Microsoft urges Entra ID admins to replace SMS and voice with passkeys
Retirement of Microsoft-provided phone authentication starts February 1, 2027, in Worldwide and Government Community Cloud tenants.
42
Product
Entra ID
- Mentions · 7d1
- Mentions · 30d5
- All mentions24
- First seenAug 16, 2026
- Last mentioned1d ago
Timeline
24 articles · newest firstRansomware crews threatened employees' families at 37% of surveyed firms
Semperis surveyed 1,200 professionals at organizations already hit; 59% paid and 87% saw identity systems targeted.
54
Ransomware Attacks Intensify: Criminals Shift Focus to Target Employees and Their Families
Semperis says 37% of successful ransomware attacks included threats against employees’ friends or relatives.
74
tenfold CE: Our free Identity Governance tool just got 2 new features
tenfold's free Community Edition IGA tool adds Microsoft 365 sharing reviews and identity event auditing.
16
Suspected Chinese spies spoofed an Anthropic exec, ex-White House official in AI phishing
China-linked TA419 phished US AI policy experts by spoofing an Anthropic executive and former White House officials.
74
Microsoft to block Entra ID script injection attacks starting October
Microsoft will enforce Entra ID Content Security Policy in October 2026 to block external script injection during sign-in.
52
Lumma, RedLine and Vidar Infostealers Fuel Cloud Credential Theft Campaigns
Lumma, RedLine, and Vidar steal cloud and developer credentials, enabling session hijacking that bypasses MFA.
62
AI-Powered Phishing Platform EvilTokens Disrupted by Microsoft
Microsoft disrupted EvilTokens, an AI-powered phishing platform that compromised 12,000+ email accounts across 10,000+ organizations.
75
Microsoft: September Windows updates break Always On VPN connections
September 2026 Windows updates break Always On VPN connections when automatic protocol selection is enabled.
45
Microsoft’s EvilTokens takedown sheds light on state of AI-powered cybercrime
Microsoft seized EvilTokens infrastructure after the AI phishing service compromised about 12,000 Microsoft 365 inboxes.
82
Top 10 Best Identity & Access Management (IAM) Solutions in 2026
A 2026 editorial roundup ranks the top ten IAM solutions, naming Microsoft Entra ID, Okta, and Ping Identity as category leaders.
15
GhostCode attackers abuse device codes to take over Microsoft 365 accounts
GhostCode phishing kit abuses Microsoft's OAuth device authorization flow to harvest tokens, register devices, and steal primary refresh tokens from M365 victims.
65
Top 10 Best Microsoft Azure Security Tools in 2026
An editorial roundup of the ten best Azure security tools in 2026 names Defender for Cloud the native floor, with Wiz, Orca, and Prisma Cloud leading third-party options.
15
MFA's Weakest Link: Account Recovery Is the New Attack Path
Help desk account recovery is increasingly the weakest link in MFA-protected identities, as Scattered Spider's impersonation-driven Marks & Spencer attack demonstrated.
32
Microsoft Patch Tuesday, September 2026 Security Update Review
Microsoft's September 2026 Patch Tuesday fixes 974 vulnerabilities, including 113 critical and two actively exploited Windows privilege escalation flaws.
74
The September 2026 Security Update Review
ZDI's September 2026 Microsoft update review lists two already-exploited Windows EoP zero-days and dozens of critical RCEs across Office, SQL Server, and Windows services.
58
Microsoft September 2026 Patch Tuesday fixes 966 flaws, 2 zero-days
Microsoft's September 2026 Patch Tuesday fixes a record 966 flaws, including two Windows zero-days actively exploited to gain SYSTEM privileges.
82
BigBear phishing crew nets thousands of Microsoft 365 credentials
CloudSEC accessed the BigBear 2.0 phishing panel, finding 5,137 stolen Microsoft 365 records across 461 organizations, including 474 MFA-bypassed sessions.
60
IT Help Desk Impersonation Lets Hackers Bypass MFA
Arctic Wolf tracks PREY-0058 posing as IT help desk to steal Microsoft 365 sessions via AiTM panels, then extorting executives after SaaS data theft.
72
Fake IT Calls Target Executives in Microsoft 365 Data Theft and Extortion Attacks
Arctic Wolf tracks PREY-0058, a vishing and AitM token-theft crew targeting Microsoft 365 executives for data theft and extortion.
76
CISA Red Team Compromised Two Critical Infrastructure Orgs, One Detected Nothing
CISA red teams fully compromised two critical infrastructure orgs with similar tradecraft; one detected nothing, the other contained phishing within minutes.
65
Microsoft patches critical Entra ID vulnerability (CVE-2026-69836)
Microsoft patched critical Entra ID RCE CVE-2026-69836 (CVSS 10.0), fully mitigated server-side with no customer action; no in-the-wild exploitation confirmed.
72
McDonald’s Employee Data Appears in Leak, Seller Claims 1.7M Records Stolen
A seller offers 1.7 million McDonald's employee records allegedly taken from its Azure tenant via compromised credentials; an 8,000-row sample verifies as genuine.
60
Week in review: Salesforce and ServiceNow portals exposed for 17 months, exploited Metabase 0-day
Weekly digest: exploited Metabase zero-day breached Framework; Salesforce/ServiceNow portals read for 17 months; Microsoft patched 400+ flaws.
32
Related CVEs
by mentions- CVE-2026-81963<1%7.8Local Privilege Escalation via Link Following in Windows Update Stack
- CVE-2026-85880<1%7.8Heap-Based Buffer Overflow in Windows ALPC Enables Local Privilege Escalation
- CVE-2026-62916<1%9.8Authentication Bypass in Microsoft Entra ID Enables Privilege Elevation
- CVE-2026-65772<1%8.8Deserialization RCE in Microsoft Dynamics 365
- CVE-2026-83941<1%8.8Missing Authorization in Microsoft Entra ID Enables Privilege Escalation
- CVE-2026-81948<1%7.8Heap-Based Buffer Overflow in Microsoft Excel and Office Allows Local Code Execution
- CVE-2026-81951<1%7.8Heap-based Buffer Overflow in Microsoft Excel Enables Local Code Execution
- CVE-2026-58599<1%7.8Heap Buffer Overflow in Microsoft Windows Codecs Library Enables Local Code Execution
- CVE-2026-81959<1%7.8Heap Buffer Overflow in Microsoft Excel Allows Local Code Execution (CVE-2026-81959)
- CVE-2026-62906<1%7.4Query Logic Flaw Enables Info Disclosure in Microsoft Discovery Studio
Appears with
- Microsoftvendor · 24
- Microsoftorganization · 9
- Microsoft 365product · 8
- SharePointproduct · 4
- OneDriveproduct · 4
- Active Directoryproduct · 4
- CISAorganization · 3
- Oktavendor · 3
- Windowsproduct · 3
- PREY-0058threat actor · 2
- IKEv2product · 2
- Windows 11product · 2
- SSTPproduct · 2
- FBIorganization · 2
- SQL Serverproduct · 2
- Copilot Studioproduct · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.