Security news aggregator

Latest coverage for Microsoft

Microsoft software and cloud platforms underpin enterprise systems, so vulnerabilities and security advisories can affect identity, data, and operations.

42 headlines in this view

Microsoft is a technology company whose Windows, Microsoft 365, Azure, identity services, and developer tools form a widely deployed enterprise computing ecosystem. Its security relevance spans endpoint and server software, cloud control planes, authentication, collaboration data, and the update mechanisms used to maintain them.

Security news under this tag commonly concerns vulnerabilities requiring patching, exploits against exposed services, identity or token compromise, and misconfiguration of cloud permissions or authentication policies. Practitioners should verify affected versions and exposure, apply updates or mitigations, enforce multifactor authentication and least privilege, and monitor relevant audit logs. Incidents involving Microsoft-hosted identities or data may require rapid session and credential containment, investigation across cloud and on-premises systems, and assessment of privacy or regulatory obligations.

Showing 20 most recent headlines of 42 Filtered view

Threat Post 3 years, 11 months ago

Microsoft Patches ‘Dogwalk’ Zero-Day and 17 Critical Flaws

August Patch Tuesday tackles 121 CVEs, 17 critical bugs and one zero-day bug exploited in the wild.

Threat Post 11 Aug 2022, 12:48 a.m. 0-Day Critical Vulnerability Flaw Microsoft Patch Patch Tuesday

Threat Post 3 years, 11 months ago

Open Redirect Flaw Snags Amex, Snapchat User Data

Separate phishing campaigns targeting thousands of victims impersonate FedEx and Microsoft, among others, to trick victims.

Threat Post 6 Aug 2022, 1:17 a.m. Flaw Microsoft Phishing Victims

Threat Post 3 years, 11 months ago

Threat Actors Pivot Around Microsoft’s Macro-Blocking in Office

Cybercriminals turn to container files and other tactics to get around the company’s attempt to thwart a popular way to deliver malicious phishing payloads.

Threat Post 29 Jul 2022, 5:24 a.m. Microsoft Phishing Threat Actor

Threat Post 3 years, 11 months ago

Phishing Attacks Skyrocket with Microsoft and Facebook as Most Abused Brands

Instances of phishing attacks leveraging the Microsoft brand increased 266 percent in Q1 compared to the year prior.

Threat Post 27 Jul 2022, 1:05 a.m. Facebook Microsoft Phishing

Threat Post 4 years ago

CISA Urges Patch of Exploited Windows 11 Bug by Aug. 2

Feds urge U.S. agencies to patch a Microsoft July Patch Tuesday 2022 bug that is being exploited in the wild by August 2.

Threat Post 19 Jul 2022, 12:19 a.m. America CISA Microsoft Patch Patch Tuesday Windows 11

Threat Post 4 years ago

Emerging H0lyGh0st Ransomware Tied to North Korea

Microsoft has linked a threat that emerged in June 2021 and targets small-to-mid-sized businesses to state-sponsored actors tracked as DEV-0530.

Threat Post 16 Jul 2022, 4:26 a.m. Microsoft Nation State North Korea Ransomware

Threat Post 4 years ago

Fancy Bear Uses Nuke Threat Lure to Exploit 1-Click Bug

The APT is pairing a known Microsoft flaw with a malicious document to load malware that nabs credentials from Chrome, Firefox and Edge browsers.

Threat Post 24 Jun 2022, 12:21 a.m. Advanced Persistent Threat APT28 Chrome Credentials Exploit Firefox Flaw Malware Microsoft

Threat Post 4 years ago

Elusive ToddyCat APT Targets Microsoft Exchange Servers

The threat actor targets institutions and companies in Europe and Asia.

Threat Post 23 Jun 2022, 12:18 a.m. Advanced Persistent Threat Europe Exchange Server Microsoft Threat Actor

Threat Post 4 years ago

Voicemail Scam Steals Microsoft Credentials

Attackers are targeting a number of key vertical markets in the U.S. with the active campaign, which impersonates the organization and Microsoft to lift Office365 and Outlook log-in details.

Threat Post 21 Jun 2022, 11:20 p.m. America Credentials Microsoft Scam

Threat Post 4 years, 1 month ago

Follina Exploited by State-Sponsored Hackers

A government-aligned attacker tried using a Microsoft vulnerability to attack U.S. and E.U. government targets.

Threat Post 8 Jun 2022, 12:45 a.m. America Government Microsoft Nation State Vulnerability

Threat Post 4 years, 1 month ago

Microsoft Releases Workaround for ‘One-Click’ 0Day Under Active Attack

Threat actors already are exploiting vulnerability, dubbed ‘Follina’ and originally identified back in April, to target organizations in Russia and Tibet, researchers said.

Threat Post 1 Jun 2022, 10:38 p.m. Microsoft Research Russia Threat Actor Vulnerability

Threat Post 4 years, 1 month ago

Zero-Day ‘Follina’ Bug Lays Older Microsoft Office Versions Open to Attack

Malware loads itself from remote servers and bypasses Microsoft's Defender AV scanner, according to reports.

Threat Post 31 May 2022, 2:53 a.m. 0-Day Malware Microsoft Microsoft Office

Threat Post 4 years, 1 month ago