Tag: microsoft
-
Microsoft Copilot Ignored Sensitivity Labels, Processed Confidential Emails
A code bug blew past every security label in the book”¦ and exposed the fatal flaw in how we govern AI. The post Microsoft Copilot Ignored Sensitivity Labels, Processed Confidential Emails appeared first on TechRepublic. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/news-microsoft-copilot-bug-confidential-emails/
-
Inside Attacker’s Defensive Funnel: How Sneaky 2FA Cloaks Itself from Security Scanners Blog – Menlo Security
Learn how Menlo Security identified a massive Sneaky 2FA phishing campaign using 3.4K domains to bypass Microsoft 365 MFA and steal session cookies. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/02/inside-attackers-defensive-funnel-how-sneaky-2fa-cloaks-itself-from-security-scanners-blog-menlo-security/
-
Microsoft says bug in classic Outlook hides the mouse pointer
Microsoft is investigating a known issue that causes the mouse pointer to disappear in the classic Outlook desktop email client for some users. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/microsoft/microsoft-says-bug-in-classic-outlook-hides-the-mouse-pointer/
-
Künstliche Intelligenz wird zur neuen Befehls- und Kontrollschicht
Die Sicherheitsforscher von Check Point Research haben eine neue Forschungsanalyse veröffentlicht, die sich auf KI-Assistenten als verdeckte Befehls- und Kontrollkanäle und KI-gesteuerte Malware konzentriert. Ein Wendepunkt im modernen Cyber-Risiko mit Auswirkungen auf alle Branchen, die die Einführung von KI vorantreiben. KI-Assistenten wie Microsoft-Copilot und Grok unterstützen Webbrowsing- oder URL-Abruf-Funktionen. Sie können als verdeckte C2-Proxys missbraucht…
-
Phishing-Kampagne umgeht Multi-Faktor-Authentifizierung von Microsoft 365
KnowBe4 Threat Labs hat eine komplexe Phishing-Kampagne entdeckt, die auf US-amerikanische Unternehmen und Fachkräfte abzielt. Die Angriffe kompromittieren Microsoft-365-Konten (Outlook, Teams, Onedrive), indem sie den OAuth-2.0-Geräteautorisierungsfluss missbrauchen und dadurch selbst starke Passwörter und Multi-Faktor-Authentifizierung (MFA) überlisten. Das Opfer wird auf das legitime Microsoft-Portal ‘https://microsoft.com/devicelogin” weitergeleitet, um einen vom Angreifer bereitgestellten Gerätecode einzugeben. Durch die Eingabe…
-
VPN in Microsoft Edge ist kein VPN
Ein Forscher hat sich das von Microsoft beworbene VPN-Feature in Edge angeschaut. Es werde dem Begriff VPN nicht gerecht. First seen on golem.de Jump to article: www.golem.de/news/browser-vpn-in-microsoft-edge-ist-kein-vpn-2602-205720.html
-
TDL 016 – Speed, Risk, and Responsibility in the Age of AI – Rafael Ramirez
Tags: access, ai, antivirus, automation, awareness, business, ciso, cloud, control, country, cyber, data, defense, detection, dns, firewall, governance, government, hacker, ibm, incident response, intelligence, Internet, law, linkedin, login, mfa, microsoft, network, risk, saas, service, skills, software, startup, strategy, technology, threat, tool, training, update, vulnerability, windows, zero-trustSummary In a recent episode of The Defenders Log, host David Redekop sat down with cyber security expert Rafael Ramirez to navigate the rapidly shifting landscape of AI security. As we move deeper into 2026, the duo explored how artificial intelligence has evolved from simple chatbots into powerful, autonomous “agentic” systems. The Double-Edged Sword of…
-
UK AI alignment project gets OpenAI and Microsoft boost
Altogether, £27m is now available to fund the AI Security Institute’s work to collaborate on safe, secure artificial intelligence First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366639303/UK-AI-alignment-project-gets-OpenAI-and-Microsoft-boost
-
News brief: 6 Microsoft zero days and a warning from CISA
Check out the latest security news from the Informa TechTarget team. First seen on techtarget.com Jump to article: www.techtarget.com/searchsecurity/news/366639010/News-brief-6-Microsoft-zero-days-and-a-warning-from-CISA
-
Critical Security Issue Found in Windows Notepad
Microsoft patches CVE-2026-20841, a high-severity Windows Notepad flaw that could allow code execution via malicious Markdown files. The post Microsoft: Critical Security Issue Found in Windows Notepad appeared first on TechRepublic. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/critical-windows-notepad-flaw-february-2026/
-
‘God-Like’ Attack Machines: AI Agents Ignore Security Policies
Microsoft Copilot recently summarized and leaked user emails; but any AI agent will go above and beyond to complete assigned tasks, even breaking through their carefully designed guardrails. First seen on darkreading.com Jump to article: www.darkreading.com/application-security/ai-agents-ignore-security-policies
-
Dynamic Objects in Active Directory: The Stealthy Threat
Active Directory’s “dynamic objects” feature offers attackers a perfect evasion cloak. These objects automatically self-destruct without a trace, so they allow adversaries to bypass quotas, pollute access lists, and persist in the cloud, leaving forensic investigators with nothing to analyze. Key takeaways The threat: Dynamic objects self-delete without leaving any traces, or “tombstones” in AD…
-
Microsoft 365 Copilot Bug Circumvented DLP Controls
Microsoft confirmed a Copilot Chat bug that summarized confidential emails despite active DLP controls, raising AI governance concerns in Microsoft 365. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/threats/microsoft-365-copilot-bug-circumvented-dlp-controls/
-
Keeper Security Extends KeeperPAM
Keeper Security has expanded its Privileged Access Management (PAM) platform, KeeperPAM, with native support for Google Cloud Platform (GCP), enabling organisations to unify privileged access controls across Google Cloud, AWS and Microsoft Azure environments. The move addresses a growing security concern for enterprises operating in increasingly complex, multi-cloud infrastructures: unmanaged and overprivileged identities. Tackling Cloud…
-
10 Passwordless-Optionen für Unternehmen
Um Passwörter hinter sich zu lassen, gibt es bessere Lösungen. Wir zeigen Ihnen zehn. Passwörter sind seit Jahrzehnten der Authentifizierungsstandard für Computersysteme, obwohl sie sich immer wieder aufs Neue als anfällig für diverse Cyberangriffsformen erwiesen haben und kompromittierte Benutzerkonten auf regelmäßiger Basis zum Einfallstor für kriminelle Hacker werden. Ein Mittel für CISOs, um diesem Problem…
-
Your Most Dangerous User Is Not Human: How AI Agents and MCP Servers Broke the Internal API Walled Garden
Highlights The Perimeter is Porous: Modern Agentic AI and the Model Context Protocol (MCP) have effectively turned internal data centers inside out, making the “internal API” security model obsolete. The “Confused Deputy” Risk: Legitimate AI agents act as trusted internal entities but can be exploited to bypass Data Loss Prevention (DLP) policies, as seen in…
-
Microsoft Patches CVE-2026-26119 Privilege Escalation in Windows Admin Center
Microsoft has disclosed a now-patched security flaw in Windows Admin Center that could allow an attacker to escalate their privileges.Windows Admin Center is a locally deployed, browser-based management tool set that lets users manage their Windows Clients, Servers, and Clusters without the need for connecting to the cloud.The high-severity vulnerability, tracked as CVE-2026-26119, carries a…
-
Huntress, Microsoft Detail the Continued Popularity, Evolution of ClickFix Attacks
ClickFix, an attack technique used to trick victims into pasting or clicking on malicious commands, has rapidly become a favorite method of threat groups. Recent reports by Huntress, Microsoft, and Intego detail how quickly the ClickFix tactic is evolving. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/02/huntress-microsoft-detail-the-continued-popularity-evolution-of-clickfix-attacks/
-
Huntress, Microsoft Detail the Continued Popularity, Evolution of ClickFix Attacks
ClickFix, an attack technique used to trick victims into pasting or clicking on malicious commands, has rapidly become a favorite method of threat groups. Recent reports by Huntress, Microsoft, and Intego detail how quickly the ClickFix tactic is evolving. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/02/huntress-microsoft-detail-the-continued-popularity-evolution-of-clickfix-attacks/
-
Microsoft reveals critical Windows Admin Center vulnerability (CVE-2026-26119)
Microsoft has disclosed a privilege-escalation vulnerability in Windows Admin Center (WAC), a browser-based platform widely used by IT administrators and infrastructure teams … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/02/19/windows-admin-center-cve-2026-26119/
-
Malvertising gegen Mac-Nutzer über Evernote-Links
Beliebte Software und Tools bleiben wirksame Lockvogel-Angebote im Dienste von Cyberkriminellen. Aktuell nutzen sie Google-Anzeigen für Mac-Nutzer mit Interesse an Anwendungen wie Microsoft-Office, Libre-Office, Notepad++, 7-Zip, VLC oder Final-Cut-Pro. Die Täter leiten ihre Opfer auf in Evernote geteilte Seiten mit bösartigen Links. Nach Klick auf die Links mit den vermeintlichen Angeboten führen die Opfer Kommandos…
-
Malvertising gegen Mac-Nutzer über Evernote-Links
Beliebte Software und Tools bleiben wirksame Lockvogel-Angebote im Dienste von Cyberkriminellen. Aktuell nutzen sie Google-Anzeigen für Mac-Nutzer mit Interesse an Anwendungen wie Microsoft-Office, Libre-Office, Notepad++, 7-Zip, VLC oder Final-Cut-Pro. Die Täter leiten ihre Opfer auf in Evernote geteilte Seiten mit bösartigen Links. Nach Klick auf die Links mit den vermeintlichen Angeboten führen die Opfer Kommandos…
-
Fehlerhafte Exchange-Regeln verschoben E-Mails in Quarantäne
Diverse URLs in E-Mails wurden als Bedrohung eingestuft. Dabei waren sie legitim. Ein Fix dauerte länger als geplant. First seen on golem.de Jump to article: www.golem.de/news/microsoft-fehlerhafte-exchange-regeln-verschoben-e-mails-in-quarantaene-2602-205609.html
-
Flaws in Google and Microsoft products added to Cisa catalogue
Cisa has added six CVEs to its Kev catalogue this week, including newly disclosed issues in Google Chromium and Dell RecoverPoint for Virtual Machines, and some older flaws as well First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366639264/Flaws-in-Google-Microsoft-products-added-to-Cisa-catalogue
-
Hackers target Microsoft Entra accounts in device code vishing attacks
Threat actors are targeting technology, manufacturing, and financial organizations in campaigns that combine device code phishing and voice phishing (vishing) to abuse the OAuth 2.0 Device Authorization flow and compromise Microsoft Entra accounts. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/hackers-target-microsoft-entra-accounts-in-device-code-vishing-attacks/
-
Flaws in Popular Software Development App Extensions Allow Data Exfiltration
Four serious new vulnerabilities affect Microsoft Visual Studio Code, Cursor and Windsurf extensions, three of which remain unpatched First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/vulnerabilities-vs-code-cursor/
-
Microsoft Defender Introduces Centralized Script Library Powered by Copilot for Live Response
Microsoft has unveiled a significant enhancement to its Defender platform: centralized library management for live response operations, powered by Microsoft Security Copilot. This new capability addresses a critical workflow limitation that previously required security analysts to upload scripts and tools during active investigation sessions. The library management feature transforms how Security Operations Center (SOC) teams…
-
Microsoft signals breakthrough in data storage that can last for generations
Microsoft announced progress on Project Silica, its research initiative focused on developing durable, long-term quartz glass-based data storage technology. Close up of Writer … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/02/19/microsoft-project-silica-data-storage-technology/