Returning from summer holidays increases cybersecurity risks for businesses - Scammers now exploit multiple communication channels

Many employees are already familiar with the warning signs of traditional email scams. As a result, cybercriminals are increasingly seeking to reach their targets through any communication platform where messages appear to be part of normal day-to-day work.

According to Kaapro Kanto, Business Director for Cybersecurity and Digital Platforms at DNA, attackers are increasingly leveraging workplace tools such as Microsoft Teams because employees tend to perceive messages received through these platforms as more trustworthy than email.

"Many organisations have become quite effective at identifying email phishing attempts, so criminals are constantly looking for new ways to reach employees. Teams, WhatsApp, Slack and many other communication applications have opened up new channels for cybercriminals because messages appear as part of normal work activities and are therefore regarded with greater trust. Criminals go where vigilance is at its weakest, and at the moment multi-channel communication platforms provide an ideal environment for this. At its core, this is about exploiting trust," says Kanto.

One click can open the door to an entire organisation

A scam may begin with what appears to be an entirely ordinary Teams message.

An employee may receive a message from someone claiming to be a new business partner and asking them to open a proposal document. However, the link leads to a fraudulent website designed to resemble a Microsoft sign-in page, allowing cybercriminals to capture the user's credentials. The message may also claim that the user's session has expired or that opening a file requires signing in again. In many cases, the attacker impersonates a colleague, manager or business partner and attempts to create a sense of urgency to prompt quick action.

"If a criminal gains access to an employee's Microsoft 365 credentials, the issue extends far beyond a single user account. Those credentials can provide access to emails, Teams conversations, documents and other business-critical information. At the same time, the attacker can send convincing messages from within the organisation, helping the attack spread further," Kanto explains.

August is peak season for scammers

After the summer holiday period, employees often return to large volumes of unread messages, packed calendars and projects that need to get back up and running. At the same time, attention to detail may temporarily decline.

According to Kanto, phishing activity often spikes immediately after employees return from their holidays.

"When people come back to work and are faced with a backlog of unread messages and a need to get things moving quickly again, routine verification practices are more likely to be overlooked. Scammers know this very well and time their attacks accordingly, especially during August," Kanto warns.

As autumn begins, companies should ensure that employees can recognise scam attempts across all communication platforms used within the organisation and understand that a message is not necessarily legitimate simply because it was delivered through a trusted channel. Updating cybersecurity awareness takes only a moment, but it can prevent significant financial losses, data breaches and business disruptions.

"Companies have invested heavily in technical security solutions, but attackers still seek the easiest route into organisations through people. As the autumn season begins, businesses should remind employees that suspicious messages can arrive not only via email, but also through Teams, meeting invitations or file-sharing requests," Kanto says.

DNA's tips for a more secure working day

• Verify the sender's identity before opening links or downloading files.
• Treat unexpected messages with caution across all communication platforms used by your organisation.
• Do not sign in to services through links contained in messages unless you are completely certain of their origin.
• Report suspicious messages to your organisation's IT support team or cybersecurity team.
• Enable multi-factor authentication for all key services and accounts.

Media inquiries:

DNA Corporate Communications, tel. +358 44 044 8000, communications@dna.fi