Tag: microsoft
-
Android-Apps: Codepanne bei Microsoft gefährdet Daten unzähliger Nutzer
Microsoft hat in mehreren seiner Android-Apps versäumt, ein Debugging-Flag zurückzusetzen. Angreifer konnten dadurch Nutzerkonten kapern. First seen on golem.de Jump to article: www.golem.de/news/android-apps-codepanne-bei-microsoft-gefaehrdet-daten-unzaehliger-nutzer-2606-209407.html
-
Stock Exchange Executive’s Outlook Targeted in Credential Theft Attack
A prolonged and highly targeted espionage campaign has been uncovered involving the compromise of a senior executive’s Microsoft Outlook account at a major global stock exchange, highlighting the strategic value of executive-level email access in modern cyber operations. The activity, which persisted for approximately five months between October 2025 and March 2026, demonstrates a disciplined…
-
Nur ein Client nötig: HTTP/2 Bomb legt Webserver in Sekunden lahm
Bei gängigen Webservern wie Nginx, Apache HTTPD und Microsoft IIS lässt sich mit wenig Aufwand innerhalb von Sekunden der Speicher fluten. First seen on golem.de Jump to article: www.golem.de/news/nur-ein-client-noetig-http-2-bomb-legt-webserver-in-sekunden-lahm-2606-209396.html
-
Researcher Drops a New VS Code Zero-Day After Losing Trust in Microsoft’s Disclosure Process
A researcher publicly released a VS Code exploit within hours, citing past disputes with Microsoft over bug handling. The security researcher Ammar Askar found a new serious zero-day in Visual Studio Code, told a contact at GitHub about it, and published a working exploit one hour later. >>Just by clicking a link, it’s possible for…
-
Kali365 PhaaS Expands to Okta, MAX Messenger Attacks
Tags: attack, cyber, infrastructure, intelligence, microsoft, monitoring, okta, phishing, russia, service, theft, threatThe Kali365 phishing-as-a-service (PhaaS) platform has significantly expanded its operational scope, moving beyond Microsoft 365 token theft to target Okta single sign-on (SSO) environments and Russia’s rapidly growing MAX Messenger platform. New threat intelligence reveals a more mature, multi-brand phishing ecosystem with centralized infrastructure, real-time token monitoring, and geographically targeted campaigns. Previously documented for abusing…
-
Microsoft Introduces Always-On AI Agent Scout for Teams, Outlook, and More
Microsoft has introduced an always-on AI agent named “Scout,” marking the debut of a new category of enterprise automation called “Autopilots.” Announced on June 2, Microsoft Scout is designed to operate continuously across Microsoft 365 services such as Teams, Outlook, OneDrive, and SharePoint, shifting AI from reactive assistants to proactive systems that execute tasks autonomously…
-
Microsoft Introduces Always-On AI Agent Scout for Teams, Outlook, and More
Microsoft has introduced an always-on AI agent named “Scout,” marking the debut of a new category of enterprise automation called “Autopilots.” Announced on June 2, Microsoft Scout is designed to operate continuously across Microsoft 365 services such as Teams, Outlook, OneDrive, and SharePoint, shifting AI from reactive assistants to proactive systems that execute tasks autonomously…
-
Microsoft Introduces Always-On AI Agent Scout for Teams, Outlook, and More
Microsoft has introduced an always-on AI agent named “Scout,” marking the debut of a new category of enterprise automation called “Autopilots.” Announced on June 2, Microsoft Scout is designed to operate continuously across Microsoft 365 services such as Teams, Outlook, OneDrive, and SharePoint, shifting AI from reactive assistants to proactive systems that execute tasks autonomously…
-
Microsoft Edge retires master password feature, adopts passkeys and biometrics
First seen on scworld.com Jump to article: www.scworld.com/brief/microsoft-edge-retires-master-password-feature-adopts-passkeys-and-biometrics
-
Mayo Clinic, Microsoft Team Up on AI for Doctors, Patients
Healthcare Sector AI Expansion Raises Questions on Governance, Privacy and Safety. Mayo Clinic and Microsoft are planning a new healthcare-specific frontier artificial intelligence model that aims to help clinicians make earlier diagnoses and deliver more personalized treatments to their patients. The clinic plans to make the new model available to patients and doctors. First seen…
-
Microsoft Tests Wearable AI Badge for Office Workers
Microsoft showed Project Solara concept devices at Build 2026, including a wearable AI badge for office workers using AI agents. The post Microsoft Tests Wearable AI Badge for Office Workers appeared first on TechRepublic. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/news-microsoft-wearable-ai-badge-office-workers/
-
Microsoft 365 Android Apps Let Any App Steal Account Tokens via Leftover Debug Flag
A development flag left switched on in production builds of several Microsoft 365 Android apps disabled the check that limits account-token sharing to trusted Microsoft apps.Any other app on the same phone could ask for the signed-in user’s token and get it, then read email, open files, browse the calendar, and send messages as that…
-
Coding Gaffe Exposes Microsoft 365 Accounts to Widespread Takeover
A disabled security setting meant to protect authentication across Android versions of key apps like Word, PowerPoint, and Excel paved the way for attackers to steal logins and data. First seen on darkreading.com Jump to article: www.darkreading.com/application-security/coding-gaffe-exposes-microsoft-365-accounts-takeover
-
Microsoft responds to security challenges facing code, AI agents, and models
Microsoft has introduced a series of security tools and capabilities focused on AI-driven vulnerability discovery, AI agents, and AI models. The updates include a multi-agent … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/06/03/microsoft-ai-agent-security-capabilities/
-
Geplatzer Milliarden-Deal – Bayern testet Alternativen zu Microsoft
Tags: microsoftFirst seen on security-insider.de Jump to article: www.security-insider.de/bayern-testet-software-alternativen-zu-microsoft-in-behoerden-a-cfb6306f1fc3d9d5a462adcfc2312625/
-
Proofpoint Ramping Up Big MSP Growth Push In North America: Exec
Proofpoint’s launch of a business unit and Microsoft 365 security platform focused on meeting the needs of MSPs and their SMB customers marks a major advancement for the managed service provider market, according to an MSP executive. First seen on crn.com Jump to article: www.crn.com/news/security/2026/proofpoint-ramping-up-big-msp-growth-push-in-north-america-exec
-
One-Click GitHub Dev Attack Lets Attackers Steal Full GitHub OAuth Tokens
Cybersecurity researchers have disclosed a one-click attack via Microsoft Visual Studio Code (VS Code) that makes it possible to steal a user’s GitHub token.”Just by clicking a link, it’s possible for an attacker to steal a GitHub token that can read and write to your repos, including private ones,” security researcher Ammar Askar said.GitHub supports…
-
Expiring Microsoft Secure Boot Keys May Block DBX Updates on Legacy Devices
Expiring Microsoft Secure Boot keys will not brick unmigrated systems on June 27, 2026. However, they will silently freeze DB/DBX updates and lock affected Windows and Linux fleets out of future boot”‘level protections. On June 27, 2026, the Microsoft Corporation KEK CA 2011 used to authorize DB/DBX updates via Windows Update reaches its end of…
-
Expiring Microsoft Secure Boot Keys May Block DBX Updates on Legacy Devices
Expiring Microsoft Secure Boot keys will not brick unmigrated systems on June 27, 2026. However, they will silently freeze DB/DBX updates and lock affected Windows and Linux fleets out of future boot”‘level protections. On June 27, 2026, the Microsoft Corporation KEK CA 2011 used to authorize DB/DBX updates via Windows Update reaches its end of…
-
New HTTP/2 Bomb Vulnerability Allows Remote DoS on NGINX, Apache, IIS, Envoy & Cloudflare
Cybersecurity researchers have discovered a remote denial-of-service exploit that affects major web servers, including NGINX, Apache HTTPD, Microsoft IIS, Envoy, and Cloudflare Pingora.The vulnerability has been codenamed HTTP/2 Bomb by Calif.”The vulnerable behavior exists in each server’s default HTTP/2 configuration,” the company said, adding it was discovered by OpenAI Codex by chaining First seen on…
-
Kein Bock auf Microsoft: Forscher leakt Zero-Day-Exploit für Github-Datenklau
Microsoft hat neben Chaotic Eclipse offenbar noch einen weiteren Forscher verärgert. Der hat nun einen gefährlichen Github-Exploit veröffentlicht. First seen on golem.de Jump to article: www.golem.de/news/kein-bock-auf-microsoft-forscher-leakt-zero-day-exploit-fuer-github-datenklau-2606-209348.html
-
Microsoft Scout agent opens a new category of always-on Autopilots
Workplace AI assistants have mostly waited for a prompt before doing anything. A user asks, the tool answers, and the exchange ends there. Microsoft is putting a different … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/06/03/microsoft-scout-personal-agent/
-
HTTP/2 Bomb Remote DoS Exploit Impacts nginx, Apache, IIS, Envoy, and Cloudflare Pingora
A newly disclosed “HTTP/2 Bomb” attack is raising serious concerns across the web infrastructure ecosystem, enabling remote denial-of-service (DoS) conditions against widely deployed servers including nginx, Apache httpd, Microsoft IIS, Envoy, and Cloudflare Pingora. Overview of the HTTP/2 Bomb Attack Security researcher Quang Luong, working with the Codex team, uncovered a novel exploitation technique that…
-
Microsoft MSRC Allegedly Declines Action on Dependency Confusion Vulnerability
Microsoft is facing scrutiny after reportedly declining to treat a critical dependency confusion vulnerability affecting Azure Portal assets as a security issue, despite a proof-of-concept exploit demonstrating remote code execution (RCE). Security researcher Wahid Fayad identified the issue while analyzing JavaScript assets served via portal.azure.com. The investigation revealed an internal Node.js dependency, FxInternal/NetDiagnostics, that was not…
-
Microsoft denies legal action against researchers after slamming BlueHammer publisher
Tags: microsoftFirst seen on scworld.com Jump to article: www.scworld.com/news/microsoft-denies-legal-action-against-researchers-after-slamming-bluehammer-publisher
-
Microsoft resolves Windows 11 update installation errors
First seen on scworld.com Jump to article: www.scworld.com/brief/microsoft-resolves-windows-11-update-installation-errors
-
Microsoft’s Coreutils project brings Linux commands to Windows
Microsoft announced today at its Build 2026 developer conference the release of Coreutils for Windows, bringing many commonly used Linux command-line utilities to Windows as native applications. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/microsoft/microsofts-coreutils-project-brings-linux-commands-to-windows/
-
FBI-Flagged Phishing Kit Kali365 Expands Its Reach
Once targeting just Microsoft 365, the phishing-as-a-service platform now aims at AWS, Okta, and Russian platforms, while relying on device code phishing. First seen on darkreading.com Jump to article: www.darkreading.com/cyber-risk/fbi-flagged-phishing-kit-kali365-expands-its-reach
-
Microsoft’s Vasu Jakkal On Why AI Agents Need Human-Level Security Controls
Microsoft is doubling down on its efforts to uniquely provide comprehensive control for securing the adoption of AI agents with the expansion of its Agent 365 offering, top Microsoft security executive Vasu Jakkal tells CRN. First seen on crn.com Jump to article: www.crn.com/news/security/2026/microsoft-s-vasu-jakkal-on-why-ai-agents-need-human-level-security-controls
-
Microsoft’s Vasu Jakkal On Why AI Agents Need Human-Level Security Controls
Microsoft is doubling down on its efforts to uniquely provide comprehensive control for securing the adoption of AI agents with the expansion of its Agent 365 offering, top Microsoft security executive Vasu Jakkal tells CRN. First seen on crn.com Jump to article: www.crn.com/news/security/2026/microsoft-s-vasu-jakkal-on-why-ai-agents-need-human-level-security-controls