Firelands Computer Services Blog

You’ve seen them hundreds of times.

“Click here to prove you’re not a robot.”

It’s one of those things you don’t really think about.

You tick a box, maybe select a few images, and move on with your day.

That’s why this new scam works.

There’s a growing number of fake CAPTCHA pages designed to trick people into doing something slightly unusual… but not unusual enough to raise alarm bells in the moment.

Instead of clicking a box or selecting images, the page asks you to confirm you’re human by sending a text message.

That might already feel a bit odd, but the way it’s presented makes it seem like part of a normal verification process.

You tap the button, your phone opens a message that’s already written, and all you need to do is press send.

Simple.

Except behind the scenes, that single action can trigger multiple texts to international numbers.

In some cases, dozens of them.

Each one adds a small charge to your bill, and because those charges don’t show up immediately, the connection isn’t obvious.

A few weeks later, the bill arrives… and by then, you’ve probably forgotten all about the “verification” you completed.

That delay is what makes this scam particularly effective.

There’s another layer to it as well.

Some of these fake CAPTCHA pages don’t appear out of nowhere. You can be redirected to them through compromised websites or advertising networks.

You click something that looks legitimate, land on a page that feels familiar, and follow the instructions without thinking too deeply about it.

In some cases, even the browser behaves in a way that nudges you forward, making it harder to simply go back or exit.

This one doesn’t rely on technical knowledge; it relies on habit.

Your team is used to seeing CAPTCHAs. They expect and trust them.

And when something looks routine, people move quickly.

But remember this: CAPTCHAs should never ask you to send a text message.

If you ever see that, stop. Close the page and don’t interact with it further.

And remind your team of this, especially as more of these scams start to appear.

A lesson in awareness can save a lot of confusion (and unexpected charges) later.

If you’d like help making sure your team knows what to look out for (and what to avoid), let’s talk. Get in touch.

It sounds like a joke.

“Maybe we should just ban AI on Friday afternoons.”

But the more you think about it, the more it makes sense.

By Friday, most people are running on fumes. The week’s been busy, there are things to finish before the weekend, and attention to detail isn’t always at its sharpest.

Now add AI into that mix.

Tools like Microsoft Copilot can draft emails, summarize documents, and generate responses in seconds.

That’s incredibly useful.

But it also introduces a subtle risk.

The output looks polished and ready to send.

When you’re tired, it’s very easy to trust it without giving it a second look.

That’s where problems creep in.

The kind of small issues that slip through when no one’s paying close attention.

An email that sounds slightly off or a message that comes across the wrong way. Something that’s technically correct, but not appropriate for the situation.

The wrong tone can be harder to spot when you’re rushing to finish the week.

There’s also something else going on here that doesn’t get talked about enough.

The more we rely on AI to think for us, the less we challenge what it produces.

That can dull critical thinking.

Instead of asking, “Is this right?” the default becomes, “That looks fine.”

Across a team, over weeks and months, it can change how decisions are made.

Some people are starting to call this “AI fatigue”.

Constantly interacting with AI tools, checking them, and relying on them can feel mentally draining.

So, the idea of “no AI on Fridays” perhaps isn’t so out there.

At the end of the week, people are more likely to skip steps, less likely to question things, and more likely to hit send.

And AI makes that easier.

You don’t need to switch AI off, but you do need to build in habits around it.

Encourage your team to review anything generated by AI before it goes out externally. Especially emails, customer responses, or anything that represents your business.

Make it normal to sense-check the tone as well as the content.

If you’re using tools like Microsoft Copilot across the business, it’s also worth setting some simple guidelines. Clear expectations about when AI should be used, and how its output should be handled.

AI is a great assistant, but it still needs a human in the loop.

Especially at 4:30pm on a Friday.

If you’d like help creating some sensible rules around how AI is used in your business, get in touch.

You probably don’t think twice when you see a Windows update.

A quick click, a short wait and the job’s done.

It’s one of those routine things that feels safe by default.

After all, updates are there to protect your system, not cause problems.

That’s exactly why this latest scam is catching people out.

There’s a fake Windows 11 update doing the rounds that looks almost identical to the real thing.

The page is designed to look like an official Microsoft support site, right down to the layout and language. At a glance, there’s nothing obvious that gives it away.

It presents what appears to be a normal update for Windows 11 and invites you to download it.

But click the button, and you’re not installing an update.

You’re installing malware.

Now, here’s where it gets a bit more concerning.

It isn’t a rough, badly put-together scam. The file itself is built using legitimate tools that developers use every day.

It’s packaged in a way that looks genuine, with familiar labels and properties that suggest it’s from Microsoft.

Even security software can struggle to flag it straight away, because on the surface, everything checks out.

Attacks have evolved.

In the past, fake updates were easier to spot. The designs were poor, the wording odd… something always felt off.

But now, they’re designed to blend in.

Updates often happen quickly and without much thought. Someone on your team sees a prompt, clicks to install, and carries on with their day.

That habit is normally fine.

But when attackers start mimicking trusted processes, that same habit becomes a risk.

So, what’s the safer approach?

Keep updates inside Windows.

If you’re using Windows 11, the safest place to manage updates is through the built-in Settings app. That’s where genuine updates are delivered and installed.

If you ever need to download something manually, go directly to Microsoft’s official website rather than following links from emails or unfamiliar pages.

It’s also worth reminding your team of a simple rule: If something unexpected appears asking you to install an update, pause and double-check before doing anything.

You don’t want to make your team paranoid. But they do need to recognize that even the most routine actions can be turned into an entry point if the timing and presentation are convincing enough.

The more normal something looks, the less likely people are to question it. And attackers are counting on that.

If you’d like some simple ways to reduce this kind of risk, we can help. Get in touch.

Cybercriminals arguing with each other sounds like good news.

One group targeting another.

Threats flying back and forth.

Even promises to “help” victims caught in the middle.

It almost feels like justice.

But here’s the reality: There’s only one thing you can rely on cybercriminals for… and that’s looking after themselves.

Recently, one ransomware group started threatening another.

They claimed they would expose identities, leak data, and even offered to help victims unlock their files.

At first glance, that might sound like an opportunity. If you’ve been hit by an attack, and someone claims they can fix it, it’s tempting to consider it.

But this is where things get dangerous.

These groups aren’t operating with any sense of fairness or responsibility.

They’re not trying to do the right thing. They’re trying to gain leverage, create pressure, and ultimately make money.

Even when they turn on each other, the motivation doesn’t change. It’s still about control and profit.

In this particular case, one group claimed they could help victims recover their data.

The problem is there’s no proof they can.

And even if they could, you’re still dealing with a criminal organization that has no obligation to follow through on anything it promises.

It’s like being caught between two scammers and hoping one of them is the “honest” one.

That’s not a position you want your business to be in.

This situation highlights something important: When a cyberattack happens, your options should never include trusting another attacker.

It doesn’t matter how convincing the offer sounds or how desperate the situation feels. Relying on criminals introduces even more risk.

The only reliable path is through proper security measures and trusted support.

That means having the right protections in place before anything happens.

Backups that are tested and accessible.

Monitoring that helps you spot unusual activity early.

A clear plan for how to respond if something goes wrong.

And if the worst does happen, it means working with people whose job is to defend your business, not exploit it.

Cyberattacks mean making decisions under pressure. And the decisions you make in those moments can either limit the damage… or make things much worse.

If you’re not completely confident in how your business would respond to an attack, it’s time to create a strategy. If you’d like help with that, get in touch.

There’s a new layer being added to business decisions right now.

An email gets drafted before you’ve fully thought it through. A report is summarized before you’ve read it. A system suggests an action and, increasingly, carries it out.

None of this feels unusual anymore.

AI isn’t only helping people do work. It’s starting to shape how work gets done, and in some cases, what decisions get made along the way.

And that raises an interesting question. How much of what’s happening in your business right now is being influenced by something you don’t fully see?

AI agents aren’t tools sitting in one place.

They’re being built into workflows, stitched between systems, and given permission to act across different parts of your business.

They can access information, make updates, and trigger actions without needing someone to oversee each step.

That’s where things can drift.

Most of the time, everything looks like it’s working well. Tasks are completed faster. Responses are quicker. The team feels more efficient.

But influence is spreading.

And when influence spreads without visibility, it becomes harder to answer questions as simple as:

Why did that happen?

Why was that email sent that way?

Why was that decision made?

Why did that data end up there?

If a customer challenges something, or if there’s a compliance issue, or even an internal mistake, you need to be able to trace it back.

Without a clear view of where AI is involved, you can end up in a position where outcomes are harder to explain than they should be.

And when something can’t be explained clearly, it becomes harder to control.

There’s also a subtle shift in accountability.

When a person makes a decision, ownership is obvious.

When an AI-driven process contributes to that decision, responsibility can become less clear. Was it the tool? The setup? The data it was trained on? The person who approved it?

AI is already embedded in many of the tools businesses rely on, and it’s delivering real value.

It’s important to stay connected to how decisions are being made, understand where AI is influencing outcomes, know which processes involve it, and to make sure there’s a clear line between automation and accountability.

Because as AI agents become more capable, they start to shape direction.

And the businesses that stay in control of that will have a real advantage.

If you want to be sure where AI is influencing decisions across your business, we can help. Get in touch.