Latest news and updates about Security.
Microsoft has expanded its Zero Trust for AI strategy with new assessment capabilities, a DevSecOps pillar in the Zero Trust Workshop, and practical implementation guidance. The updates help security and platform teams assess AI-related risk, secure AI-assisted development, and build a phased roadmap for adopting Zero Trust controls across AI systems.
Microsoft has disclosed CaptiveCrunch, an active campaign linked to Midnight Blizzard that hijacks traffic on hospitality and captive portal networks to steal credentials and deliver malware. The threat is especially relevant for organizations with frequent travelers because attackers are abusing Entra ID device code flows, fake update prompts, and adversary-in-the-middle phishing to compromise corporate accounts and endpoints.
Microsoft’s July 2026 security updates focus on protecting AI environments, embedding AI into security operations, and strengthening identity, cloud, and data protection foundations. Key additions include Project Perception, new Defender protections for prompt injection and cloud agents, Entra passkeys by default, and expanded Purview controls for Copilot and shadow AI apps.
Microsoft is urging security leaders to treat AI security as a systems challenge that requires better questions, clearer objectives, and stronger governance across data, identities, and processes. The message matters for IT and security teams adopting AI because success depends not just on more signals or tools, but on layered controls, human oversight, and decision-making designed for resilience.
Microsoft has introduced Project Perception, a new agentic security system designed to help organizations defend against AI-driven threats at machine speed. Entering public preview on August 3, it combines specialized agents, security context, and a multi-model architecture to improve vulnerability management and automate protection while keeping human defenders in control.
Microsoft has launched the External Red Team Alliance (EXTRA), a global expansion of its AI Red Team to improve AI safety and security testing with outside experts. The initiative funds 18 university labs across six continents and builds an external network of specialists to assess emerging AI risks that internal teams alone may miss.
Microsoft’s Q2 2026 email threat report shows a major 92% drop in Tycoon2FA-linked phishing following disruption efforts, alongside declines in QR code and CAPTCHA-gated phishing. However, defenders should note that attackers are shifting tactics, with Teams-based social engineering, credential phishing, and fast-moving business email compromise campaigns continuing to pose significant risk.
Microsoft has partnered with AXA XL to bring Microsoft Defender Experts Cybersecurity Incident Response directly to cyber insurance policyholders. The move aims to speed up containment and recovery by aligning security, legal, executive, and insurance workflows before an incident occurs.
Microsoft used Black Hat USA 2026 to spotlight how attackers are abusing trusted software, identities, cloud services, and AI systems to scale attacks. The company also highlighted ongoing npm supply chain investigations, new Microsoft Defender Experts capabilities, and research sessions that give security teams practical guidance for defending trust paths.
Microsoft reports increased ACR Stealer activity targeting enterprises through ClickFix social engineering, with two intrusion chains using WebDAV, Python loaders, MSHTA, obfuscated PowerShell, and steganography. The campaigns focus on stealing browser credentials, session tokens, and sensitive documents, making early detection and user awareness critical for defenders.
Microsoft is urging organizations to treat AI agents as first-class identities with tightly scoped access, explicit role assignments, and controlled tool bindings. The guidance matters because agentic workflows can span multiple systems, increasing the blast radius of misconfigured permissions, weak audit trails, and unclear accountability.
Microsoft Threat Intelligence uncovered a coordinated compromise of the AsyncAPI npm organization that republished five package versions with malicious code that runs when packages are imported, not just installed. The incident matters because common mitigations like npm install --ignore-scripts do not stop this technique, putting developer workstations, CI/CD pipelines, and production services at risk if they resolved the affected versions.