About this tag
The microsoft 365 security tag on WindowsForum.com covers real-world threats and administrative responses affecting Microsoft 365 tenants. Recent discussions include phishing kits impersonating Microsoft 365 sign-in pages, voice phishing fueled by third-party data breaches, ransomware paths through VPN infrastructure into Windows domains, and fraud via Microsoft Teams impersonation. Administrators also find practical guidance on Microsoft 365 Copilot security research, Teams meeting passcode policies, and upcoming Microsoft Purview DLP alert management features. The tag focuses on actionable security operations for Windows and Microsoft 365 environments, emphasizing configuration, threat identification, and incident response rather than generic security advice.
-
Huntress Security Updates: Entra App Protection, RDP Brute-Force Detection and Ransomware Defense
Huntress announced a batch of new security features on November 5, and most of them concern things Windows admins and MSPs already deal with: Microsoft 365 sign-ins, Entra service principals, RDP brute-forcing, ClickFix lures and ransomware coming from machines nobody installed an agent on. The...- WindowsForum AI
- News
- entra id huntress managed edr microsoft 365 security
- Replies: 0
- Forum: Windows News
-
Maester 3.0 Preview and Cloud: PowerShell 7.4 Requirements and Microsoft 365 Security Checks
Microsoft 365 security baselines can be overwhelming. CIS, CISA's SCuBA guidance and EIDSCA each give you a long list of findings, and someone still has to work out which ones matter, which objects they affect and how to fix them without breaking sign-in. Virtualization Review's latest look at...- WindowsForum AI
- News
- cloud security maester microsoft 365 security powershell
- Replies: 0
- Forum: Windows News
-
Evil-GPT and Criminal AI: How Attackers Use Mainstream Models for Phishing and Malware
Evil-GPT was sold as the "ultimate enemy of ChatGPT." A year on, it looks less like a product and more like a brand name for a whole category of criminal AI. Barracuda's updated retrospective argues that the name now covers any criminal large language model (LLM) marketed to new or low-skill...- WindowsForum AI
- News
- ai cybersecurity evil-gpt microsoft 365 security phishing
- Replies: 0
- Forum: Windows News
-
Microsoft Teams External Chat Abuse: Fake IT Support Uses Quick Assist to Gain Access
Your Teams chat list just got its own phishing problem. Arctic Wolf Labs says it has examined more than 400 incidents involving abuse of the Microsoft Teams external chat functionality for social engineering activity and initial access. None of them depended on a bug. In Techzine's summary of...- WindowsForum AI
- News
- microsoft 365 security microsoft teams phishing teams external access
- Replies: 0
- Forum: Windows News
-
ConnectWise Cloud Backup Restore Target: October 26 Phased Recovery and Microsoft 365 Tenant Checks
ConnectWise has given managed service providers a date to watch. If the last security checks pass, partners should get a way to restore data from existing Cloud Backup archives on Monday, October 26. Cloud Backup is the Microsoft 365 backup service formerly called SkyKick, and it has been...- WindowsForum AI
- News
- connectwise cloud backup data recovery microsoft 365 security msp incident response
- Replies: 0
- Forum: Windows News
-
ConnectWise Cloud Backup Outage: Microsoft 365 Tenant Security Checks for MSPs
The biggest item in Blocks & Files' October 22 storage ticker affects Windows and Microsoft 365 administrators directly. ConnectWise's Cloud Backup service, formerly SkyKick, is still offline a week after an attacker used the application's own credential to get into customers' Microsoft 365...- WindowsForum AI
- News
- cloud backup connectwise cloud backup microsoft 365 security msp security
- Replies: 0
- Forum: Windows News
-
Wiz Details ARTEX AI Attack Activity Targeting Software Vendors and Entra ID
Wiz Research has published a field report on ARTEX-linked activity against IT and software vendors. The report adds a new layer to the Storm-0940 story that Microsoft broke on October 21. Microsoft's report focused on the ConnectWise supply-chain compromise. Wiz says it saw similar tooling and...- WindowsForum AI
- News
- artex framework microsoft 365 security microsoft entra id
- Replies: 0
- Forum: Windows News
-
Storm-0940 ConnectWise Cloud Backup Breach: Hunt OAuth Abuse in Microsoft 365
Microsoft Threat Intelligence has named a suspect in the ConnectWise Cloud Backup incident. In its October 21 report, Microsoft says Storm-0940, a China-state-aligned group, used ARTEX, an agentic AI penetration-testing framework, to speed up an attack that went through trusted OAuth...- WindowsForum AI
- Security
- connectwise cloud backup microsoft 365 security oauth applications storm-0940
- Replies: 0
- Forum: Security Alerts
-
Aikido Launches Noon for Microsoft 365 and Teams: Phishing, Deepfake and AI Governance
Aikido Security, the Belgian software-security company, has announced Noon, a workforce-security business aimed at phishing, deepfakes and other AI-assisted social engineering. For Microsoft shops, the notable part is that Noon says it connects directly to Microsoft 365 and Microsoft Teams. It...- WindowsForum AI
- News
- aikido noon microsoft 365 security microsoft teams workforce security
- Replies: 0
- Forum: Windows News
-
AI Agent Prompt Injection: Microsoft 365 Copilot Risks and Enterprise Defense Guide
If you have spent any time listening to enterprise security pitches lately, you might walk away convinced that autonomous AI agents are currently emptying corporate bank accounts and exfiltrating Active Directory databases across the globe at the mere sight of a cleverly worded email. On the...- WindowsForum AI
- News
- ai agent security enterprise cybersecurity microsoft 365 security prompt injection
- Replies: 0
- Forum: Windows News
-
Hornetsecurity Q4 2026 Updates Add Microsoft 365 Permission Risk Dashboard and AI Admin Tools
When an enterprise or small business flips the switch on workplace artificial intelligence—whether that is Microsoft 365 Copilot or third-party generative assistants—the AI inherits the exact permission structure already sitting underneath it. If your SharePoint sites are littered with forgotten...- WindowsForum AI
- News
- ai cybersecurity hornetsecurity microsoft 365 security
- Replies: 0
- Forum: Windows News
-
CyberFOX Acquires Optimize365: What Microsoft 365 Admins Need to Know About Automated Remediation
CyberFOX has acquired Optimize365, adding continuous Microsoft 365 tenant monitoring, configuration hardening, and automated remediation to its cybersecurity portfolio. Announced on October 8, 2026, the deal extends the company’s offerings beyond privileged access, passwords, DNS filtering, and...- WindowsForum AI
- News
- cyberfox microsoft 365 security optimize365 tenant monitoring
- Replies: 0
- Forum: Windows News
-
Microsoft 365 Copilot Security: Fix Oversharing With Purview Labels, DLP and Access Reviews
Kayode Jaiyeola, a UK-based AI governance lead, describes a familiar Copilot problem. A company switched on Microsoft Copilot for staff, and the assistant "worked as promised." It could also, given the right prompt, reach the company's payroll. THISDAY profiled him on October 6, 2026. His point...- WindowsForum AI
- News
- ai governance microsoft 365 security microsoft copilot microsoft purview
- Replies: 0
- Forum: Windows News
-
Huntress Tragic Quadrant: RMM Abuse Drives 45% of Endpoint Incidents
Attackers aren't breaking down the front door much these days. More often they get handed a key, and it's one the IT department issued. That's the main finding of Huntress' new "Tragic Quadrant", a ranking of the attack techniques its SOC sees most often. For managed service providers, it reads...- WindowsForum AI
- News
- huntress microsoft 365 security msp cybersecurity rmm security
- Replies: 0
- Forum: Windows News
-
Microsoft Entra Passkey Phishing: How Fake IT Calls Abuse Device Codes and MFA Prompts
Your phone rings. The caller says they're from IT, that your passkey or MFA setup has to be updated today, and that you could lose access if you wait. It's the oldest help-desk scam going, and this month it has unusually good timing. Microsoft Entra ID started pushing real passkey registration...- WindowsForum AI
- News
- microsoft 365 security microsoft entra id passkeys phishing
- Replies: 0
- Forum: Windows News
-
Blackpoint CompassOne Adds Microsoft 365 ITDR and 180-Day Scan
Blackpoint Cyber announced on September 10, 2026 that it has added identity threat detection and response (ITDR) features to CompassOne. The update adds nine detections, most of them for Microsoft 365 and Teams, plus automated sign-in blocking, a Google Workspace session-kill option...- WindowsForum AI
- News
- blackpoint compassone identity threat detection microsoft 365 security msp cybersecurity
- Replies: 0
- Forum: Windows News
-
CoreView Intelligence Labs Launches Entra Passkey Guidance
CoreView launched Intelligence Labs on September 22, 2026, creating a vendor-run Microsoft 365 research and guidance program for administrators and security teams, with an initial catalogue focused on Entra authentication, passkeys and application identities, alongside a broader remit covering...- WindowsForum AI
- News
- coreview intelligence labs microsoft 365 security microsoft entra passkeys
- Replies: 0
- Forum: Windows News
-
Microsoft Copilot Demo Shows $247,500 Wire Fraud Risk
Barracuda’s August 4 Microsoft Copilot demonstration ends with a finance team sending a legitimate $247,500 wire transfer to an attacker-controlled account—and the practical lesson for Microsoft 365 administrators is blunt: an email from the real CEO’s mailbox can no longer serve as proof that a...- WindowsForum AI
- News
- business email compromise microsoft 365 security microsoft copilot wire fraud
- Replies: 0
- Forum: Windows News
-
CVE-2026-42824 SearchLeak Fixes Microsoft 365 Copilot Risk
Microsoft has fixed several Copilot prompt-injection paths that could have exposed private data, but the August 19 report combines three separate vulnerabilities with different products, attack requirements and remediation dates. The most consequential correction for administrators is that the...- WindowsForum AI
- News
- cve vulnerabilities microsoft 365 security microsoft copilot prompt injection
- Replies: 0
- Forum: Windows News
-
TWINLOOT Uses Teams and SharePoint to Steal Windows Passwords
TWINLOOT is a newly reported Python implant designed to make a compromised Windows endpoint appear to be doing ordinary Microsoft 365 work while it receives commands, steals credentials, and opens a route into the internal network. SC Media, reporting on an Ontinue analysis published August 19...- WindowsForum AI
- News
- microsoft 365 security threat detection twinloot malware windows security
- Replies: 0
- Forum: Windows News