Back to updates

Microsoft - 3

2026 (11)

September (8)

azure: Retirement: Azure IoT Central will be retired on September 20, 2029

Azure Updates

2026-09-29

Azure IoT Central will be retired on September 20, 2029. Microsoft says you can keep using it until then, but recommends starting transition planning early as Azure IoT evolves.

security: Star Blizzard refines phishing and malware delivery with the RedFlick technique

Microsoft Security Blog

2026-09-29

Microsoft says it has observed Russian state actor Star Blizzard since January 2026 using large-scale phishing, compromised website accounts, and a new malware delivery method it tracks as RedFlick. The update focuses on the actor’s improved detection evasion and delivery techniques.

security: Storm-3168: Agentic-driven cloud attacks using compromised service principals

Microsoft Security Blog

2026-09-25

Microsoft describes Azure attacks linked to Storm-3168 using compromised service principals, including reconnaissance, resource deletion, and credential access. The post links the activity to JADEPUFFER and includes defender guidance.

security: Beyond the ransomware: Tracking Storm-2570’s consistent tradecraft across deployments

Microsoft Security Blog

2026-09-24

Microsoft says Storm-2570 reuses the same post-compromise tools and techniques across multiple ransomware deployments, including Qilin, DragonForce, Anubis, and BERT. The post outlines guidance for defenders to detect and disrupt the activity before ransomware is deployed.

security: Unmasking EvilTokens: Getting to the root of device code phishing

Microsoft Security Blog

2026-09-22

Microsoft says EvilTokens emerged as a major phishing-as-a-service platform for device code phishing, using AI-assisted lures, automated infrastructure, and token theft. In collaboration with partners, Microsoft’s Digital Crimes Unit disrupted its infrastructure and operations.

security: Protecting organizations from AI-assisted executive impersonation and invoice fraud

Microsoft Security Blog

2026-09-10

Microsoft describes an AI-assisted business email compromise campaign that impersonated executives and used fake invoices to target finance teams for ACH payment fraud. The post focuses on the attack pattern and how organizations can protect against it.

commandline: PyRIT: Democratizing AI red teaming through open-source tooling

Microsoft Command Line Blog

2026-09-10

PyRIT is presented as an open-source Python tool for AI red teaming that lowers the barrier for subject matter experts to test generative AI systems. The article describes its evolution toward making red teaming more accessible across many domains.

security: Threat matrix: Mapping threats across cloud web applications

Microsoft Security Blog

2026-09-09

Microsoft introduced the Cloud Web Applications Threat Matrix, a MITRE ATT&CK-aligned framework for understanding and prioritizing threats against cloud-hosted web applications and serverless platforms. It is intended to help defenders map attacks and identify mitigations.

August (3)

commandline: Your agent’s guardrails have a bypass

Microsoft Command Line Blog

2026-08-27

Microsoft introduced Agent Hooks, an open, framework-neutral governance contract for agent systems. It includes conformance testing and is intended to make enforcement fail closed instead of failing open when controls crash.

security: When AI infrastructure becomes the target: Securing gateways and control points

Microsoft Security Blog

2026-08-26

Microsoft Threat Intelligence reports on attacks against exposed AI infrastructure, focusing on LiteLLM gateway exploitation and related credential theft, persistence, and cryptomining activity. The post highlights gateways and other control points as targets that need protection.

security: Microsoft named a Leader in the Frost Radar™: Cloud Workload Protection Platforms, 2026

Microsoft Security Blog

2026-08-19

Microsoft says it was named a visionary leader in Frost & Sullivan’s 2026 Frost Radar for Cloud Workload Protection Platforms, citing Microsoft Defender for Cloud’s unified runtime security. The post is a brief recognition announcement with no product changes described.