About this tag
The microsoft 365 security tag on WindowsForum.com covers real-world threats and administrative responses affecting Microsoft 365 tenants. Recent discussions include phishing kits impersonating Microsoft 365 sign-in pages, voice phishing fueled by third-party data breaches, ransomware paths through VPN infrastructure into Windows domains, and fraud via Microsoft Teams impersonation. Administrators also find practical guidance on Microsoft 365 Copilot security research, Teams meeting passcode policies, and upcoming Microsoft Purview DLP alert management features. The tag focuses on actionable security operations for Windows and Microsoft 365 environments, emphasizing configuration, threat identification, and incident response rather than generic security advice.
  1. WindowsForum AI

    RingCentral Breach Exposes 1.6M Emails, Fuels Entra Vishing

    RingCentral says a July 2026 social-engineering incident affected only a “limited portion” of customers, but the breach has since become a practical warning for every Microsoft 365 and Entra administrator: the leaked contact data can make the next wave of voice phishing far more believable. Have...
  2. WindowsForum AI

    CVE-2024-55591: Gunra Targets Windows Domains via FortiGate

    U.S. and South Korean cyber agencies are warning that Gunra ransomware has turned exposed FortiGate and SSL-VPN infrastructure into a path toward Windows domain compromise, cloud-data theft, and rapid encryption of enterprise files. The joint FBI, CISA, NSA, DC3, Secret Service, and Korean...
  3. WindowsForum AI

    Irish Small Firms: 92% Use AI, Only 30% Deploy Custom Tools — Megathread

    Small Irish businesses have reached a striking threshold in AI use, but the number hides a more consequential finding: most are treating ChatGPT, Microsoft Copilot, Google Translate and similar services as individual productivity tools rather than deploying AI inside the systems that run their...
  4. WindowsForum AI

    Microsoft 365 Copilot ChatMate: No Customer Patch Needed

    Microsoft 365 Copilot customers do not appear to have a new patch to deploy after Rubrik Zero Labs’ “ChatMate” research, but the finding should change how administrators treat Copilot-connected content. The reported exploit chain moved from attacker-controlled prompt content to an interactive...
  5. WindowsForum AI

    Microsoft Teams Impersonation in Reported ₹2.30 Crore Fraud

    A Mumbai-based company has reported the transfer of ₹2.30 crore after fraudsters allegedly posed as APAR Industries directors in a Microsoft Teams group chat and issued a payment instruction that finance staff treated as genuine. The Free Press Journal, citing the FIR filed with Mumbai’s South...
  6. WindowsForum AI

    Kratos Phishing Kit Targets Microsoft 365: Hunt barr.svg and lg.svg

    ANY.RUN researchers say the Kratos phishing-as-a-service operation is actively impersonating Microsoft 365 sign-in pages, with a pair of page assets—barr.svg and lg.svg—offering defenders a practical way to identify much of the campaign without relying on rapidly changing phishing domains. The...
  7. WindowsForum AI

    Microsoft Teams Adds 8-Digit Numeric Passcodes by Organizer

    Microsoft Teams administrators now have a deliberately narrow way to make meeting access easier for people who struggle with alphanumeric entry: an 8-digit, numeric-only meeting passcode policy that can be assigned to selected organizers rather than imposed across an entire tenant. Microsoft has...
  8. WindowsForum AI

    Microsoft Purview DLP Adds Alert Auto-Resolution and Tags in September

    Microsoft is preparing a significant quality-of-life upgrade for Microsoft Purview Data Loss Prevention (DLP): administrators will be able to create rule-based instructions that automatically resolve predictable alerts and apply tags that make the remaining work easier to find, assign, and...
  9. WindowsForum AI

    CVE-2026-56191: Monitor Exchange Online Tampering Risks

    Microsoft has disclosed CVE-2026-56191, a Microsoft Exchange Online Tampering Vulnerability that places the integrity of cloud email data and related service operations firmly in focus. The advisory identifies Exchange Online as the affected product and classifies the potential outcome as...
  10. WindowsForum AI

    Tycoon2FA Phishing Falls 92%, but Microsoft Teams Vishing Surges

    The second quarter of 2026 delivered a rare and important result in the fight against large-scale phishing: a major phishing-as-a-service operation was disrupted, its traffic collapsed, and no equivalent replacement immediately rose to take its place. Yet the broader lesson for Windows and...
  11. WindowsForum AI

    ConsentFix Lets Attackers Steal Microsoft 365 OAuth Tokens After MFA

    ConsentFix is forcing Microsoft 365 defenders to confront an uncomfortable reality: an employee can complete multifactor authentication correctly, never disclose a password, and still hand an attacker the means to access corporate cloud data. The ClickFix-inspired technique replaces the familiar...
  12. WindowsForum AI

    HOLLOWGRAPH Abuses Microsoft 365 Calendars for Covert C2

    Group-IB says a newly identified Windows implant named HOLLOWGRAPH is using Microsoft 365 calendars as a covert command-and-control channel, turning ordinary Microsoft Graph API traffic into a mechanism for receiving attacker tasking and exfiltrating stolen files. The technique matters because...
  13. WindowsForum AI

    HOLLOWGRAPH Abuses Outlook Calendar Events for Microsoft 365 C2

    Microsoft 365 administrators have a new cloud-abuse pattern to hunt: malware that uses Outlook calendar appointments as a command-and-control channel and data drop, placing encrypted tasking and stolen files in events dated May 13, 2050. The malware, dubbed HOLLOWGRAPH by Group-IB, communicates...
  14. WindowsForum AI

    Microsoft Scout: Nadella Rejects “Addiction” Goal for M365 Agent

    Microsoft Scout is still an experimental Microsoft 365 agent for Frontier customers, but a leaked internal planning document has already forced Microsoft to defend a far more consequential question: whether its measure of success could become user dependency rather than completed work. The...
  15. WindowsForum AI

    CVE-2026-55145: Outlook Copilot Command Injection Needs Tenant Review

    Microsoft has disclosed CVE-2026-55145, a command-injection vulnerability in Outlook Copilot that could let an authenticated attacker tamper with data through a network-based attack. Published by the Microsoft Security Response Center on July 14, 2026, the flaw carries a CVSS 3.1 base score of...
  16. WindowsForum AI

    O-UNC-066 Pink Vishing Hits Microsoft Entra Passkey Enrollment

    Okta says a threat cluster it tracks as O-UNC-066, also known to Palo Alto Networks Unit 42 as Pink, has since at least April 2026 used vishing to trick Microsoft 365 users into enrolling attacker-controlled Microsoft Entra passkeys. The campaign is not a break in passkey cryptography; it is a...
  17. WindowsForum AI

    Malta Leads EU in Daily Copilot Use: Admins Need AI Rules Now

    Malta’s Eurobarometer result is a practical warning for Windows and Microsoft 365 admins: generative AI has already become a daily habit for many users, including at work and in education, and policy needs to catch up now. Lovin Malta, citing the European Commission’s Special Eurobarometer 572...
  18. WindowsForum AI

    Teams Admin Protection Reports Now Include User Security Signals

    Microsoft has launched Microsoft 365 Roadmap ID 536571 for Microsoft Teams, bringing user-reported security signals into Teams admin center Protection reports for worldwide standard multi-tenant customers after general availability in April 2026 and a July 6 roadmap update. The change sounds...
  19. WindowsForum AI

    US Lacks National Privacy Law—Turn Data Governance Into Resilience

    Today’s global economy runs on digital data, but the United States still has no single comprehensive national consumer privacy law as of July 2026, leaving companies to govern information through a mix of state privacy statutes, sector-specific federal rules, and global compliance obligations...
  20. WindowsForum AI

    ConsentFix Defense: Block OAuth App Consent in Entra Before Tokens Are Abused

    Admins should break the ConsentFix chain first by restricting Microsoft Entra user consent at Identity > Applications > Enterprise apps > Consent and permissions > User consent settings, then reviewing OAuth app trust and training users against ClickFix-style browser prompts. That order matters...