This week our team encountered a malware family called "QuartzLine" that is being served to users mainly through ads on free file-hosting sites. It installs in the user context (so admin privilege is not required), establishes several paths for persistence, and creates a connection with attacker infrastructure that allows the device to receive instructions from C2 servers as it checks in on an hourly basis. We have observed browser data being compiled and exported to an attacker-controlled S3 bucket in AWS. For those of you with Crowdstrike MDR, it seems like their team is just now starting to detect and remediate this malware, but their interaction has been inconsistent so far, so it is definitely worth checking on yourself. 

We wrote up a report with more details, including IOCs, remediation items, and queries that can be run with Crowdstrike's Advanced Event Search. Here is a link to our website where we have more details: 

https://www.oaisd.org/programs-services/innovation-technology-information-security/technology-services/cyber-security-operations-center-csoc/technical-documentation#:~:text=QuartzLine%20%2D%20October%202026

Here is a link to a printable report: 

https://docs.google.com/document/d/1YYksttmskrNiE-bTQEYTryYIZyuEQ5txwYv18xVkwHU/edit?usp=sharing

If anyone has questions about remediation, please feel free to reach out. If you detect QuartzLine on any devices in your district, I would strongly recommend isolating the device so that inbound and outbound network connections do not go through while you are continuing to investigate and remediate. 

Hi crew - curious how you handle meeting room scheduling. We have ~20 rooms that we put on a public schedule tool and allow staff (and the general public) to request the use of the space. All requests are manually reviewed and approved by admin staff. For reference, we currently use CalendarWiz (with "locations" being rooms) but it is lacking some features that are becoming untenable.

We need a public facing calendar with ability to hide private events, a tool to request space use (public facing), double-booking avoidance, control over what information is submitted when space use requests are submitted, double-booking avoidance when requesting space, and some related features. We do NOT have scheduling system hardware in the rooms or on the walls outside, so we really just need a software platform. The data is entered via import/manually, so we don't care about multi-calendar syncing either.

Gemini pointed me towards Skedda and Yarooms - curious if anyone has used either or has suggestions for other options to look at?

Backstory: We're running the free version of Google for Education. For Google Groups, under the settings for who can create groups, there are 3 options:

1. Only Google admins

2. Anyone in the organization

3. Anyone in the universe

We've had it at option 2, but we have some students creating their own (sometimes inappropriate) groups. We're going to change it to option 1, but we have teachers and building admins wanting to create their own groups (students in class, students + parents, etc.), and so I'm trying to create a custom admin role for these folks to be able to create (but not delete) groups.

Our info originates via on-premise Active Directory and gets sync'd (1-way) over to Google. We have teacher groups (AD security groups) that show up as "Mailing groups" on the Google side, where you have to change them to what Google defines as "security groups" in order to assign group permissions for admin tasks. So I've done that, and enabled only Groups - Create, Groups - Read, and Groups - Update in the custom admin role.

I have a test teacher who's able to start the group creation, add members, and set a handful of initial settings, but when she clicks "Create" she gets multiple captchas and then an error saying unable to complete.

Am I asking more of Google Admin that it's capable of doing here?

Thanks in advance...

Have two schools reporting this issue same day. Time is off and drifting on Chromebooks.

This is interesting for me for a few reasons:

• Chromebooks don't use NTP like AD DS / Domain Computers
• We haven't made any setting or config changes to security / domain traffic
• These two school districts utilize very different ISPs for internet uplink

I just went in and set Timezones automatically and to send all location data up to Google under Chrome OS Device settings. Going to see if that helps. But..it's weird seeing two sites both have the same issue all the sudden; going to start monitoring the rest of our sites. But...figured I'd reach out here to see if anyone else is experiencing this.

This has been an ongoing issue for a while but no real pattern to it. Sometimes chromebooks just forget the wifi password. It's not the same ones and it's at multiple campuses. And it's not like a hundred at a time. I'm having to retype the password at least two or three times a day at different campuses. Is there some setting in admin console I need to check? It doesn't do it with our teacher laptops, just the Chromebooks.

Blocking these is an exercise in futility, but in case anyone is trying, here is a rash of them:

unblocked-games.s3.amazonaws.com/mobile/index.html

s3.amazonaws.com/deaganfern/index.html

brianthomas-studyhub.s3.amazonaws.com/index.html

lumivex.s3.amazonaws.com/index.html

s3.amazonaws.com/lumivex/index.html

s3.amazonaws.com/crazygames-unblocked/index.html

nothing-to-hide-demo.s3.amazonaws.com/index.html

s3.amazonaws.com/iogameslists/index.html

tbg95.s3.amazonaws.com/driving.html

unblockedgamesaz.s3.amazonaws.com/tag/laser/index.html

unblocked-games.s3.amazonaws.com/unblocked/index.html

g-class.s3.amazonaws.com/index.html

unblocked-games.s3.amazonaws.com/cdn/index.html

s3ef.s3.amazonaws.com/index.html

unblocked-2026.s3.amazonaws.com/index.html

funnyshooter2.s3.amazonaws.com/index.html

run3.s3.amazonaws.com/index.html

s3.amazonaws.com/superjoe/temp/pillagers/index.html

We had a sudden bombardment of student accounts end up being called out for suspicious login attempts this week as they attempted to login to on site chromebooks. All of them had a phone number attached to their accounts that caused MFA confirmations requirements. Staff had to go into each account and remove the associated phone number to allow the accounts in question to login again.

I feel it is worth noting that we are a phone free school, and that it is possible that some parents are logged in to their student's accounts on the parent's phones.

Edit: I want to clarify that the issue is two fold: first is that phone numbers are being associated with accounts without users being informed, as long as they are added to an android phone.

Second was the suspicious login messaging, which CAN be seen with a sudden burst of requests or logins from an IP or gateway apparently (we normally see this behavior at the start of a new school year) but could also be triggered when an account is logged in on a device and another login attempt occurs where the connection traces to a different geolocation.

From Android Authority:

https://www.androidauthority.com/google-auto-phone-number-verification-android-3723117/

Copy/pasted select sections:

PSA: Google is silently linking your phone number across all signed-in accounts

Android’s phone number verification setting is opt-out, and links your number across every Google account on your device.

TL;DR

Google now automatically verifies and attaches your phone number to every Google account signed in on your Android device without explicit prompts.

Google updated its documentation between August and October 2025 to reflect this opt-out behavior, which links numbers across secondary, work, and alt profiles.

Users can turn off “Verify phone numbers automatically” in their Android device’s Google settings page, but previously linked numbers must be manually removed from each Google account’s Personal Info page.

Note that turning off the phone number verification toggle only prevents future linking. If Google has already attached your number across secondary accounts, you will need to open your Google Account Personal Info page, head to Contact info > Phone, and manually remove the number from each profile where it doesn’t belong.

This looks like a combination of heat and chemical damage to me. Has anyone else seen something like this? There is also substantial damage and warping on the lid along with a large stress crack. No indication of bending or crushing.

Hello Everyone,

recently a local business dropped an ATM at our school and I found out when a ticket was put in for it to have a hard-wire network connection installed. My compliance alarm bells started shrieking quite loudly.

This is a small rural community and I am afraid the people whose numbers I have been given to talk to, who delivered this thing will be quite indifferent towards the security and compliance side of things, I don't even think they plan to bolt this thing down.

does anyone have any suggestions? while I don't think I when some guy in a mask with a handtruck walks off with it during a volleyball game, I also don't want a team of lawyers who lost my salary on kalshi last week grilling me about this thing.

When clicking on a video on a student's Chromebook, it pops up the error "Could not preview the file. There was a problem playing this video." The original files were a mix of .webm and .mkv, I swapped them to .mp4, but the issue persists. I also saw an old post from 9 years ago that said to set 3rd Party Cookies to allow, but the issue persists. Does anyone have any ideas to fix this?

Solution: Thanks to u/jay0lee, he recommended trying it on a hotspot. After doing so, it finally loaded, but it showed the actual cause: apparently, Google Drive uploaded videos still try to contact youtube.googleapis.com, which was blocked. After unblocking that address on the firewall and moving it back on the network, it started working instantly.

Hope this helps anyone else experiencing this issue

The Google coverage centers on Gemini and the new Canvas feature. The guys describe creating polished Google Sheets dashboards and accessible tools in minutes and show how quick, whimsical vibe coding can generate games - but they warn that those same creative powers let students build distractions or bypass controls.

Listen https://k12techtalkpodcast.com/e/vibe-coding-bidets-ai-in-schools-inside-google-s-education-summit/ and all major podpcast platforms

Came into the office today with (so far) a half dozen of this model PC booting into a Disk Read error screen. Several of these have different drives that were swapped out over the years, so the only matching hardware among them is CPU, mobo, ram and PSU. Bios shows drive fine, which made me think it maybe wasn't Windows. We are swapping drives into another PC now to test ( I am not at campus with other techs).

Assumed it was a Windows update to hit a specific model like this (all were running same version of 11, re-imaged from 10 originally for that model). Has anyone else seen this today or something similar?

Hi everyone,

I am not sure if anyone else is experiencing this, but something we have started to notice. As a district, we decided to turn K-8 access to YouTube off at the GAC level. This will allow them to still view embedded content (by teachers, curriculum, etc), but will not allow them to go to YouTube.com. We have noticed a handful of students that are in this K-8 age group still able to get past this (while viewing through our GoGuardian Filter). It is not all the time and you will notice many students will get that "Your institution has denied access" when they try to go to YouTube.com, but sometimes they are able to do it for a small period of time.

For context, we have CBs locked down so they cannot be logged in with any account from outside the district and they also cannot log into another account within Chrome. It does appear like they are not going directly to YouTube.com home page and able to search, but are instead entering the whole url for a specific video (almost always to get more proxy site addresses). We can also confirm they are not on a Proxy site when doing this. We also have logged in as the student and we are still getting the blocked message. GoGuardian wants us to block YouTube.com, but this would then block embedded content, which we still need to have open for them.

Has anyone seen this and any tips with making sure it is fully locked down?

Has anyone gotten from there admin the "free" Microsoft/Adobe programs from artcraft. Asking to replace all of the apps that it could?

https://getartcraft.com/apps

What do you guys think, I just downloaded them and going to try them out, they especially want the PDF Craft.

I've known about this for several months and have already transitioned; but in talking to a few others who were unaware I don't think it's been communicated very effectively.

If you are using SCEP via Google for certificate enrollment for 802.1x, it will stop working at the end of next month. You need to transition to the newer certificate provisioning API.

https://support.google.com/chrome/a/answer/18337728?hl=en

Just for shits and giggles, I’m tempted to dress up as a wizard for Halloween at school. What good tech-y sounding spells should I use when helping people, un-jamming copiers, helping kids with their iPads, etc? Like “O, mighty Wozniak! Bring this iPad back to life!”

We've had some Chromebooks that seem to log out while using them, but a reboot fixes them. We also have some iPads that aren't letting users login from Mosyle because of an authentication issue. Nothing changed on our end and nothing was updated recently.

We're in Pennsylvania if that matters.

Hello, do any of you guys have experience with using Managed Methods for their email filtering/phishing solution? I have a sales call with them next week and am looking for feedback on their product, their support, and how much IT overhead / time invested will be required for this solution.

Thanks!

We manage all our accounts with Active Directory and sync them to Entra (P1) and Google Workspace for Education (Fundamentals). Students use Chromebooks grades 3-12. We use Lightspeed as the filter.

A couple years back, Microsoft added the GitHub sign-in path and students immediately began exploiting it on their Chromebooks. They could do this because sign-in to the Chromebook occurs before any filtering is brought online. We "blocked" them by using Custom CSS in our Entra custom branding to remove the "Sign-in options" link.

Now Microsoft is retiring custom CSS positioning properties. They specifically call out "display", which is what we use to remove the link. They are doing this October 26.

There is no toggle to remove the "Sign-in options" link that I have found. How do the rest of you block it or ensure students can only use their school-issued account to log into their Chromebooks?

I'm sick of Intune. I'm sick of packaging apps in the only way that Intune can handle them. I'm sick of my deployments possibly installing sometime between 20 minutes and 2 days. I'm sick of hearing that a patch is breaking something and having no way to block that single update and automatically uninstalling it (a feature that SCCM/WSUS has had for years upon years!). I'm sick of having to come up with novel ways to script things that SCCM could do natively. I'm sick of the limitations to dynamic groups. I'm sick of autopilot breaking or just not working or computer names/ID's left behind when it does break. I'm sick of seeing duplicate computers due to the same reason.

I want to replace Intune wholesale. I want a fully featured suite that gives me remote access, patching, app deployment and scripting (if necessary). I want the inventory it collects to be up to date. What grinds my gears is this is all stuff that Microsoft should be able to do natively - has done natively - and still can't implement it in any useable way into their own first party solutions.

I'm looking at NinjaOne as a replacement but was curious if anyone else was in the same boat or just skipped the Intune nightmare and went with something that would do the job better. We migrated from SCCM and I miss it everyday. Even better if it has an imaging solution baked in - but I can come up with something on that front if I need to.

I've been having an ongoing issue with a Meraki MS250-48 switch which is driving me nuts that I can't figure out. Maybe someone out there has some thoughts.

We have a combined MS/HS and a single elementary in our district. Internet comes into our MS/HS and is shared to our elementary via a private fiber line. Almost (not every time, but like 85% of the time) if I restart that switch, or restart the firewall at our MS/HS (which is where the connection for the elementary is supplied), the switch port doesn't recognize it is connected.

All the switches will come up with all of the ports EXCEPT the uplink port. If I remove the sftp+ transceiver and plug it back in, then it detects it and everything comes back up. This works to bring it back up 100% of the time.

I have replaced the transceiver, the fiber connection to where the fiber line comes into the building, the switch itself (the new/different switch does the same thing), moved the connection to a different port on the firewall, physically connected to the switch and pulled logs from the switch and sent them to Cisco, etc, and this is still happening.

At this point I'm out of ideas to try to see why this does this. Any thoughts or other things to try would be appreciated!

With budgets so tight in most districts, what conferences if any are you going to? So many EdTech conferences are too expensive or very teacher centered. Are there any worth the travel and budget that you go to? I have gone to TETL (Texas) and CoSN and they were both ok, TETL more so directed at tech directors instead of teachers.