Watch the Episode
Listen on Spotify
If you run a small business, today’s tech news hits close to home. Hackers are weaponizing tax season Google Ads to install malware that shuts down your security software, Microsoft is locking Copilot behind a paywall in two weeks, and the safety net for expired Microsoft 365 subscriptions just disappeared — effective today, April 1st. None of this is an April Fools’ joke. Here’s what you need to know and what to do about it.
Tax Season Google Ads Are Delivering Malware That Disables Your Endpoint Security
A large-scale malvertising campaign has been active since January 2026, targeting U.S. individuals and businesses who search Google for common tax forms like W-2s and W-9s. When someone clicks the sponsored ad — which looks identical to a legitimate search result — it installs ScreenConnect, a remote access tool that gives attackers full control of the machine.
What makes this attack especially dangerous is what happens next. The attackers deploy a driver exploit that specifically disables endpoint security software, including Microsoft Defender, SentinelOne, and Kaspersky. Once your security tools go silent, they steal passwords and move laterally across your network. If your EDR agent goes offline unexpectedly, treat that as an emergency, not a glitch.
We understand how frustrating it is when you’re trying to run your business and the tools you trust to protect you get turned against you. The reality is that your team is Googling tax forms right now, and these fake ads are nearly impossible to distinguish from real results. Here’s what we recommend: tell your entire team to never click sponsored Google Ads for tax forms. Go directly to IRS.gov. And if you see a security agent drop offline in your dashboard, call your IT partner immediately.
Microsoft Paywalls Copilot in Word, Excel, and PowerPoint Starting April 15
Starting April 15, 2026, Microsoft is removing free Copilot Chat access from Word, Excel, PowerPoint, and OneNote. If your team has been experimenting with Copilot inside these apps without a paid Microsoft 365 Copilot license, that access disappears in two weeks. Users without the paid license will only be able to use Copilot through the standalone Copilot app, not inside Office documents. Copilot in Outlook will still work.
This is Microsoft’s classic pattern: give a feature away free long enough for people to build habits around it, then put it behind a paywall. If your employees have started relying on Copilot to draft documents, analyze spreadsheets, or build presentations, you need to make a decision now. Either budget for the per-user Copilot license or set expectations with your staff that the feature is going away.
Check with your team this week. If nobody’s actually using Copilot inside Office apps, no action needed. But if people are depending on it, you want to plan for this before it disappears mid-month.
Microsoft Kills the Free Grace Period for Expired M365 Subscriptions — Effective Today
This one takes effect today, April 1, 2026. Microsoft has eliminated the free 90-day grace period that previously kept services running when a subscription expired or auto-renewal was turned off. Now, expired subscriptions automatically roll into a paid “Extended Service Term” at month-to-month rates plus a 3% surcharge. The only way to avoid these charges is to explicitly cancel before the subscription end date.
If you manage your own Microsoft 365 licenses and were relying on that grace period as a safety net, it’s gone. Forgetting to renew or cancel now costs you money automatically. This is especially important for businesses that add and remove seats seasonally — every subscription you forget about starts billing at a premium rate the moment it lapses.
Mark your renewal dates on the calendar. If ACS manages your licenses, we’re already on top of this. If you manage them yourself, audit your subscription list today before you get surprised on next month’s invoice.
Quick Hits: Stryker Intune Wipe, AI Training Act, CareCloud Breach
Stryker Intune Wipe Attack: Iran-linked hackers compromised a single admin account at medical device giant Stryker and used Microsoft Intune to remotely wipe over 200,000 devices across 79 countries. No malware was used — just a stolen password and a legitimate IT management tool. CISA has issued guidance urging all organizations to audit Intune admin privileges and enable MFA on every admin account. If you use Intune, this is your wake-up call to review who has admin access.
Senate Reintroduces AI Training Act: Senators Cantwell and Moran reintroduced the Small Business Artificial Intelligence Training Act, directing the Commerce Department and SBA to create AI training resources specifically for small businesses. This is good news for SMBs looking to adopt AI tools without enterprise-level budgets.
CareCloud Healthcare EHR Breach: Healthcare software company CareCloud disclosed a breach of its electronic health record environment to the SEC. Healthcare practices using CareCloud should check for notifications and review their data exposure immediately.
Key Takeaways for Small Business Owners
- Never click sponsored Google Ads for tax forms — go directly to IRS.gov
- If your endpoint security agent goes offline unexpectedly, treat it as an emergency
- Decide this week whether Microsoft Copilot is worth the paid license before April 15
- Audit your Microsoft 365 subscription renewal dates — the free grace period is gone
- Review who has admin access to your Intune and Microsoft 365 environment
- Enable MFA on every admin account, no exceptions
Stay Ahead of Tech Problems Before They Hit Your Business
Three of today’s stories involve Microsoft tools being changed or exploited. The common thread: you need to know what’s in your Microsoft environment and who has admin access. That’s exactly what a good IT partner stays on top of for you.
If you’re tired of finding out about these changes after they’ve already cost you money or caused a security incident, let’s talk. Schedule a free IT consultation and we’ll review your environment together. No pressure, no sales pitch — just a clear picture of where you stand.
Subscribe to the ACS Daily Tech Briefing for daily tech news that affects your business. New episodes every weekday.