Microsoft Describes Azure DevOps Pipeline Abuse After Identity Compromise
Microsoft analyzed an incident attributed to Storm-3068 activity in which an attacker used an Azure DevOps pipeline to obtain kubeconfig files after taking over an account.
Tag Microsoft 365
Microsoft Warns of Phishing Abusing MSP360 RMM and ScreenConnect
Microsoft analyzed phishing campaigns in which attackers delivered a signed MSP360 RMM installer and then deployed ConnectWise ScreenConnect for more persistent remote access.
NeedyMantis Malware: Microsoft Publishes Analysis of Post-Compromise Attacks
Microsoft has published a technical analysis of the modular NeedyMantis malware, which the analysis says is used after access to an environment has been obtained.
Microsoft Introduces New Copilot with Home, Code and Autopilot
Microsoft announced a new Copilot with Home, Code and Autopilot areas. The full scope of the features and availability of the individual components has not yet been independently confirmed.
Microsoft analyzes Storm-2570 across ransomware ecosystems
Microsoft described the Storm-2570 actor, linking it to the deployment of four ransomware families and a repeated post-compromise process.
Microsoft Disrupts EvilTokens Phishing Service
Microsoft and its partners disrupted EvilTokens infrastructure that, according to the company, helped attackers access email inboxes through phishing abuse of the device code flow.
Microsoft Fixes Critical Azure AI Foundry Flaw Without Customer Action
Microsoft fixed CVE-2026-85889 on the Azure AI Foundry service side. The CVSS 10.0 flaw could have allowed an unauthorized attacker to escalate privileges over a network.
Microsoft Employee’s Internal Remark Appears in Publishers’ Dispute with OpenAI
A partially unsealed filing by publishers in a US copyright dispute quotes Microsoft employee Brent Hecht. Microsoft emphasizes that it was not the company’s position.
Microsoft Warns of Passkey-Themed Phishing and Cloud Identity Compromise
Microsoft has recorded active intrusions into cloud accounts in which attackers exploit phone calls and text messages with urgent requests to change a passkey or MFA.
Microsoft Analyzes BEC Campaign Impersonating Executives and Using ServiceNow Invoices
Microsoft detected more than one million fraudulent emails impersonating company executives and ServiceNow communications. Indicators suggest possible use of generative AI, but they are not definitive evidence.