All news with #microsoft tag

🔐 Microsoft Deputy CISO Ilya Grebnov outlines practical steps to make opportunistic cyberattacks harder by design. He emphasizes credential elimination using managed identities and federated tokens, paired with endpoint reduction to move services off the public internet. The article further advocates platform engineering—paved paths, policy-as-code, and centralized core services—to enforce consistent secure defaults and reduce the attack surface at scale.

🔒 Microsoft warns that threat actors are increasingly abusing external Microsoft Teams collaboration to impersonate IT or helpdesk staff and gain remote access. Attackers initiate cross-tenant chats to request remote assistance—commonly via Quick Assist—then perform reconnaissance and deploy small payloads into user-writable locations. They abuse trusted, signed applications for execution and use HTTPS-based C2 and tools like Rclone to exfiltrate filtered, high-value data, often blending into normal traffic. Administrators are urged to treat external Teams contacts as untrusted, restrict remote-assistance tools, and limit WinRM usage.

🔒 Microsoft warns that attackers are exploiting Microsoft Teams cross-tenant features to impersonate IT helpdesk staff and trick employees into granting remote control. The cross-tenant helpdesk impersonation playbook leverages real-time chats, social engineering, and legitimate remote-support tools so access appears user-approved and avoids typical malware detections. Organizations are urged to tighten external access, restrict support workflows, enforce Zero Trust controls, and improve behavioral monitoring.

⚡Microsoft is rolling out a set of File Explorer enhancements to Windows 11 Insiders that aim to improve launch speed and overall performance. While implementation details are limited, the company earlier tested optional background preloading to accelerate startup times and offers a toggle to disable that behavior. The update also improves reliability around stopping explorer.exe after closing windows and expands fixes for bright white flashes in dark mode. A new full-screen Xbox mode is available as well; changes are arriving for Release Preview Insiders on Builds 26100.8313 and 26200.8313 (KB5083631).

🔧 Microsoft has reverted a service update that prevented some customers from launching the Microsoft Teams desktop client, leaving affected users stuck on a loading screen with the error “We're having trouble loading your message. Try refreshing.” The vendor traced the failure to a transient service infrastructure issue and a regression in the client build caching system. Microsoft says its automated recovery system remediated the impact and advises users to fully quit and restart Teams so the fix can propagate.

⚠️Microsoft has released out-of-band updates to address multiple issues affecting Windows Server systems after the April 2026 cumulative patches. An installation failure impacting KB5082063 on Windows Server 2025 and LSASS crashes that can force domain controllers into restart loops are the primary problems. Microsoft published OOB fixes for Server 2025 (KB5091157) — which resolves both issues — and separate updates for 23H2, 2022, 2019, 2016 and Azure hotpatch editions; some Server 2025 devices may also enter BitLocker recovery after KB5082063.

🔧 A recent Microsoft Edge update introduced a code regression that breaks right-click paste in the Microsoft Teams desktop client, leaving the Paste option greyed out in chat context menus. Microsoft advises using keyboard shortcuts (Ctrl+C/Ctrl+V on Windows, Cmd+C/Cmd+V on macOS) as an immediate workaround. The company says it identified the cause in Edge and is rolling out a staged fix while monitoring telemetry.

🔐 Microsoft Defender Security Research outlines a human-operated intrusion playbook where attackers abuse cross-tenant Microsoft Teams collaboration to impersonate IT/helpdesk staff and socially engineer users into granting remote assistance. With user consent, adversaries gain interactive access via Quick Assist or similar tools, then execute attacker modules by side-loading them into trusted vendor-signed applications. The chain leverages native administrative protocols such as WinRM and commercial RMM tooling to move laterally and stage sensitive business data for exfiltration. Microsoft Defender provides correlated identity, endpoint, and collaboration telemetry to surface and disrupt this pathway.

🔒 Huntress warns that threat actors are actively exploiting three recently disclosed Microsoft Defender vulnerabilities — codenamed BlueHammer, RedSun, and UnDefend — to gain elevated privileges and disrupt defenses. Microsoft addressed BlueHammer in this week's Patch Tuesday as CVE-2026-33825, but RedSun and UnDefend remain unpatched and have PoCs observed in the wild. Huntress reported weaponization beginning April 10 for BlueHammer and April 16 for RedSun and UnDefend, and said it isolated affected environments while investigating post-exploitation activity.

🛡️ A new proof-of-concept called RedSun demonstrates that Microsoft Defender can be manipulated to overwrite protected system files and escalate privileges to SYSTEM on Windows 10 and 11 systems with cloud files features enabled. The exploit leverages Defender’s special handling of cloud-tagged files, which can trigger a rewrite to disk during remediation, allowing attackers to influence timing and destination. Researchers reproduce the issue using the Cloud Files API, oplocks, Volume Shadow Copy race conditions, and directory junctions; detection is limited and Microsoft has not yet commented.

⚠️After installing the April 2026 Windows security update (KB5082063), some non‑Global Catalog domain controllers configured with Privileged Access Management (PAM) may experience Local Security Authority Subsystem Service (LSASS) crashes during startup. Affected servers can enter repeated reboot loops, disrupting authentication and directory services and potentially rendering domains unavailable. Microsoft is investigating and advises administrators to contact Microsoft Support for Business for mitigation options until a permanent fix is released.

⚠️ A proof-of-concept for a second Microsoft Defender zero-day, dubbed RedSun, was published by researcher 'Chaotic Eclipse', demonstrating a local privilege escalation that grants SYSTEM privileges on patched Windows 10, Windows 11, and supported Windows Server releases when Defender is enabled. The PoC exploits Defender's handling of cloud-tagged files via the Cloud Files API to overwrite system binaries and achieve code execution as SYSTEM. Security analyst Will Dormann of Tharros confirmed the exploit works; some antivirus products detect elements of the PoC due to an embedded EICAR test file. The researcher says the publication was a protest over interactions with the Microsoft Security Response Center.

🔐 Post-quantum cryptography is imminent, and Microsoft emphasizes that the biggest challenge is locating every use of cryptography across applications, devices, networks, and services. Building a comprehensive, ongoing cryptographic inventory enables risk-based decisions, crypto agility, and regulatory compliance. The article outlines a practical Cryptography Posture Management lifecycle and recommends Microsoft tools—GitHub Advanced Security, Defender suites, Azure Key Vault—and partner integrations to discover, normalize, assess, prioritize, and remediate cryptographic risks.

🛡️ This week's bulletin highlights both legacy and emerging threats, including a published Microsoft Defender privilege escalation exploit (RedSun) and a 17‑year‑old Excel RCE (CVE‑2009‑0238) newly added to CISA's KEV. Incidents range from a Zerion hot-wallet compromise (~$100K stolen through AI‑enabled social engineering) to a fake macOS Ledger app that drained about $9.5M. Researchers also disclosed novel C2 frameworks, a WordPress plugin supply-chain backdoor affecting 180k+ installs, and a surge in SonicWall/FortiGate brute-force probing. The collection underscores the need to patch promptly, validate app-store integrity, rotate credentials, and audit third-party dependencies.

🛡️ A security researcher says Microsoft’s Windows Recall feature remains vulnerable to quiet exfiltration of everything it captures by malware running in the same user context. Alexander Hagenah published a proof-of-concept called TotalRecall Reloaded and disclosed the issue to Microsoft on March 6; Microsoft reviewed and closed the report April 3, calling the behavior "by design." Hagenah says the gap lies not in encryption but in how decrypted screenshots and text are handled and displayed in an unprotected process, allowing same-user code to read Recall data without admin rights or kernel exploits.

📧 In Q1 2026, Check Point Research found Microsoft was the most impersonated brand in phishing campaigns, accounting for 22% of brand impersonation attempts. Apple (11%), Google (9%), Amazon (7%) and LinkedIn (6%) followed, reflecting attackers’ focus on both enterprise and consumer ecosystems tied to identity, devices and payments. The report underscores a persistent trend: threat actors exploit trusted brands to harvest credentials and gain initial access to personal and corporate environments.

⚠️ Microsoft is investigating reports that the April KB5082063 cumulative security update fails to install on some Windows Server 2025 systems, with affected devices returning 0x800F0983 installation errors. The company says it is monitoring diagnostic telemetry and observed recurring failures after the April 14, 2026 release. A limited number of servers may also boot into BitLocker recovery and request recovery keys, a condition Microsoft says typically affects enterprise-managed configurations. Microsoft is continuing its investigation and will share additional details as they become available.

🛡️ Microsoft awarded $2.3 million to security researchers after receiving nearly 700 submissions during this year’s Zero Day Quest hacking contest, compensating teams for high‑impact cloud and AI vulnerabilities uncovered at the live event. Participants from more than 20 countries tested within authorized environments under Microsoft’s Rules of Engagement and demonstrated issues such as credential exposure, SSRF chains, and cross‑tenant access without accessing customer data. The contest is part of the Secure Future Initiative, and Microsoft said findings will be shared through the CVE program to strengthen cloud and AI security.

⚠️ CISA warned federal agencies that a Windows Task Host privilege escalation flaw, tracked as CVE-2025-60710, is being treated as actively exploited and must be patched. The issue affects Windows 11 and Windows Server 2025 and arises from a link-following weakness in the Task Host that lets a local user with basic permissions elevate to SYSTEM. Agencies were given two weeks under BOD 22-01 to remediate; CISA urges all organizations to apply the patch or vendor mitigations immediately.

🔒 April's Patch Tuesday addresses critical vulnerabilities across major vendors. Patches fix a near-critical SQL injection in SAP (CVE-2026-27681) that enables arbitrary database commands, an actively exploited RCE in Adobe Acrobat Reader (CVE-2026-34621), and numerous high-severity Microsoft, Fortinet, and ColdFusion issues. FortiSandbox fixes close authentication-bypass and command-injection holes, while Adobe's ColdFusion updates remediate multiple code execution and path-traversal flaws. Organizations should prioritize vendor updates and apply mitigations where immediate patching is not possible.