This Week in IT: Stay Safe

Welcome back to the itpick weekly news roundup — your no-nonsense guide to what happened in tech this week and, more importantly, what it actually means for you. It’s been a busy one, so let’s get into it.

OpenAI Just Launched What It’s Calling the Start of AGI

Big news from OpenAI this week: they’ve released GPT-6 Astra, and they’re not being shy about what they think it represents. The company is billing it as the beginning of the AGI era — that’s artificial general intelligence, the long-chased goal of building AI systems that can outperform humans across most meaningful tasks.

Now, bold claims are something OpenAI is rather good at, and it’ll take a while for independent researchers to properly stress-test what GPT-6 Astra can actually do. But if even half the promises hold up, this is a genuine step change in what AI tools can help you with day-to-day — whether that’s drafting documents, analysing data, writing code, or handling complex research tasks.

For context, tools like Grammarly and Notion are already integrating earlier AI models to help with writing and productivity. As frontier models like GPT-6 improve, expect those kinds of tools to get meaningfully smarter over the coming months.

What this means for you: Keep an eye on the AI tools you already use — they’re likely to get a significant upgrade as GPT-6 Astra trickles into third-party products.

Hackers Broke Into Hotel Rooms to Backdoor Executives’ Laptops

This one reads like a spy thriller, but it’s completely real. A Chinese state-linked hacking group targeted business executives attending an agricultural industry conference in China this spring. Rather than sending dodgy emails or hacking a network, the attackers physically broke into hotel rooms while the executives were at dinner, booted up their laptops using a USB stick, and installed a backdoor — all without leaving obvious signs of entry.

The detail that stings a bit: the fix that would have blocked the attack already existed. A security feature that prevents unauthorised booting from external devices was available but hadn’t been enabled on the affected machines. CrowdStrike, who uncovered the campaign, flagged this as a stark reminder that having security tools is only half the job — they need to be properly configured too.

If you’re travelling for business, especially internationally, physical device security matters just as much as your passwords. A VPN like NordVPN protects your connection on dodgy hotel Wi-Fi, but it won’t help if someone’s had physical access to your machine.

What this means for you: Enable full-disk encryption and BIOS boot protection on your work laptop — and never leave it unattended in a hotel room at a conference.

A Dodgy npm Package Has Been Quietly Downloaded Nearly 1,000 Times

Developers and small businesses using JavaScript tooling, take note. Security researchers discovered a malicious package on npm — the popular software package registry — called “imgdecode.” It was hiding a shellcode loader inside what looked like a legitimate Windows helper file. It had already been downloaded close to a thousand times before being flagged.

This is part of a broader campaign researchers are calling MALFEX, which targets the software supply chain — essentially, the libraries and tools that developers pull into their projects. The scary part is that most people downloading these packages have no idea what’s inside them.

If your business relies on any custom software or has developers on the team, it’s worth making sure there’s a process for vetting third-party dependencies. This kind of attack is increasingly common and can quietly compromise a system without any obvious warning signs.

What this means for you: If you use npm packages in any of your projects, audit your dependencies regularly and use tools that flag known malicious packages automatically.

Hackers Used a Stolen Backup Tool Credential to Access 173 Microsoft 365 Accounts

Finally, a serious warning for anyone using Microsoft 365 — which, let’s be honest, is most of us. Attackers got hold of a compromised credential belonging to ConnectWise Cloud Backup, a backup service used by managed service providers (MSPs). Using that single login, they were able to access Microsoft 365 environments belonging to 173 different organisations.

This is a textbook supply chain attack: compromise one trusted provider, and you potentially get a skeleton key to hundreds of their customers. It’s a good reminder that your Microsoft 365 security is only as strong as every tool you’ve connected to it.

Make sure multi-factor authentication is switched on across your M365 account, audit which third-party apps have access, and use a proper password manager — NordPass, for example, can help make sure your credentials aren’t being reused across services.

What this means for you: Review which third-party tools have access to your Microsoft 365 account, enable MFA everywhere, and treat your backup provider’s security as seriously as your own.

That’s your week in IT. Between a potential AGI milestone, physical laptop attacks at conferences, and supply chain compromises hitting Microsoft 365 users, it’s been a week that underlines an old truth: the threats are getting more creative, but the defences are usually straightforward — if you actually put them in place. We’ll be back next week with more. Stay safe out there.