Welcome to The Senroc Download! This is your weekly briefing from the team at Senroc Technologies letting you know what we're seeing, what we're thinking, and tips you can use right now.

Password managers are a smart security habit — one strong password to remember instead of dozens of weak ones. Attackers know people trust them, which is why a phishing campaign is now targeting users of LastPass and Bitwarden specifically. The emails look like official security alerts, warning that the company was breached and urging you to download an updated version of the app. The download installs software that gives the attacker remote access to your computer.

LastPass confirmed it was not actually breached — the emails are fake. But they're well-crafted enough that people are clicking.

Takeaway: The lesson isn't to stop using a password manager. It's to never download software in response to an unexpected email, no matter how official it looks. If you get an unexpected security alert from any platform you use, go directly to the company's real website to verify — don't click any links in the email.

One of the most common ways businesses lose money to cybercrime has nothing to do with ransomware or hacking. An employee gets an email that looks like it's from a vendor, a supplier, or even their own CEO, asking them to process a payment or wire funds to a new account. The email address looks right. The tone is familiar. The money goes out and it's gone.

Two things stop this almost every time. First, any request to change payment information or wire money to a new account should be verified by phone, using a number you already have on file, not one in the email. Second, set a policy that payments over a certain dollar amount require a second person to approve. Neither of these takes more than five minutes to put in place.

Takeaway: If a vendor sends new banking details, call them to confirm before making any payment. Make that a written policy for your team. The attackers are counting on someone being too busy to make the call.

Most businesses know they're supposed to have backups. What's less understood is that ransomware attackers know it too — and they look for your backups first. Modern ransomware often sits inside a network for days or weeks before activating, identifying and encrypting backup files before the attack becomes visible. By the time you go to restore, the backups are compromised too.

The standard that actually protects you is called 3-2-1: three copies of your data, on two different types of storage, with one copy stored somewhere entirely separate from your main environment. It's also not enough to have the backup — it needs to be tested regularly to confirm a real restore actually works.

Takeaway: Ask your IT team when your backups were last tested with an actual restore. "We have backups" and "we can recover from backups" are two different things. The difference matters most when you need it.