3+ day, 4+ hour ago   (444+ words) Microsoft Security Research said it has observed the cloud-focused intrusions since May 2026. The campaign begins with a phone call or SMS sent to an employee’s personal device. Posing as IT support, the caller claims the target must urgently update a…...

5+ day, 4+ hour ago   (596+ words) A newly documented ransomware intrusion attributed to The Gentlemen shows how attackers can convert a foothold in a Windows environment into domain-wide control by elevating accounts, turning off endpoint defenses, and abusing trusted Active Directory infrastructure to distribute ransomware. The…...

5+ day, 18+ min ago   (634+ words) A human-operated intrusion campaign in which attackers abuse Microsoft Teams external collaboration to impersonate internal IT or helpdesk staff, persuade employees to grant remote control of their PCs, and then move toward critical enterprise infrastructure. The result is a hands-on-keyboard…...

1+ week, 5+ day ago   (578+ words) A coordinated social-engineering campaign dubbed Spring Ring used external Microsoft Teams accounts to impersonate corporate IT help desk staff and target more than 150 employees across at least 10 organizations between January and April 2026. The operation demonstrates how attackers are shifting phishing…...

2+ week, 5+ day ago   (548+ words) Victims can complete a legitimate Microsoft sign-in and MFA challenge, yet unknowingly authorize an attacker-controlled session. The PhaaS operation was advertised on Telegram from mid-February 2026 and was later documented by Sekoia researchers as a turnkey Microsoft device-code phishing kit. Its…...

2+ week, 5+ day ago   (624+ words) A cluster of fraudulent websites impersonating Microsoft is using fake “security scans” to pressure victims into uninstalling antivirus products, disclosing personal and banking information, and granting remote access to their computers. The sites, branded as SysScan, claim to assess whether…...

2+ week, 6+ day ago   (524+ words) The archives carried weaponized LNK files disguised as topical Japanese- and Korean-language documents, including material related to regional events and policy issues. When a recipient launches the shortcut, it executes a concealed command that opens a decoy PDF while downloading…...