three bureaus — Equifax, Experian, and TransUnion. It's free, and it's the most effective step you can take right now.
Story 6 — Rogue Planet Update: Microsoft Defender Exploit Still Has No Patch
Last week we covered a Microsoft Defender exploit called Rogue Planet — a vulnerability that gives an attacker complete control of a Windows machine once they have any level of access to it. This week, Microsoft officially acknowledged it. They've assigned it CVE-2026-50656 and confirmed a patch is in development.
But that patch is not available yet.
For business owners, this is serious. Your employees' computers are potential entry points. If someone clicks a bad link or opens a malicious attachment, Rogue Planet can turn that single mistake into total system compromise.
Your best defenses right now: ensure antivirus is running, employ zero trust application control, keep Windows updated, and train your team not to click suspicious links or attachments.
Story 7 — Beats Studio Buds Bluetooth Vulnerability: Update Your Firmware Now
Apple released a firmware update for Beats Studio Buds to patch a Bluetooth security flaw that allowed anyone within Bluetooth range to eavesdrop on your conversations through the earbuds' microphone while the device was in pairing mode.
If you own Beats Studio Buds, update to firmware version 1B211 immediately. Open your Bluetooth settings on your phone and verify your earbuds are running the latest version.
Story 8 — June Windows Update Bug: Word, Excel, and PowerPoint Won't Open Through Third-Party Apps
This one isn't a security threat, but it's a real productivity problem. The June Windows update introduced a bug preventing some users from opening Word, Excel, PowerPoint, or Access through third-party applications. If your accounting software or dental practice management software suddenly can't launch Office programs, this is the cause. Microsoft says a fix is in progress but is not yet available.
What This Means for Florida Businesses
Eight significant threats in a single week is a reminder that cybercriminals are not slowing down. For small and mid-sized businesses on Florida's Treasure Coast, Space Coast, and South Florida, staying ahead of threats like these requires constant vigilance — the kind that's simply not realistic to handle in-house.
At A Faster PC, we monitor the cybersecurity landscape every single day so our clients don't have to. From managed firewall protection and Microsoft 365 security to employee training and endpoint management, we keep businesses in Port St. Lucie, Stuart, Vero Beach, Melbourne, and across South Florida protected and productive.
Rp worrying about cybersecurity? Schedule a FREE discovery call today!
If you need help protecting your business, or even just your personal computer, call us today at 772-878-5978 or visit https://www.AFasterPC.com. And while you're there, download our free cybersecurity report — it walks you through the most important steps you can take to protect yourself right now.
When you have — or want to prevent — cybersecurity problems, you need A Faster PC.
Watch the full video here: AI Scammers Just Stole $2 Billion | Here's How They Did It
Frequently Asked Questions
Q: What is FortiBleed and should my business be worried?
A: FortiBleed is the name given to a massive credential leak that exposed the usernames and passwords for nearly 74,000 Fortinet firewall and VPN devices across 194 countries. Attackers don't need to hack anything — they just log in using the stolen credentials. If your business uses Fortinet firewalls or VPN devices, CISA has issued an emergency advisory directing you to change your credentials immediately. If you're not sure whether your network uses Fortinet equipment, contact a managed IT provider like A Faster PC to check.
Q: How did AI help criminals steal $2 billion in phishing scams?
A: A Chinese cybercrime group called Outsider Enterprise used artificial intelligence to mass-produce 9,000 fake websites and send 2.5 million phishing text messages in just two weeks. The AI made the fake messages look convincingly real — mimicking carriers like AT&T, T-Mobile, and Verizon. The FBI shut down the operation through an effort called Operation Riptide, but the group had already caused nearly $2 billion in losses and stolen 3.8 million credit card numbers.
Q: What is the Microsoft 365 Copilot Search Leak vulnerability and am I affected?
A: The Search Leak vulnerability, discovered by security firm Varonis, allowed a single malicious link to silently use Microsoft Copilot's permissions to search and steal your emails, OneDrive files, SharePoint documents, and calendar data. Microsoft has rated this critical and released a patch. If your business uses Microsoft 365 Copilot and hasn't applied recent updates, you may still be vulnerable. Have your IT provider verify your environment is fully patched.
Q: Are scammers really sending people to victims' homes to collect cash?
A: Yes, and the FBI is actively warning about it. Scammers — typically running investment fraud, tech support scams, or government impersonation — are sending human couriers to collect cash from victims in person when bank wire transfers get blocked. They use code words or serial numbers to make the exchange feel official. This scam primarily targets seniors, but it's spreading. No legitimate company, government agency, or investment platform will ever send someone to your door to collect cash.
Q: What should I do if I bought a hunting or fishing license in Texas?
A: The Texas Parks and Wildlife Department disclosed a data breach affecting more than 3 million people. If you've purchased a license through their third-party vendor system, your driver's license number, passport number, email address, phone number, and home address may have been stolen. Social Security numbers and financial data were not taken. Your best immediate step is to place a free credit freeze with all three bureaus — Equifax, Experian, and TransUnion — to prevent new accounts from being opened in your name.
Q: What is the Rogue Planet exploit and is my Windows computer at risk?
A: Rogue Planet (now officially assigned CVE-2026-50656) is a Microsoft Defender vulnerability that allows anyone who already has any level of access to your computer to gain complete control of it. Microsoft has acknowledged it and is developing a patch, but that fix is not yet available. In the meantime, make sure your antivirus is active, keep Windows updated, and train employees not to click suspicious links or open unknown attachments.
Q: What cybersecurity steps should small businesses on Florida's Treasure Coast take right now?
A: Florida's Treasure Coast, Space Coast, and South Florida businesses face the same threats as companies anywhere in the world, but many don't have dedicated IT staff monitoring for them. Right now, priority actions include: changing Fortinet firewall credentials if you use them, verifying Microsoft 365 is fully patched, freezing credit if you bought a Texas hunting or fishing license, and training employees not to click links in unexpected text messages or emails. A managed IT services provider like A Faster PC in Port St. Lucie can handle these checks for you so you can focus on running your business.
Q: How do I update the firmware on my Beats Studio Buds?
A: Apple released firmware version 1B211 for Beats Studio Buds to patch a Bluetooth vulnerability that let anyone nearby eavesdrop through the earbuds' microphone. To update, open your iPhone or Android Bluetooth settings, connect your Beats Studio Buds, and check for a firmware update in the device details. The fix is available now and takes only a few minutes to apply.
About A Faster PC
A Faster PC is a leading managed services provider (MSP) serving Florida's Treasure Coast, Space Coast, and South Florida. A Faster PC provides responsive IT support, advanced cybersecurity solutions, cloud backup, disaster recovery, breach remediation, patch management, computer repair, and technical support for accounting offices, attorneys' offices, medical offices, dental offices, professional offices, small- to medium-sized businesses, non-profits, churches, home office users, and individuals throughout the regions. We help our clients cut costs in their Internet, TV, and telephone bills and in business operations.
Every week at 10:07 AM EST, A Faster PC hosts A Faster PC Live Technical Support which is a live Radio Show that is livestreamed to YouTube and Facebook and is available as a podcast. For various ways to listen to and watch A Faster PC Live Technical support, visit https://www.afasterpc.com/live-technical-support/.
A Faster PC services the following counties and cities: St. Lucie County including: Port St. Lucie, Fort Pierce, St. Lucie West, Tradition, St. Lucie Village; Martin County including: Stuart, Jensen Beach, Jupiter Island, Ocean Breeze Park, and Sewall's Point; Indian River County: including Vero Beach, Sebastian, Fellsmere, Indian River Shores; Palm Beach County including: Jupiter, Jupiter Inlet Colony, Juno Beach, Tequesta, Palm Beach Gardens, North Palm Beach, Palm Beach Shores, Riviera Beach, West Palm Beach, Wellington, Royal Palm Beach, Greenacres, Lake Worth Beach, Lantana, Boynton Beach, Ocean Ridge, Briny Breezes, Gulf Stream, Delray Beach, Highland Beach, and Boca Raton; Broward County including: Fort Lauderdale, Hollywood, Pompano Beach, Coral Springs, Pembroke Pines, Miramar, Davie, Plantation, Sunrise, Deerfield Beach, Lauderhill, Weston, Tamarac, Coconut Creek, Margate, Lauderdale Lakes, Oakland Park, Hallandale Beach, Cooper City, Wilton Manors, Lighthouse Point, Parkland, Lauderdale-by-the-Sea, Sea Ranch Lakes, Lazy Lake, Hillsboro Beach, Southwest Ranches, North Lauderdale, Dania Beach; Miami-Dade County including: Miami, Miami Beach, Hialeah, Miami Gardens, Coral Gables, Homestead, Doral, North Miami, Aventura, Kendall, Cutler Bay, Sunny Isles Beach, Key Biscayne, Pinecrest, Surfside, Bal Harbour, North Miami Beach, Palmetto Bay, Miami Springs, Opa-locka, Miami Lakes, Florida City, South Miami, Sweetwater, West Miami, Bay Harbor Islands, Biscayne Park, El Portal, Golden Beach, Hialeah Gardens, Indian Creek, Medley, North Bay Village, and Virginia Gardens; and Okeechobee County including: Okeechobee, Taylor Creek, Cypress Quarters, Fort Drum, and Basinger.
