Back to updates

Security - 9

2025 (12)

October (7)

security: Investigating targeted “payroll pirate” attacks affecting US universities

Microsoft Security Blog

2025-10-09

Microsoft Threat Intelligence reports a financially motivated actor tracked as Storm-2657 conducting "payroll pirate" attacks against US universities by compromising employee accounts, accessing employee profiles, and diverting salary payments to attacker-controlled accounts.

security: Disrupting threats targeting Microsoft Teams

Microsoft Security Blog

2025-10-07

Microsoft highlights that threat actors are abusing Microsoft Teams features across the attack chain and urges defenders to proactively monitor, detect, and respond. The blog recommends layered countermeasures and optimal controls across identity, endpoints, data and app protection, and network controls to better protect enterprise Teams users.

security: New Microsoft Secure Future Initiative (SFI) patterns and practices: Practical guides to strengthen security

Microsoft Security Blog

2025-10-07

Microsoft’s Secure Future Initiative (SFI) patterns and practices provide practical, practitioner‑led guidance based on Microsoft’s Zero Trust implementation. The guides are designed to help organizations accelerate security maturity, reduce implementation friction, and build systems that are secure by design, by default, and in operation.

security: Inside Microsoft Threat Intelligence: Calm in the chaos

Microsoft Security Blog

2025-10-06

Microsoft’s Incident Response team works effectively amid the disorder caused by fast-moving threat actors, treating compromised environments, missing data, and shaken confidence as the starting point for investigations, as described in the Microsoft Security Blog post "Inside Microsoft Threat Intelligence: Calm in the chaos."

security: Investigating active exploitation of CVE-2025-10035 GoAnywhere Managed File Transfer vulnerability

Microsoft Security Blog

2025-10-06

Microsoft observed active exploitation of CVE-2025-10035, a deserialization vulnerability in the GoAnywhere Managed File Transfer (MFT) License Servlet, by the financially motivated actor Storm-1175 (associated with Medusa ransomware). The blog post raises awareness and describes end-to-end protection coverage in Microsoft Defender.

security: Microsoft named a Leader in the IDC MarketScape for XDR

Microsoft Security Blog

2025-10-02

Microsoft was named a Leader in IDC’s inaugural Worldwide Extended Detection and Response (XDR) Software MarketScape for 2025, recognized for its deep integration, intelligent automation, and unified security operations solutions, as reported on the Microsoft Security Blog.

security: Cybersecurity Awareness Month: Security starts with you

Microsoft Security Blog

2025-10-01

Microsoft highlights that cybersecurity is as much about people as technology in its Cybersecurity Awareness Month post, "Security starts with you." The blog directs readers to Microsoft’s resources and practical guidance to help individuals stay safe online and adopt safer habits.

September (5)

security: Empowering defenders in the era of agentic AI with Microsoft Sentinel

Microsoft Security Blog

2025-09-30

Microsoft Sentinel is expanding into an agentic security platform: the Sentinel data lake is generally available, and Sentinel graph plus the Sentinel Model Context Protocol (MCP) server are available in public preview to enable richer data, graph-based analysis, and model-aware agentic workflows for defenders.

security: Introducing Microsoft Marketplace — Thousands of solutions. Millions of customers. One Marketplace.

Microsoft Security Blog

2025-09-25

Microsoft announced the launch of the reimagined Microsoft Marketplace, a unified and trusted destination for cloud solutions, AI apps and agents designed to connect thousands of solutions with millions of customers and empower organizations to become 'Frontier'.

security: XCSSET evolves again: Analyzing the latest updates to XCSSET’s inventory

Microsoft Security Blog

2025-09-25

Microsoft Threat Intelligence has identified a new variant of the XCSSET malware that targets Xcode projects used by developers building Apple and macOS applications, detailed in a Microsoft Security Blog post.

security: Retail at risk: How one alert uncovered a persistent cyberthreat​​

Microsoft Security Blog

2025-09-24

Microsoft's Cyberattack Series examines a retail incident where a single security alert exposed a persistent cyberthreat. Attackers exploited unpatched SharePoint vulnerabilities and compromised identities to infiltrate networks, causing widespread operational risk—echoed by industry statistics (60% operational disruptions, 43% breaches). Microsoft’s Detection and Response Team (DART) provided forensic analysis and actionable remediation guidance; the full report offers detailed findings and defensive recommendations.

security: AI vs. AI: Detecting an AI-obfuscated phishing campaign

Microsoft Security Blog

2025-09-24

Microsoft Threat Intelligence detected and blocked a credential-phishing campaign that likely used AI-generated code to obfuscate its payload and evade traditional defenses, highlighting a trend of attackers leveraging AI and the need for defenders to anticipate and adapt to AI-driven threats.