60
Search: “Microsoft Defender for Endpoint”
396 stories
Impersonating IT support: how threat actors turn a remote session into enterprise-wide access
Microsoft details Teams IT-support impersonation campaigns deploying Node.js implants, AD reconnaissance, and WinRM lateral movement toward domain controllers.
Microsoft Threat Intelligence describes a human-operated campaign where attackers impersonate IT/helpdesk staff via Microsoft Teams external collaboration, talk users into granting remote sessions, and use RMM tools for interactive access. During the session they run PowerShell to silently install a malicious MSI that stages a portable Node.js runtime and obfuscated JavaScript implant for C2, executing follow-on payloads via rundll32. Operators then perform host and Active Directory reconnaissance, capture desktop screenshots, and pivot via WinRM on port 5985 to domain controllers and certificate authorities. The hands-on-keyboard chain, which can precede data theft and ransomware, blends into normal operations by relying on Teams, Quick Assist, msiexec, and Node.js; Microsoft shares hunting and mitigation guidance.
82
Microsoft March 2022 Patch Tuesday updates fix 89 vulnerabilities
60
March 2022 Patch Tuesday: Microsoft fixes RCEs in RDP client, Exchange Server
60
60
60
60
60
Microsoft Patch Tuesday, July 2022 Edition
60
60
60
60
Microsoft Partch Tuesday for April 2022 fixed 10 critical vulnerabilities
60
60
60
60
60
60
Attackers use passkey-themed scams to hijack Microsoft 365 accounts
Microsoft tracks ongoing M365 cloud intrusions since May using passkey-themed helpdesk vishing, AiTM phishing, and device-code abuse.
Microsoft Security Research has tracked active cloud intrusions since May in which attackers posing as IT helpdesk staff lured employees with fake passkey/MFA enrollment requests. Attacks used adversary-in-the-middle phishing pages, device-code authentication flows, and Teams messages from compromised accounts. Attackers registered their own MFA methods, enumerated tenants via Microsoft Graph, and accessed SharePoint, OneDrive, and Exchange Online data, throttling activity below 1000 files/emails per hour.
78
60
60
60
Week in review: Patched curl and libcurl vulnerability, 15 free M365 security training modules
60
60
60
60
Microsoft Releases Fix for Zero-Day Flaw in July 2022 Security Patch Rollout
60
Microsoft Releases Urgent Patch for SharePoint RCE Flaw Exploited in Ongoing Cyber Attacks
60
60
Microsoft Fixes 78 Flaws, 5 Zero-Days Exploited; CVSS 10 Bug Impacts Azure DevOps Server
60
Passkey-themed social engineering leads to identity and cloud compromise
Microsoft tracks ongoing cloud intrusions where passkey-themed helpdesk lures enable AiTM credential theft, MFA persistence, and SharePoint data theft.
Microsoft Security Research is tracking active cloud-based intrusions, observed since May 2026, that begin with helpdesk impersonation calls and SMS lures urging urgent passkey, MFA, or SSO updates. The lures lead to adversary-in-the-middle phishing or device-code authentication flows that capture credentials and session tokens or grant actor access, after which the actors add authentication methods, conduct Microsoft Graph reconnaissance, and download SharePoint and OneDrive content via REST APIs. Phishing domains embed victim organization names as subdomains (e.g., contoso.add-passkey[.]com), are often registered with Nicenic, and go operational within hours. Microsoft advises revoking sessions and removing unauthorized authentication methods for confirmed compromises.
76
Microsoft fixes actively exploited zero-days (CVE-2024-43451, CVE-2024-49039)
60
60
60
Microsoft pins on-prem SharePoint attacks on Chinese threat actors
60
60
60
60
60
60