Outlook Having PDF Preview Issues With Microsoft PowerToys

Do you use Microsoft PowerToys?  If you’re not sure what that is then you probably don’t. If you’re curious, Microsoft has an open-source set of tools called PowerToys which is designed to allow power users to customize their Windows environments to taste.

In some instances, for some Microsoft 365 users, if the user in question also has PowerToys installed, it may cause an issue with Outlook’s PDF previewer. So when you get an email with a PDF attachment, and the conditions laid out above are also true, Outlook’s built in PDF viewer may not function for you.

This is obviously not an issue that is impacting millions of users around the world.  The conditions described above would only apply to a tiny slice of Windows 10 users. If you happen to be a Windows 10 user and you use Microsoft 365, you have PowerToys installed, and you also get emails with PDF attachments on a regular basis, you may have noticed this problem.

If it crops up for you, you’ll get a message telling you that Outlook is unable to preview the file because there is no previewer installed for it.

According to Microsoft, one of the reasons this error appears is because there is a PDF preview File Explorer add-on bundled with Microsoft PowerToys.  This add-on over-rides the PFD Preview setting in Microsoft 365.

Fortunately, if you are being impacted by this error there’s a simple fix for it.  You can simply open your PowerToys software, clicking “File Explorer Add-Ons” on the left-hand sidebar, and toggle the “Enable PDF Preview” option to off.

Again, this isn’t something that most people will ever even see.  There are a very specific set of conditions that must be true for this error to even pop up on your radar. If you are seeing it, now you know why, and knowledge is power.

Transitioning from average to best-in-class with IT

Transitioning from average to best-in-class with IT

Many small or mid-sized businesses don’t focus much on IT as they should. For a lot of them, the focus is on customers, ensuring they have enough staff to meet their client needs, expanding their business and driving revenue by selling. IT comes into the picture initially when the business is being set up. Once they have their IT infrastructure up and running, it tends to take a backseat. The typical mid-sized or small business owner seems to prefer the firefighting approach to IT–meaning, they reach out to an IT service provider only when they have an IT problem.

Interestingly, this is the key difference between the average SMB and best-in-class SMBs. The best-in-class SMBs tend to adopt a more proactive approach towards IT. They either have an in-house IT team or sign-up with a Managed Services Provider to take care of their IT needs on a regular basis. In contrast to the average SMB, the best-in-class almost always has a Service Level Agreement (SLA) with a reputed MSP.

Businesses that have service contracts with MSPs have access to the latest technology. The IT industry is constantly evolving and managed service providers are well aware of the changes. They know it first when a new technology is gaining widespread adoption across various industry verticals and can advise their clients accordingly. On the other hand, the in-house IT team may be too busy handling the day-to-day IT requirements to be able to focus on new technology and the various ways in which it can be applied to benefit the business. This specialized focus of MSPs also makes them a great asset to have on board when implementing new technologies or deploying new IT projects within the business.

Having a dedicated MSP-partner to take care of all IT needs helps businesses give 100% to other areas that help the business grow. With IT issues off their shoulders, management can focus more on clients, brand and market expansion.

New GIMMICK Malware Targets MacOS Users

If you follow the global threat landscape closely, then you may already be aware of a notorious Chinese hacking collective known as “Storm Cloud.” What few people know is that this group seems to be the driving force behind a new variant of malware that researchers have recently spotted in the wild.

Dubbed “GIMMICK” by the researchers at Volexity who first discovered it, the malicious code seems to be a custom tool designed and built by Storm Cloud specifically to target Mac users.

Once GIMMICK has found its way onto a target system, it quietly installs a trio of malware components called DriveManager, FileManager, and GCDTimerManager.

The DriveManager component gives the malware the following capabilities:

  • Manage the Google Drive and proxy sessions.
  • Maintain a local map of the Google Drive directory hierarchy in memory.
  • Manage locks for synchronizing tasks on the Google Drive session.
  • Handle download and upload tasks to and from the Google Drive session.

FileManager as the name indicates, manages the local directory where particulars relating to the command-and-control server are stored, along with the command tasks necessary for file exfiltration.

Finally, the GCDTimerManager handles the management of the various GCD objects.

The researchers at Volexity had this to say about the malware in their recently published report:

“Due to the asynchronous nature of the malware operation, command execution requires a staged approach. Though the individual steps occur asynchronously, every command follows the same.”

The bottom line is that this is a complex, robust malware strain. The good news is that the fine folks at Apple have found ways to guard against this latest threat.  The company has rolled out new protections to all supported macOS versions with new signatures for XProtect and MRT.

The new signatures that have been available since March 17, 2022 should protect users against GIMMICK. So if it’s been a while since you updated your OS, now is the time to do so.  Kudos to Apple for their rapid response here and to the sharp-eyed researchers at Volexity for spotting the new threat.

Data Breach Announced At Popular Photo Site Shutterfly

Online photography platform Shutterfly is the latest high-profile company to fall victim to a hacking attack.  The company recently disclosed that in December of last year (2021) they were targeted by the Conti gang, who successfully breached their system and initiated a ransomware attack. The company’s breach notification statement was sent to impacted users and filed with the California Attorney General’s Office in the aftermath of the attack.

Their statement reads in part as follows:

“The attacker both locked up some of our systems and accessed some of the data on those systems. This included access to personal information of certain people, including you.

We believe the access occurred on or about December 3, 2021. We discovered the incident on December 13, 2021.”

Their statement goes on to say that a large amount of data was stolen, and that it included employee personal information. Some of the information taken were names, addresses, salaries, login credentials for an unspecified number of Corporate Services users, and a wide range of customer information including at least the last four digits of credit card numbers kept on file.

Unfortunately, we don’t yet have a good accounting of exactly how many users, employees, or customers may have been impacted by the breach.  What is known is that so far, the company has decrypted more than 4,000 devices and more than 120VMware ESXi servers belonging to Shutterfly. Also, the investigation into the matter is ongoing at this time.

If you are a Shutterfly customer who was impacted by the attack, you’ve almost certainly received a copy of the official breach notification at this point.  If you’re a customer and you haven’t received one, you may want to reach out to the corporate office to check the status of your account.

Finally, out of an abundance of caution, if you have an account with Shutterfly you should probably change your password right away. If you’re using that same password on other web properties, change those too.

This will certainly not be the last such incident we hear about in 2022, so stay vigilant out there.

Fake Work From Home Opportunities Are Phishing For Data

It’s no secret that the pandemic changed the way much of the world works.  Tens of millions of people are now working from home with millions more eyeing that as a very real possibility.

Unfortunately, the pandemic also changed what kinds of opportunities hackers and scammers are targeting. It shouldn’t come as a great shock that they’ve begun targeting work from home opportunities.

Here’s how a typical campaign plays out, according to researchers at Proofpoint:

On average, more than 4000 phishing emails a day are being sent to recipients worldwide.  The bulk of recipients are in the United States, but people in Europe and Australia are being targeted too.

In more than 95 percent of cases, attackers are targeting email addresses that are linked to colleges and universities. So as a first necessary step, the attackers are either hacking into university databases to get the email addresses or they’re leveraging someone else’s prior breach and buying the data on the Dark Web.

In any case, the specific lure varies from one campaign to the next but it’s always some variation of “we’re hiring X number of remote workers to do this!” They then include a few details about the job with an attachment or an embedded link to follow for more information.

Naturally, if you open the file or follow the link you’ll ultimately be presented with capture boxes designed to collect your login information or other personal details. If you give the hackers/scammers any information, you can bet that it will be used against you.  According to FBI statistics, the average loss for a victim of employment fraud is about $3,000.

It may not be life ruining bad, but it still stings. In any case, these kinds of attacks are on the rise in our post-pandemic world. Be aware and make sure that your friends and family know too.