phishing

A growing number of Microsoft account holders report successful sign‑ins from IP addresses inside Microsoft’s own network despite having two‑factor authentication enabled — an uptick of incidents first detailed in a German investigation and corroborated by threads on Reddit and Microsoft’s own...

Microsoft's latest Windows 11 preview builds have repurposed the post‑setup SCOOBE flow into a large, full‑screen subscription reminder that will tell Microsoft 365 users their account “needs attention” — and it does so in a way that many will read as a direct, blocking prompt to renew...

Microsoft’s latest Windows 11 Insider builds are shipping a new, full-screen renewal prompt aimed at lapsed Microsoft 365 subscriptions — an eye-catching SCOOBE (Second‑Chance Out‑of‑Box Experience) screen that insiders and early reports describe as a full‑screen nag to renew rather than a...

Microsoft’s latest push makes the long-promised “passwordless” future real for Windows 11 users by turning passkeys and Windows Hello into the default, secure way to sign into apps, websites, and corporate devices — removing passwords from the sign-in flow while preserving recoverability and...

A new, industrialized phishing service called VoidProxy is being used by multiple criminal groups to intercept Google and Microsoft sign-ins in real time, harvest credentials, MFA responses and — critically — session cookies that let attackers impersonate users without needing passwords or...

Microsoft’s Security Update Guide lists CVE-2025-54910 as a heap-based buffer overflow in Microsoft Office that can allow an attacker to execute code locally when a crafted Office document is processed, but the vendor’s advisory requires direct inspection for exact builds and KB identifiers...

Microsoft’s Security Update Guide lists CVE-2025-55243 as a spoofing vulnerability in Microsoft OfficePlus that can lead to the exposure of sensitive information and enable an attacker to perform spoofing over a network, but key public mirrors and automated scrapers offer limited or inconsistent...

Microsoft’s advisory that an improper authentication vulnerability in Windows NTLM can let an authenticated actor elevate privileges over the network is the latest warning flag in a year already crowded with NTLM-related incidents and active exploitation chains. The vendor entry the user...

Microsoft’s advisory link for CVE-2025-54908 points to a PowerPoint use‑after‑free that “allows an unauthorized attacker to execute code locally,” but that specific CVE number could not be corroborated in public vulnerability trackers at the time of verification; when attempting to load the...

Microsoft’s Security Response Center has published an advisory for CVE-2025-54907, describing a heap-based buffer overflow in Microsoft Office Visio that can allow an unauthorized attacker to execute code in the context of the user who opens a malicious file. This is a document‑parser...

Microsoft has published an advisory for CVE-2025-54906, a Microsoft Office vulnerability described as a “free of memory not on the heap” condition that can lead to local remote‑code‑execution (RCE) when a user opens or previews a specially crafted Office document; Microsoft lists the...

Microsoft has published an advisory for CVE-2025-54903, a use‑after‑free vulnerability in Microsoft Excel that can lead to local code execution when a victim opens a specially crafted spreadsheet — a document‑based remote code execution (RCE) risk that should be treated as high priority for both...

A newly disclosed Microsoft Excel vulnerability tracked as CVE-2025-54902 is an out‑of‑bounds read flaw in Excel’s file‑parsing logic that Microsoft warns could allow an attacker to achieve code execution on a targeted machine when a user opens a specially crafted spreadsheet, and organizations...

Microsoft’s security tracker lists CVE-2025-54898 as an out-of-bounds read vulnerability in Microsoft Excel that can be triggered by a crafted spreadsheet and may allow an attacker to achieve local code execution when a user opens a malicious file. Background Microsoft Excel remains one of the...

Microsoft Defender SmartScreen in Microsoft Edge acts as a live reputation and content filter that warns users about phishing pages, malicious downloads, and suspicious sites before they can do harm. (support.microsoft.com, learn.microsoft.com) Background Microsoft Defender SmartScreen began as...

Since March 2025, threat actors have increasingly weaponized ConnectWise ScreenConnect installers — using trojanized, stripped-down ClickOnce runners and other delivery tricks to convert a trusted remote administration tool into a stealthy initial-access vector that drops multiple RATs and...

Microsoft has confirmed that Phase 2 of its mandatory multi‑factor authentication (MFA) enforcement for Azure will begin a tenant‑by‑tenant rollout this autumn, extending MFA requirements from portal sign‑ins down into the Azure Resource Manager (ARM) control plane and affecting command‑line...

Google's Chromium team has fixed a medium-severity UI spoofing flaw—tracked as CVE-2025-9865—that existed in the browser's Toolbar implementation and could allow domain spoofing on Android when a user performed specific UI gestures on crafted pages. Background Chromium's September 2025 security...

Google and the Chromium project have patched CVE-2025-9867, a medium-severity inappropriate implementation bug in the Downloads component that can be abused for UI spoofing on Chrome for Android, and users should update their mobile and desktop Chromium-based browsers immediately to eliminate...

Palo Alto Networks has pushed a clear marker in the SASE arms race with the launch of Prisma SASE 4.0, a major platform refresh that explicitly frames the next phase of enterprise security as AI versus AI — protecting organizations not only from AI-augmented attackers, but from the uncontrolled...