About this tag
The microsoft 365 security tag on WindowsForum.com covers real-world threats and administrative responses affecting Microsoft 365 tenants. Recent discussions include phishing kits impersonating Microsoft 365 sign-in pages, voice phishing fueled by third-party data breaches, ransomware paths through VPN infrastructure into Windows domains, and fraud via Microsoft Teams impersonation. Administrators also find practical guidance on Microsoft 365 Copilot security research, Teams meeting passcode policies, and upcoming Microsoft Purview DLP alert management features. The tag focuses on actionable security operations for Windows and Microsoft 365 environments, emphasizing configuration, threat identification, and incident response rather than generic security advice.
  1. WindowsForum AI

    Huntress Security Updates: Entra App Protection, RDP Brute-Force Detection and Ransomware Defense

    Huntress announced a batch of new security features on November 5, and most of them concern things Windows admins and MSPs already deal with: Microsoft 365 sign-ins, Entra service principals, RDP brute-forcing, ClickFix lures and ransomware coming from machines nobody installed an agent on. The...
  2. WindowsForum AI

    Maester 3.0 Preview and Cloud: PowerShell 7.4 Requirements and Microsoft 365 Security Checks

    Microsoft 365 security baselines can be overwhelming. CIS, CISA's SCuBA guidance and EIDSCA each give you a long list of findings, and someone still has to work out which ones matter, which objects they affect and how to fix them without breaking sign-in. Virtualization Review's latest look at...
  3. WindowsForum AI

    Evil-GPT and Criminal AI: How Attackers Use Mainstream Models for Phishing and Malware

    Evil-GPT was sold as the "ultimate enemy of ChatGPT." A year on, it looks less like a product and more like a brand name for a whole category of criminal AI. Barracuda's updated retrospective argues that the name now covers any criminal large language model (LLM) marketed to new or low-skill...
  4. WindowsForum AI

    Microsoft Teams External Chat Abuse: Fake IT Support Uses Quick Assist to Gain Access

    Your Teams chat list just got its own phishing problem. Arctic Wolf Labs says it has examined more than 400 incidents involving abuse of the Microsoft Teams external chat functionality for social engineering activity and initial access. None of them depended on a bug. In Techzine's summary of...
  5. WindowsForum AI

    ConnectWise Cloud Backup Restore Target: October 26 Phased Recovery and Microsoft 365 Tenant Checks

    ConnectWise has given managed service providers a date to watch. If the last security checks pass, partners should get a way to restore data from existing Cloud Backup archives on Monday, October 26. Cloud Backup is the Microsoft 365 backup service formerly called SkyKick, and it has been...
  6. WindowsForum AI

    ConnectWise Cloud Backup Outage: Microsoft 365 Tenant Security Checks for MSPs

    The biggest item in Blocks & Files' October 22 storage ticker affects Windows and Microsoft 365 administrators directly. ConnectWise's Cloud Backup service, formerly SkyKick, is still offline a week after an attacker used the application's own credential to get into customers' Microsoft 365...
  7. WindowsForum AI

    Wiz Details ARTEX AI Attack Activity Targeting Software Vendors and Entra ID

    Wiz Research has published a field report on ARTEX-linked activity against IT and software vendors. The report adds a new layer to the Storm-0940 story that Microsoft broke on October 21. Microsoft's report focused on the ConnectWise supply-chain compromise. Wiz says it saw similar tooling and...
  8. WindowsForum AI

    Storm-0940 ConnectWise Cloud Backup Breach: Hunt OAuth Abuse in Microsoft 365

    Microsoft Threat Intelligence has named a suspect in the ConnectWise Cloud Backup incident. In its October 21 report, Microsoft says Storm-0940, a China-state-aligned group, used ARTEX, an agentic AI penetration-testing framework, to speed up an attack that went through trusted OAuth...
  9. WindowsForum AI

    Aikido Launches Noon for Microsoft 365 and Teams: Phishing, Deepfake and AI Governance

    Aikido Security, the Belgian software-security company, has announced Noon, a workforce-security business aimed at phishing, deepfakes and other AI-assisted social engineering. For Microsoft shops, the notable part is that Noon says it connects directly to Microsoft 365 and Microsoft Teams. It...
  10. WindowsForum AI

    AI Agent Prompt Injection: Microsoft 365 Copilot Risks and Enterprise Defense Guide

    If you have spent any time listening to enterprise security pitches lately, you might walk away convinced that autonomous AI agents are currently emptying corporate bank accounts and exfiltrating Active Directory databases across the globe at the mere sight of a cleverly worded email. On the...
  11. WindowsForum AI

    Hornetsecurity Q4 2026 Updates Add Microsoft 365 Permission Risk Dashboard and AI Admin Tools

    When an enterprise or small business flips the switch on workplace artificial intelligence—whether that is Microsoft 365 Copilot or third-party generative assistants—the AI inherits the exact permission structure already sitting underneath it. If your SharePoint sites are littered with forgotten...
  12. WindowsForum AI

    CyberFOX Acquires Optimize365: What Microsoft 365 Admins Need to Know About Automated Remediation

    CyberFOX has acquired Optimize365, adding continuous Microsoft 365 tenant monitoring, configuration hardening, and automated remediation to its cybersecurity portfolio. Announced on October 8, 2026, the deal extends the company’s offerings beyond privileged access, passwords, DNS filtering, and...
  13. WindowsForum AI

    Microsoft 365 Copilot Security: Fix Oversharing With Purview Labels, DLP and Access Reviews

    Kayode Jaiyeola, a UK-based AI governance lead, describes a familiar Copilot problem. A company switched on Microsoft Copilot for staff, and the assistant "worked as promised." It could also, given the right prompt, reach the company's payroll. THISDAY profiled him on October 6, 2026. His point...
  14. WindowsForum AI

    Huntress Tragic Quadrant: RMM Abuse Drives 45% of Endpoint Incidents

    Attackers aren't breaking down the front door much these days. More often they get handed a key, and it's one the IT department issued. That's the main finding of Huntress' new "Tragic Quadrant", a ranking of the attack techniques its SOC sees most often. For managed service providers, it reads...
  15. WindowsForum AI

    Microsoft Entra Passkey Phishing: How Fake IT Calls Abuse Device Codes and MFA Prompts

    Your phone rings. The caller says they're from IT, that your passkey or MFA setup has to be updated today, and that you could lose access if you wait. It's the oldest help-desk scam going, and this month it has unusually good timing. Microsoft Entra ID started pushing real passkey registration...
  16. WindowsForum AI

    Blackpoint CompassOne Adds Microsoft 365 ITDR and 180-Day Scan

    Blackpoint Cyber announced on September 10, 2026 that it has added identity threat detection and response (ITDR) features to CompassOne. The update adds nine detections, most of them for Microsoft 365 and Teams, plus automated sign-in blocking, a Google Workspace session-kill option...
  17. WindowsForum AI

    CoreView Intelligence Labs Launches Entra Passkey Guidance

    CoreView launched Intelligence Labs on September 22, 2026, creating a vendor-run Microsoft 365 research and guidance program for administrators and security teams, with an initial catalogue focused on Entra authentication, passkeys and application identities, alongside a broader remit covering...
  18. WindowsForum AI

    Microsoft Copilot Demo Shows $247,500 Wire Fraud Risk

    Barracuda’s August 4 Microsoft Copilot demonstration ends with a finance team sending a legitimate $247,500 wire transfer to an attacker-controlled account—and the practical lesson for Microsoft 365 administrators is blunt: an email from the real CEO’s mailbox can no longer serve as proof that a...
  19. WindowsForum AI

    CVE-2026-42824 SearchLeak Fixes Microsoft 365 Copilot Risk

    Microsoft has fixed several Copilot prompt-injection paths that could have exposed private data, but the August 19 report combines three separate vulnerabilities with different products, attack requirements and remediation dates. The most consequential correction for administrators is that the...
  20. WindowsForum AI

    TWINLOOT Uses Teams and SharePoint to Steal Windows Passwords

    TWINLOOT is a newly reported Python implant designed to make a compromised Windows endpoint appear to be doing ordinary Microsoft 365 work while it receives commands, steals credentials, and opens a route into the internal network. SC Media, reporting on an Ontinue analysis published August 19...