Tag: microsoft

Dringend patchen: Attacken auf Microsoft Sharepoint beobachtet

Mar 19, 2026 1:10 PM

Tags: microsoft

Microsoft hält die Ausnutzung einer kritischen Sharepoint-Lücke für weniger wahrscheinlich. Angreifern ist das offenkundig egal. First seen on golem.de Jump to article: www.golem.de/news/dringend-patchen-attacken-auf-microsoft-sharepoint-beobachtet-2603-206691.html
Dringend patchen: Attacken auf Microsoft Sharepoint beobachtet

Mar 19, 2026 1:10 PM

Tags: microsoft

Microsoft hält die Ausnutzung einer kritischen Sharepoint-Lücke für weniger wahrscheinlich. Angreifern ist das offenkundig egal. First seen on golem.de Jump to article: www.golem.de/news/dringend-patchen-attacken-auf-microsoft-sharepoint-beobachtet-2603-206691.html
Golem Karrierewelt: Heute im Livestream: SMTP BasicAuth vor dem Aus

Mar 19, 2026 1:10 PM

Tags: microsoft

Microsoft plant, SMTP BasicAuth bei Exchange Online abzuschalten. Frank Carius zeigt im Gespräch mit Podcast-Host Aaron Siller Umstiegspfade auf. First seen on golem.de Jump to article: www.golem.de/news/golem-karrierewelt-heute-im-livestream-smtp-basicauth-vor-dem-aus-2603-206682.html
CISA warns of active exploitation of Microsoft SharePoint vulnerability (CVE-2026-20963)

Mar 19, 2026 1:10 PM

Tags: cisa, cve, exploit, microsoft, remote-code-execution, vulnerability

CVE-2026-20963, a remote code execution (RCE) SharePoint vulnerability Microsoft fixed in January 2026, is being exploited by attackers. The confirmation comes from the US … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/03/19/sharepoint-vulnerability-cve-2026-20963-exploited/
CISA urges US orgs to secure Microsoft Intune systems after Stryker breach

Mar 19, 2026 1:10 PM

Tags: breach, cisa, cyberattack, endpoint, exploit, microsoft, technology, tool

CISA warned U.S. organizations to follow Microsoft guidance to strengthen the Intune endpoint management tool after a cyberattack exploited it to wipe medical technology giant Stryker’s systems. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/cisa-warns-businesses-to-secure-microsoft-intune-systems-after-stryker-breach/
Critical Microsoft SharePoint flaw now exploited in attacks

Mar 19, 2026 12:10 PM

Tags: attack, cybersecurity, exploit, flaw, infrastructure, microsoft, vulnerability

A critical Microsoft SharePoint vulnerability patched in January is now being exploited in attacks, the Cybersecurity and Infrastructure Security Agency (CISA) warned. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/microsoft/critical-microsoft-sharepoint-flaw-now-exploited-in-attacks/
Angreifer nutzen Microsoft Teams und Quick Assist als Einfallstor für Angriffe

Mar 19, 2026 12:10 PM

Tags: cyberattack, microsoft, risk

Unternehmen, die diese Maßnahmen konsequent umsetzen, können ihr Risiko deutlich reduzieren und ihre Sicherheitsstrategie nachhaltig verbessern. First seen on infopoint-security.de Jump to article: www.infopoint-security.de/angreifer-nutzen-microsoft-teams-und-quick-assist-als-einfallstor-fuer-angriffe/a44189/
Angreifer nutzen Microsoft Teams und Quick Assist als Einfallstor für Angriffe

Mar 19, 2026 12:10 PM

Tags: cyberattack, microsoft, risk

Unternehmen, die diese Maßnahmen konsequent umsetzen, können ihr Risiko deutlich reduzieren und ihre Sicherheitsstrategie nachhaltig verbessern. First seen on infopoint-security.de Jump to article: www.infopoint-security.de/angreifer-nutzen-microsoft-teams-und-quick-assist-als-einfallstor-fuer-angriffe/a44189/
Angreifer nutzen Microsoft Teams und Quick Assist als Einfallstor für Angriffe

Mar 19, 2026 12:10 PM

Tags: cyberattack, microsoft, risk

Unternehmen, die diese Maßnahmen konsequent umsetzen, können ihr Risiko deutlich reduzieren und ihre Sicherheitsstrategie nachhaltig verbessern. First seen on infopoint-security.de Jump to article: www.infopoint-security.de/angreifer-nutzen-microsoft-teams-und-quick-assist-als-einfallstor-fuer-angriffe/a44189/
Angreifer nutzen Microsoft Teams und Quick Assist als Einfallstor für Angriffe

Mar 19, 2026 12:10 PM

Tags: cyberattack, microsoft, risk

Unternehmen, die diese Maßnahmen konsequent umsetzen, können ihr Risiko deutlich reduzieren und ihre Sicherheitsstrategie nachhaltig verbessern. First seen on infopoint-security.de Jump to article: www.infopoint-security.de/angreifer-nutzen-microsoft-teams-und-quick-assist-als-einfallstor-fuer-angriffe/a44189/
Your MFA isn’t broken, it’s being bypassed, and your employees can’t tell the difference

Mar 19, 2026 11:09 AM

Tags: access, attack, authentication, awareness, breach, credentials, cryptography, defense, detection, email, fido, finance, google, Hardware, identity, jobs, linkedin, login, malicious, mfa, microsoft, monitoring, passkey, password, phishing, service, theft, threat, vulnerability

Three failures that keep showing up: Through my research into adversary-in-the-middle attacks and reviewing industry incident reports, I have identified three consistent failures that make these attacks successful. 1. We trained our people for the wrong threat Most security awareness programs still teach the same things: Look for misspellings, check the sender address, hover over…
Your MFA isn’t broken, it’s being bypassed, and your employees can’t tell the difference

Mar 19, 2026 11:09 AM

Tags: access, attack, authentication, awareness, breach, credentials, cryptography, defense, detection, email, fido, finance, google, Hardware, identity, jobs, linkedin, login, malicious, mfa, microsoft, monitoring, passkey, password, phishing, service, theft, threat, vulnerability

Three failures that keep showing up: Through my research into adversary-in-the-middle attacks and reviewing industry incident reports, I have identified three consistent failures that make these attacks successful. 1. We trained our people for the wrong threat Most security awareness programs still teach the same things: Look for misspellings, check the sender address, hover over…
Sicherheitstheater: Microsoft erhält FedRAMP-Zulassung trotz massiver Mängel

Mar 19, 2026 9:10 AM

Tags: fedramp, microsoft

Interne Berichte und Experten kritisieren die Zertifizierung von Microsofts-Cloudlösung GCC High für US-Behörden scharf. First seen on golem.de Jump to article: www.golem.de/news/sicherheitstheater-microsoft-erhaelt-fedramp-zulassung-trotz-massiver-maengel-2603-206672.html
CISA Warns of Zimbra, SharePoint Flaw Exploits; Cisco Zero-Day Hit in Ransomware Attacks

Mar 19, 2026 8:10 AM

Tags: attack, cisa, cisco, cve, cybersecurity, exploit, flaw, government, infrastructure, microsoft, office, ransomware, vulnerability, zero-day

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has urged government agencies to apply patches for two security flaws impacting Synacor Zimbra Collaboration Suite (ZCS) and Microsoft Office SharePoint, stating they have been actively exploited in the wild.The vulnerabilities in question are as follows -CVE-2025-66376 (CVSS score: 7.2) – A stored cross-site scripting First seen…
Outband getting out of hand as Microsoft pushes hotpatch for Bluetooth

Mar 19, 2026 7:10 AM

Tags: microsoft, windows

Second emergency fix in days targets Windows 11 24H2 and 25H2 First seen on theregister.com Jump to article: www.theregister.com/2026/03/17/microsoft_bluetooth_hotpatch/
U.S. CISA adds Microsoft SharePoint and Zimbra flaws to its Known Exploited Vulnerabilities catalog

Mar 18, 2026 11:10 PM

Tags: cisa, cybersecurity, exploit, flaw, infrastructure, kev, microsoft, vulnerability

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds SharePoint and Zimbra flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added ([1, 2]) SharePoint and Zimbra flaws to its Known Exploited Vulnerabilities (KEV) catalog. Below are the flaws added to the catalog: The first vulnerability added to the catalog, tracked…
ClickFix treibt neue Infostealer-Kampagnen an

Mar 18, 2026 11:11 AM

Tags: api, captcha, control, cyberattack, encryption, exploit, framework, github, infrastructure, intelligence, lazarus, login, malware, microsoft, powershell, rat, social-engineering, threat, windows, wordpress

ClickFix-Kampagnen werden immer raffinierter und zielen verstärkt auf WordPress-Webseiten.Cyberkriminelle kombinieren kompromittierte Websites mit immer raffinierteren Social-Engineering-Köder-Methoden, um neue Infostealer-Malware zu verbreiten. Bekannt ist das Ganze unter dem Namen ClickFix und zudem effektiv: In einer einzigen Kampagne wurden über 250 WordPress-Websites in zwölf Ländern infiziert.Während diese Kampagne zu unauffälligen, im Arbeitsspeicher ausgeführten Schadprogrammen führt, beobachtete Microsoft…
Big tech companies step in to support the open source security ecosystem

Mar 18, 2026 11:11 AM

Tags: github, google, linux, microsoft, open-source, openai

The Linux Foundation announced $12.5 million in grant funding backed by Anthropic, AWS, GitHub, Google, Google DeepMind, Microsoft, and OpenAI to strengthen open source … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/03/18/linux-foundation-open-source-security-12-5-million-funding/
Software-Rollout: Microsoft stoppt automatische Copilot-Installation

Mar 18, 2026 10:09 AM

Tags: microsoft, software

Nach Datenschutzkritik und Kurskorrekturen setzt Microsoft die automatische Verteilung der Copilot-App für Microsoft-365-Nutzer vorerst aus. First seen on golem.de Jump to article: www.golem.de/news/software-rollout-microsoft-stoppt-automatische-copilot-installation-2603-206628.html
Microsoft Teams-Based Vishing Attack Tricks Victims Into Quick Assist Takeover

Mar 18, 2026 10:09 AM

Tags: attack, breach, corporate, cyber, cyberattack, detection, identity, microsoft, phishing, social-engineering, software, threat, vulnerability

Threat actors are increasingly relying on social engineering rather than complex software vulnerabilities to breach corporate networks. In November 2025, Microsoft’s Detection and Response Team (DART) investigated a notable identity-first intrusion where attackers successfully used Microsoft Teams voice phishing (vishing) to compromise a corporate device via Quick Assist. This incident, detailed in Microsoft’s latest Cyberattack…
Researchers Disclose ‘RegPwn,’ a Windows Registry Weakness Allowing SYSTEM Access

Mar 18, 2026 8:09 AM

Tags: access, cve, cyber, exploit, flaw, microsoft, vulnerability, windows

Researchers at MDSec have disclosed a newly patched Elevation of Privilege vulnerability in Microsoft Windows, known as >>RegPwn<<. Tracked as CVE-2026-24291, this flaw allows a low-privileged user to gain full SYSTEM access by exploiting how Windows handles registry configurations for its built-in Accessibility features."‹ Windows Accessibility features, such as the On-Screen Keyboard and Narrator, run…
FAQ on CVE-2026-21514: OLE bypass N-Day in Microsoft Word

Mar 18, 2026 5:10 AM

Tags: access, ai, apt, attack, awareness, backdoor, cctv, cisa, cloud, control, cve, cyber, cyberattack, data, data-breach, detection, email, endpoint, exploit, flaw, fortinet, google, government, group, healthcare, identity, infrastructure, intelligence, Internet, iran, kev, malicious, malware, microsoft, mitigation, network, office, phishing, remote-code-execution, risk, technology, theft, threat, training, unauthorized, update, vulnerability, windows, zero-day

An N-day vulnerability in Microsoft Word exposes nearly 14 million assets. Attackers can exploit this flaw to bypass security prompts, enabling deployment of malware and establishing persistent access without triggering user warnings. Key takeaways: CVE-2026-21514 is a Microsoft Word n-day that bypasses OLE and Mark-of-the-Web protections, executing payloads silently without triggering user security prompts Tenable’s…
FAQ on CVE-2026-21514: OLE bypass N-Day in Microsoft Word

Mar 18, 2026 5:10 AM

Tags: access, ai, apt, attack, awareness, backdoor, cctv, cisa, cloud, control, cve, cyber, cyberattack, data, data-breach, detection, email, endpoint, exploit, flaw, fortinet, google, government, group, healthcare, identity, infrastructure, intelligence, Internet, iran, kev, malicious, malware, microsoft, mitigation, network, office, phishing, remote-code-execution, risk, technology, theft, threat, training, unauthorized, update, vulnerability, windows, zero-day

An N-day vulnerability in Microsoft Word exposes nearly 14 million assets. Attackers can exploit this flaw to bypass security prompts, enabling deployment of malware and establishing persistent access without triggering user warnings. Key takeaways: CVE-2026-21514 is a Microsoft Word n-day that bypasses OLE and Mark-of-the-Web protections, executing payloads silently without triggering user security prompts Tenable’s…
Operation Epic Fury: Why exposure data changes everything about Iran’s cyber-kinetic campaign

Mar 18, 2026 5:10 AM

Tags: access, ai, api, apt, attack, backdoor, breach, cctv, cisa, cloud, country, cve, cvss, cyber, cybersecurity, data, data-breach, ddos, detection, dns, espionage, exploit, firewall, flaw, fortinet, government, group, healthcare, identity, infrastructure, intelligence, Internet, iot, iran, kev, malware, microsoft, military, network, office, phishing, radius, remote-code-execution, risk, strategy, supply-chain, technology, threat, unauthorized, update, vpn, vulnerability, warfare, windows

Iran’s retaliatory campaign following Operation Epic Fury has collapsed the boundary between physical and digital warfare. Tenable’s exposure data analysis across seven target countries reveals that the largest exploitable attack surface isn’t the headline threat, it’s a Microsoft Word N-day affecting nearly 14 million assets. Key takeaways: Exposure data rebalances the threat picture. A Microsoft…
Operation Epic Fury: Why exposure data changes everything about Iran’s cyber-kinetic campaign

Mar 18, 2026 5:10 AM

Tags: access, ai, api, apt, attack, backdoor, breach, cctv, cisa, cloud, country, cve, cvss, cyber, cybersecurity, data, data-breach, ddos, detection, dns, espionage, exploit, firewall, flaw, fortinet, government, group, healthcare, identity, infrastructure, intelligence, Internet, iot, iran, kev, malware, microsoft, military, network, office, phishing, radius, remote-code-execution, risk, strategy, supply-chain, technology, threat, unauthorized, update, vpn, vulnerability, warfare, windows

Iran’s retaliatory campaign following Operation Epic Fury has collapsed the boundary between physical and digital warfare. Tenable’s exposure data analysis across seven target countries reveals that the largest exploitable attack surface isn’t the headline threat, it’s a Microsoft Word N-day affecting nearly 14 million assets. Key takeaways: Exposure data rebalances the threat picture. A Microsoft…
Researchers Uncover New Phishing Risk Hidden Inside Microsoft Copilot

Mar 17, 2026 11:10 PM

Tags: ai, attack, injection, microsoft, phishing, risk

Researchers reveal how Microsoft Copilot can be manipulated by prompt injection attacks to generate convincing phishing messages inside trusted AI summaries. The post Researchers Uncover New Phishing Risk Hidden Inside Microsoft Copilot appeared first on TechRepublic. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/news-microsoft-copilot-prompt-injection-phishing-risk/
Storm-2561 Uses Fake Fortinet, Ivanti VPN Sites to Drop Hyrax Infostealer

Mar 17, 2026 10:10 PM

Tags: cybercrime, fortinet, ivanti, microsoft, vpn

In mid-January 2026, Microsoft Defender Experts identified a devious way that cybercriminals are tricking people into giving away… First seen on hackread.com Jump to article: hackread.com/storm-2561-fake-fortinet-ivanti-vpn-sites-hyrax-infostealer/
Microsoft Confirms Windows 11 Bug Crippling PCs, Blocking Access to Core Drive

Mar 17, 2026 5:10 PM

Tags: access, microsoft, windows

Microsoft says a Windows 11 issue tied to Samsung Galaxy Connect can block access to the C: drive and prevent key apps from opening. The post Microsoft Confirms Windows 11 Bug Crippling PCs, Blocking Access to Core Drive appeared first on TechRepublic. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/news-windows-11-bug-c-drive-access-denied-samsung-fix/
Microsoft stops force-installing the Microsoft 365 Copilot app

Mar 17, 2026 4:10 PM

Tags: microsoft, windows

Microsoft has stopped automatically installing the Microsoft 365 Copilot app on Windows devices outside the European Economic Area (EEA) that have the Microsoft 365 desktop client apps. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/microsoft/microsoft-stops-force-installing-the-microsoft-365-copilot-app/
Risiken durch Copilot mindern: Analyst schlägt KI-Verbot am Freitagnachmittag vor

Mar 17, 2026 3:10 PM

Tags: ai, gartner, microsoft, risk

In einem Vortrag erörtert ein Gartner-Analyst fünf Risiken beim Einsatz von Microsoft 365 Copilot und zeigt Wege, diese zu vermeiden. First seen on golem.de Jump to article: www.golem.de/news/risiken-durch-copilot-mindern-analyst-schlaegt-ki-verbot-am-freitagnachmittag-vor-2603-206601.html