Tag: microsoft
-
Microsoft tightens cloud login process to prevent common attack
Hackers have spent decades exploiting a ubiquitous type of vulnerability. Microsoft is trying to change that. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/microsoft-change-cloud-login-entra-id-xss/806556/
-
Microsoft tightens cloud login process to prevent common attack
Hackers have spent decades exploiting a ubiquitous type of vulnerability. Microsoft is trying to change that. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/microsoft-change-cloud-login-entra-id-xss/806556/
-
Microsoft Teams Flaw in Guest Chat Exposes Users to Malware Attacks
New research from Ontinue exposes a major security flaw in Microsoft Teams B2B Guest Access. Learn how attackers bypass all Defender for Office 365 protections with a single invite. First seen on hackread.com Jump to article: hackread.com/microsoft-teams-guest-chat-flaw-malware/
-
Microsoft Teams Flaw in Guest Chat Exposes Users to Malware Attacks
New research from Ontinue exposes a major security flaw in Microsoft Teams B2B Guest Access. Learn how attackers bypass all Defender for Office 365 protections with a single invite. First seen on hackread.com Jump to article: hackread.com/microsoft-teams-guest-chat-flaw-malware/
-
Microsoft Teams Flaw in Guest Chat Exposes Users to Malware Attacks
New research from Ontinue exposes a major security flaw in Microsoft Teams B2B Guest Access. Learn how attackers bypass all Defender for Office 365 protections with a single invite. First seen on hackread.com Jump to article: hackread.com/microsoft-teams-guest-chat-flaw-malware/
-
Security keys may prompt for PIN after recent updates
Microsoft warned users on Tuesday that FIDO2 security keys may prompt them to enter a PIN when signing in after installing Windows updates released since the September 2025 preview update. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/microsoft/microsoft-fido2-security-keys-may-prompt-for-pin-after-recent-windows-updates/
-
Unternehmen scheitern häufig an den verborgenen Risiken in Microsoft-365
Unternehmen schätzen ihre Cybersicherheitsreife häufig deutlich höher ein, als es die tatsächliche Situation rechtfertigt. Eine aktuelle Analyse von Coreview unter mehr als 250 IT- und Sicherheitsverantwortlichen aus Enterprise- und Midmarket-Organisationen zeigt: 60 Prozent der Unternehmen bewerten ihre Microsoft-365-Sicherheit als ‘etabliert” oder ‘fortgeschritten” doch ebenso viele erlebten bereits Kontoübernahmen. Diese Diskrepanz zwischen Selbstwahrnehmung und realem […]…
-
Unternehmen scheitern häufig an den verborgenen Risiken in Microsoft-365
Unternehmen schätzen ihre Cybersicherheitsreife häufig deutlich höher ein, als es die tatsächliche Situation rechtfertigt. Eine aktuelle Analyse von Coreview unter mehr als 250 IT- und Sicherheitsverantwortlichen aus Enterprise- und Midmarket-Organisationen zeigt: 60 Prozent der Unternehmen bewerten ihre Microsoft-365-Sicherheit als ‘etabliert” oder ‘fortgeschritten” doch ebenso viele erlebten bereits Kontoübernahmen. Diese Diskrepanz zwischen Selbstwahrnehmung und realem […]…
-
Microsoft to secure Entra ID sign-ins from script injection attacks
Starting in mid-to-late October 2026, Microsoft will enhance the security of the Entra ID authentication system against external script injection attacks. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/microsoft/microsoft-to-secure-entra-id-sign-ins-from-external-script-injection-attacks/
-
Microsoft to secure Entra ID sign-ins from script injection attacks
Starting in mid-to-late October 2026, Microsoft will enhance the security of the Entra ID authentication system against external script injection attacks. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/microsoft/microsoft-to-secure-entra-id-sign-ins-from-external-script-injection-attacks/
-
Microsoft to secure Entra ID sign-ins from script injection attacks
Starting in mid-to-late October 2026, Microsoft will enhance the security of the Entra ID authentication system against external script injection attacks. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/microsoft/microsoft-to-secure-entra-id-sign-ins-from-external-script-injection-attacks/
-
ToddyCat APT evolves to target Outlook archives and Microsoft 365 tokens
Outlook in the Crosshairs: Another evolution involves accessing actual mail data. ToddyCat deployed a tool named TCSectorCopya C++ utility that opens the disk as a read-only device and copies Outlook’s offline storage files (OST) sector by sector, bypassing any file-lock mechanisms that Outlook may enforce.Once OST files are extracted, they are fed into XstReader, an…
-
ToddyCat APT evolves to target Outlook archives and Microsoft 365 tokens
Outlook in the Crosshairs: Another evolution involves accessing actual mail data. ToddyCat deployed a tool named TCSectorCopya C++ utility that opens the disk as a read-only device and copies Outlook’s offline storage files (OST) sector by sector, bypassing any file-lock mechanisms that Outlook may enforce.Once OST files are extracted, they are fed into XstReader, an…
-
HashJack: A Novel Exploit Leveraging URL Fragments To Deceive AI Browsers
Security researchers at Cato CTRL have uncovered HashJack. This innovative indirect prompt-injection attack hides harmful commands in the fragment portion of URLs after the >>#
-
Microsoft Teams Rolls Out New Feature For Faster Startup and Better Performance
Microsoft Teams is set to launch a key update for its Windows desktop client, introducing a new child process, ms-teams_modulehost.exe, to boost the performance of calling features and reduce startup times. This change separates the calling stack from the primary ms-teams.exe process, allowing better resource management and smoother meetings without altering user interfaces or workflows.…
-
Microsoft Teams Rolls Out New Feature For Faster Startup and Better Performance
Microsoft Teams is set to launch a key update for its Windows desktop client, introducing a new child process, ms-teams_modulehost.exe, to boost the performance of calling features and reduce startup times. This change separates the calling stack from the primary ms-teams.exe process, allowing better resource management and smoother meetings without altering user interfaces or workflows.…
-
Exchange Online outage blocks access to Outlook mailboxes
Microsoft is investigating an Exchange Online service outage that is preventing customers from accessing their mailboxes using the classic Outlook desktop client. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/microsoft/microsoft-exchange-online-outage-blocks-access-to-outlook-mailboxes/
-
Microsoft is speeding up the Teams desktop client for Windows
Microsoft says it will add a new Teams call handler beginning in January 2026 to reduce launch times and boost call performance for the Windows desktop client. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/microsoft/microsoft-to-boost-teams-performance-with-new-call-handler/
-
Microsoft Warns of Security Risks in New Agentic AI Feature
Microsoft is sounding the alarm on critical security considerations as it introduces agentic AI capabilities to Windows through experimental features like Copilot Actions. The company is rolling out a new agent workspace feature in private preview that establishes isolated environments for AI agents to operate, but the tech giant is being transparent about the novel…
-
Microsoft Warns of Security Risks in New Agentic AI Feature
Microsoft is sounding the alarm on critical security considerations as it introduces agentic AI capabilities to Windows through experimental features like Copilot Actions. The company is rolling out a new agent workspace feature in private preview that establishes isolated environments for AI agents to operate, but the tech giant is being transparent about the novel…
-
ToddyCat’s New Hacking Tools Steal Outlook Emails and Microsoft 365 Access Tokens
The threat actor known as ToddyCat has been observed adopting new methods to obtain access to corporate email data belonging to target companies, including using a custom tool dubbed TCSectorCopy.”This attack allows them to obtain tokens for the OAuth 2.0 authorization protocol using the user’s browser, which can be used outside the perimeter of the…
-
ToddyCat’s New Hacking Tools Steal Outlook Emails and Microsoft 365 Access Tokens
The threat actor known as ToddyCat has been observed adopting new methods to obtain access to corporate email data belonging to target companies, including using a custom tool dubbed TCSectorCopy.”This attack allows them to obtain tokens for the OAuth 2.0 authorization protocol using the user’s browser, which can be used outside the perimeter of the…
-
Microsoft Warns of Security Risks in New Agentic AI Feature
Microsoft is sounding the alarm on critical security considerations as it introduces agentic AI capabilities to Windows through experimental features like Copilot Actions. The company is rolling out a new agent workspace feature in private preview that establishes isolated environments for AI agents to operate, but the tech giant is being transparent about the novel…
-
Microsoft cracks down on malicious meeting invites
Phishing is shifting into places people rarely check. Meeting invites that plant themselves on calendars can survive long after the malicious email is gone. That leaves a … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/11/25/enhance-microsoft-calendar-threat-protection/
-
Fluent Bit: Große Clouddienste durch Bugs in Open-Source-Tool gefährdet
Konzerne wie AWS, Microsoft und Google setzen Fluent Bit ein. Angreifer hätten deren Cloudsysteme durch Sicherheitslücken kapern können. First seen on golem.de Jump to article: www.golem.de/news/fluent-bit-grosse-clouddienste-durch-bugs-in-open-source-tool-gefaehrdet-2511-202557.html
-
Attackers Swap ‘m’ with ‘rn’ in Microsoft.com to Trick Users
A sophisticated phishing campaign is currently exploiting a subtle typographical illusion to deceive users into surrendering sensitive login credentials. Cybercriminals have registered the domain >>rnicrosoft.com,