Security - 2

2026 (12)

May (3)

security: Breaking the code: Multi-stage ‘code of conduct’ phishing campaign leads to AiTM token compromise

Microsoft Security Blog

2026-05-04

Microsoft Defender Research documented a large-scale credential theft campaign using code-of-conduct-themed lures, a multi-step phishing chain, and legitimate email services to send authenticated messages from attacker-controlled domains. The campaign led to adversary-in-the-middle (AiTM) token compromise.

security: CVE-2026-31431: Copy Fail vulnerability enables Linux root privilege escalation across cloud environments

Microsoft Security Blog

2026-05-02

Microsoft says CVE-2026-31431 (“Copy Fail”) is a high-severity Linux vulnerability that can be used for root privilege escalation across cloud and Kubernetes environments. The post says a working exploit is already in the wild and urges organizations to detect and mitigate quickly.

security: Microsoft Agent 365, now generally available, expands capabilities and integrations

Microsoft Security Blog

2026-05-01

Microsoft announced general availability of Agent 365 and previewed new features for discovering and managing shadow AI agents, including local agents such as OpenClaw and Claude Code.

April (9)

security: What’s new, updated, or recently released in Microsoft Security

Microsoft Security Blog

2026-04-30

Microsoft Security published a brief In the Loop roundup page highlighting recently released, updated, or new security items. The provided content does not include any specific product changes or feature details.

security: Email threat landscape: Q1 2026 trends and insights

Microsoft Security Blog

2026-04-30

Microsoft reported that email threats rose in early 2026, driven by credential phishing, QR code phishing, and CAPTCHA-gated campaigns. It also said disruption of the Tycoon2FA phishing platform reduced observed volume by 15% and prompted changes in attacker tactics.

security: 8 best practices for CISOs conducting risk reviews

Microsoft Security Blog

2026-04-29

Microsoft Security Blog published a brief post titled "8 best practices for CISOs conducting risk reviews." The provided excerpt is a short intro that emphasizes proactive security to reduce exposure to threats.

security: Simplifying AWS defense with Microsoft Sentinel UEBA

Microsoft Security Blog

2026-04-28

Microsoft says Sentinel UEBA can help defenders separate normal AWS activity from suspicious behavior by turning raw CloudTrail logs into binary behavioral signals based on user, peer, and device baselines.

security: AI-powered defense for an AI-accelerated threat landscape

Microsoft Security Blog

2026-04-22

Microsoft says it is partnering with Anthropic and other industry players to apply leading AI models, along with its platforms and expertise, to convert AI-driven threat discovery into scalable protection.

security: Detection strategies across cloud and identities against infiltrating IT workers

Microsoft Security Blog

2026-04-21

Microsoft Security published a post on detection strategies for infiltrating IT workers in cloud and identity environments. It frames the topic around increased remote hiring, digital onboarding, and reliance on online identity verification and remote access.

security: Making opportunistic cyberattacks harder by design

Microsoft Security Blog

2026-04-20

Microsoft describes changes to Dynamics 365 and Power Platform aimed at reducing opportunistic attacks by removing credentials, shrinking attack surfaces, and applying platform engineering controls. The post focuses on design choices that make common attack paths harder to exploit.

security: Cross‑tenant helpdesk impersonation to data exfiltration: A human-operated intrusion playbook

Microsoft Security Blog

2026-04-18

Microsoft describes a human-operated intrusion pattern that uses external Microsoft Teams collaboration to impersonate IT helpdesk staff, persuade users to grant remote access, then abuse legitimate tools and admin protocols for lateral movement and data exfiltration. Microsoft Defender can detect related activity across Teams, endpoint, and identity telemetry.

security: Containing a domain compromise: How predictive shielding shut down lateral movement

Microsoft Security Blog

2026-04-17

Microsoft describes a real-world domain compromise where exposure-based containment and predictive shielding were used to slow lateral movement, stop credential abuse, and interrupt the attacker’s progress.