Microsoft Defender for Office 365 (Product): news timeline & CVEs

As phishing-as-a-service goes industrial, Microsoft takes down a marketplace behind 1 billion messages

Microsoft dismantled YAM Store, a phishing marketplace tied to more than one billion malicious messages.

Microsoft's Digital Crimes Unit says it dismantled YAM Store, a Chinese-language phishing-as-a-service marketplace, after a nearly year-long investigation that began with a late-2025 tip from Japan's National Police Agency. The marketplace and kits including Iron Man System, CoGUI, and Haozi enabled more than 1 billion malicious messages to over 75,000 organizations, including more than 750 million sent to Microsoft customers, and generated tens of millions of dollars. Customers bought fraudulent Microsoft and Google accounts, expired-domain infrastructure, and more than 2,300 lure templates impersonating organizations in over 150 countries. Partners included Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs.

CSO Onlineupdated Oct 16, 11:26 UTC · 16h agofirst Oct 15, 01:20 UTC · 2d agoPhishing & fraud in the wild 13 sources1· 1 read

Microsoft Teams Adds New Security Feature to Detect Malicious QR Codes in Messages

Microsoft Teams will warn users when Defender detects malicious URLs embedded in QR codes in messages.

Microsoft Message Center notice MC1490905 says Teams will scan QR codes in received messages, extract the URLs, and warn recipients if Defender for Office 365 finds a harmful destination. Global rollout begins in early October 2026 and should finish by early November for tenants with Defender for Office 365, with no extra setup. Plan 1 and Plan 2 customers can also use Zero-hour Auto Purge to quarantine eligible internal malware or high-confidence phishing after delivery. Extracted QR links will appear in Defender XDR Advanced Hunting in the MessageUrlInfo table.

GBHackersOct 12, 06:02 UTC · 4d agoTools 2 sources2· 1 read

Microsoft Teams to Warn Users About Malicious Links Hidden in QR Codes

Microsoft Teams will warn users when Defender finds malicious URLs hidden inside QR codes.

Microsoft is adding post-delivery QR code checks to Teams for customers using Defender for Office 365, under Message Center notice MC1490905. Defender extracts web addresses from QR images and warns users, or blocks messages, when destinations are malicious. Worldwide rollout begins in early October 2026 and is expected to finish by early November. Extracted URLs will appear in Microsoft Defender XDR Advanced Hunting in the MessageUrlInfo table with UrlLocation set to QRCode.

Cyber Security Newsupdated Oct 12, 06:02 UTC · 4d agofirst Oct 10, 05:49 UTC · 6d agoTools 2 sources1· 1 read

ASCII smuggling crosses over from AI prompt injection to phishing evasion

Microsoft details high-volume phishing campaign using ASCII smuggling (Unicode tag chars) for filter evasion, peaking at 2.3M messages.

Microsoft researchers observed a high-volume finance-themed phishing campaign using invisible Unicode tag characters (U+E0000–U+E007F), a technique known from AI prompt injection research as ASCII smuggling, to split lure words like 'funding' and evade email filters. Telemetry from Microsoft Defender for Office 365 showed signature hits jump from roughly 21,000 messages on February 8, 2026 to more than 1.3 million on February 9, peaking above 2.3 million on February 11, with elevated weekday activity lasting approximately three months. The discovery emerged from prompt injection protection research, showing AI-era evasion techniques crossing into traditional phishing. Most messages were flagged by layered Defender protections rather than a single Unicode-specific signal.

Microsoft Security BlogSep 3, 16:00 UTC · Sep 3, 2026Phishing & fraud in the wild1

Microsoft Defender for Office 365

Timeline4 articles

Appears with

As phishing-as-a-service goes industrial, Microsoft takes down a marketplace behind 1 billion messages

Microsoft Teams Adds New Security Feature to Detect Malicious QR Codes in Messages

Microsoft Teams to Warn Users About Malicious Links Hidden in QR Codes

ASCII smuggling crosses over from AI prompt injection to phishing evasion