Latest news and updates about Security.
Microsoft has identified a new ClickFix-style campaign targeting macOS users with fake troubleshooting and utility instructions hosted on blogs and content platforms. Instead of downloading apps, victims are tricked into running Terminal commands that bypass typical macOS app checks and deploy infostealers such as Macsync, SHub Stealer, and AMOS.
Microsoft has detailed a large-scale adversary-in-the-middle (AiTM) phishing campaign that used fake code-of-conduct investigations to steal authentication tokens. The attack combined polished social engineering, staged CAPTCHA pages, and a legitimate Microsoft sign-in flow, highlighting why phishing-resistant protections and stronger email defenses matter.
Microsoft has detailed CVE-2026-31431, a high-severity Linux local privilege escalation flaw that can grant root access across major distributions and cloud-hosted workloads. The issue matters because it affects shared-kernel environments such as containers and Kubernetes, increasing the risk of container escape, lateral movement, and host compromise if systems are not patched quickly.
Microsoft Agent 365 is now generally available for commercial customers, giving IT and security teams a unified control plane to observe, govern, and secure AI agents across Microsoft 365, endpoints, and cloud environments. New preview capabilities also extend visibility to shadow AI, local Windows agents, multicloud agent platforms, and policy-based controls through Defender and Intune.
Microsoft reports 8.3 billion phishing emails detected in Q1 2026, with QR code phishing more than doubling and CAPTCHA-gated campaigns evolving quickly. The findings matter for security teams because attackers are shifting toward link-based credential theft, while disruption efforts against Tycoon2FA show coordinated action can reduce phishing impact.
Microsoft has announced new security capabilities across Agent 365, Defender for Cloud, GitHub Advanced Security, and Microsoft Purview. The updates focus on improving visibility into AI agent activity, strengthening code-to-runtime protection, and accelerating data security investigations for security and IT teams.
Microsoft has published a practical framework for CISOs and security leaders to run more effective risk reviews amid rising AI-enabled cyberthreats. The guidance focuses on eight review areas—from assets and applications to authentication, authorization, and network isolation—to help organizations shift from reactive response to proactive risk reduction.
Microsoft Sentinel UEBA now adds richer behavioral analytics for AWS CloudTrail data, giving security teams built-in context like first-time geography, uncommon ISP, unusual actions, and abnormal operation volume. The update helps defenders detect suspicious AWS activity faster and reduces the need for complex KQL baselines and manual enrichment.
Microsoft says AI is accelerating how vulnerabilities are found and exploited, shrinking the time defenders have to respond. In response, the company is expanding AI-driven vulnerability discovery, exposure management, and Defender-based protections, while also previewing a new multi-model scanning solution for customers in June 2026.
Microsoft has outlined detection strategies for identifying North Korea-aligned threat actors posing as remote IT hires to infiltrate organizations. The guidance focuses on correlating HR SaaS, identity, email, conferencing, and Microsoft 365 signals so security and HR teams can spot suspicious candidates before and after onboarding.
Microsoft is urging organizations to make opportunistic cyberattacks harder by removing credentials, shrinking public attack surfaces, and standardizing secure platform patterns. The guidance is especially relevant for teams running Azure, Dynamics 365, and Power Platform workloads at scale, where inconsistent architectures and exposed secrets can make lateral movement easier for attackers.
Microsoft has detailed a human-operated intrusion chain where attackers use cross-tenant Microsoft Teams chats to impersonate helpdesk staff and trick users into granting remote access through tools like Quick Assist. The campaign matters because it blends legitimate collaboration, remote support, and admin tools to enable lateral movement, persistence, and data exfiltration while appearing like normal IT activity.