Microsoft - 2

2026 (12)

April (10)

security: Making opportunistic cyberattacks harder by design

Microsoft Security Blog

2026-04-20

Microsoft describes changes to Dynamics 365 and Power Platform aimed at reducing opportunistic attacks by removing credentials, shrinking attack surfaces, and applying platform engineering controls. The post focuses on design choices that make common attack paths harder to exploit.

security: Cross‑tenant helpdesk impersonation to data exfiltration: A human-operated intrusion playbook

Microsoft Security Blog

2026-04-18

Microsoft describes a human-operated intrusion pattern that uses external Microsoft Teams collaboration to impersonate IT helpdesk staff, persuade users to grant remote access, then abuse legitimate tools and admin protocols for lateral movement and data exfiltration. Microsoft Defender can detect related activity across Teams, endpoint, and identity telemetry.

security: Incident response for AI: Same fire, different fuel

Microsoft Security Blog

2026-04-15

Microsoft published a blog post on incident response for AI, focusing on how existing IR practices still apply while AI-specific telemetry, tools, and skills are needed. It frames AI incidents as similar to traditional response work but with different signals and operational needs.

ai: Foundry Local is now Generally Available

Microsoft AI Foundry Blog

2026-04-09

Microsoft says Foundry Local is now generally available for running AI inference on-device. The announcement emphasizes local deployment, privacy, and no per-token costs.

security: Investigating Storm-2755: “Payroll pirate” attacks targeting Canadian employees

Microsoft Security Blog

2026-04-09

Microsoft reports on Storm-2755, a financially motivated threat actor targeting Canadian employee accounts to access profile data and redirect salary payments to attacker-controlled accounts. The post is based on observations from Microsoft Incident Response – Detection and Response Team (DART).

security: SOHO router compromise leads to DNS hijacking and adversary-in-the-middle attacks

Microsoft Security Blog

2026-04-07

Microsoft says Forest Blizzard, a threat actor linked to the Russian military, is compromising insecure home and small-office routers and changing their settings to support malicious infrastructure. The activity includes DNS hijacking and adversary-in-the-middle attacks.

security: Inside an AI‑enabled device code phishing campaign

Microsoft Security Blog

2026-04-06

Microsoft describes a new device code phishing campaign that uses AI and end-to-end automation to generate live authentication codes on demand. The result is more scalable account compromise, higher success rates, and longer post-compromise access.

security: Threat actor abuse of AI accelerates from tool to cyberattack surface

Microsoft Security Blog

2026-04-02

Microsoft says threat actors are increasingly using generative AI to improve cyberattacks, including much higher phishing click-through rates and industrialized MFA bypass. The post frames AI as part of the attack surface, not just a tool attackers use.

security: Mitigating the Axios npm supply chain compromise

Microsoft Security Blog

2026-04-01

Microsoft reports that Axios was compromised in a March 31, 2026 npm supply chain attack. Two newly published version-update packages were used to download from command-and-control infrastructure, which Microsoft Threat Intelligence attributes to the North Korean actor Sapphire Sleet.

azure: Retirement: Select Azure AI Language Features

Azure Updates

2026-04-01

Microsoft will retire eight Azure AI Language features on March 20, 2027. The notice lists Key Phrase Extraction, Sentiment Analysis and Opinion Mining, Custom Text Classification, Conversational Language Understanding (CLU), Custom Question Answering (CQA), and other related language features.

March (2)

security: Addressing the OWASP Top 10 Risks in Agentic AI with Microsoft Copilot Studio

Microsoft Security Blog

2026-03-30

Microsoft published a security blog post mapping OWASP’s Top 10 risks for agentic applications to mitigations in Microsoft Copilot Studio. The article frames agentic AI as introducing new security risks and presents Copilot Studio as a way to address them.

security: CTI-REALM: A new benchmark for end-to-end detection rule generation with AI agents

Microsoft Security Blog

2026-03-20

Microsoft introduced CTI-REALM, an open-source benchmark for evaluating AI agents on end-to-end detection engineering. It measures whether agents can turn cyber threat intelligence into validated detection rules.