A critical security flaw in #Microsoft's Copilot Studio, tracked as CVE-2024-38206, has been disclosed, potentially exposing sensitive information.

Learn more: https://thehackernews.com/2024/08/microsoft-patches-critical-copilot.html

A critical zero-day vulnerability in Google Chrome has been exploited by North Korean actors to deploy the FudModule rootkit.

#Microsoft links the attack to a Lazarus Group subgroup, notorious for advanced cyber campaigns.

https://thehackernews.com/2024/08/north-korean-hackers-deploy-fudmodule.html

#Microsoft’s September Patch Tuesday addresses 79 vulnerabilities, including 7 critical ones, with 3 under active attack. CVE-2024-43491 (CVSS 9.8) is a major threat with remote code execution risk.

Details here: https://thehackernews.com/2024/09/microsoft-issues-patches-for-79-flaws.html

Patch your systems immediately!

The U.S. Department of Justice and #Microsoft have seized 107 domains used by Russia-linked COLDRIVER hackers to launch phishing attacks, frequently targeting experts in Russian affairs, #privacy advocates, and intelligence officials.

Read: https://thehackernews.com/2024/10/us-and-microsoft-seize-107-russian.html

⚡ 35,000 DDoS attacks in one year—Anonymous Sudan orchestrated this by running a DDoS botnet-for-hire.

Two Sudanese brothers face charges for targeting critical infrastructure and major companies, including #Microsoft, worldwide.

Read: https://thehackernews.com/2024/10/us-charges-two-sudanese-brothers-for.html

⚠️ A high-severity flaw in #Microsoft SharePoint (CVE-2024-38094) has been added to CISA's Known Exploited Vulnerabilities catalog.

Proof-of-concept (PoC) scripts are already public, making exploitation more accessible.

Learn more: https://thehackernews.com/2024/10/cisa-warns-of-active-exploitation-of.html

⚠️ A new phishing wave uses malicious OAuth apps to bypass email and browser defenses, #Microsoft warns.

Victims click links tied to fake app scopes, get redirected through legitimate identity providers, and end up downloading ZIP files that trigger PowerShell, MSI installs, and DLL sideloading.

🔗 Read → https://thehackernews.com/2026/03/microsoft-warns-oauth-redirect-abuse.html

🚨 GitHub is investigating TeamPCP’s claim: ~4,000 internal repositories allegedly stolen and listed for sale ($50,000+).

This comes as the group’s Mini Shai-Hulud worm just hit #Microsoft’s durabletask PyPI package (v1.4.1–1.4.3) — a #Linux-only infostealer that spreads via AWS SSM + Kubernetes.

Worth rotating secrets and scanning your repos.

Full story: https://thehackernews.com/2026/05/github-investigating-teampcp-claimed.html

⚡ ThreatsDay Bulletin (May 28, 2026) – Security teams, here are the 17 key updates you need today.

Key updates:
• Anthropic launches #Claude code security plugin
• Kali365 kit bypasses Microsoft 365 MFA
• 1,300+ malicious C2 servers found in Middle East
• FIFA World Cup 2026 scam surge begins
• #Microsoft patches Azure AKS priv-esc flaw
• Silent Ransom Group impersonates IT support
• GhostTree bypasses Windows security tools
• CISA adds DAEMON Tools to KEV catalog

Plus 9 more: Apple post-quantum crypto release, WaSteal #WhatsApp stealer extensions, fake GitHub installers, and phishing campaigns.

Full bulletin here: https://thehackernews.com/2026/05/threatsday-bulletin-claude-security.html

⚡ #Microsoft is adding a 2-hour delay before VS Code extensions auto-update.

The wait gives maintainers more time to catch bad or compromised releases before they spread further.

⁃ Microsoft, #GitHub, and #OpenAI extensions update instantly
⁃ Manual updates still work anytime
⁃ npm, pnpm, Bun, Yarn, and Bundler added similar delays

Read details: https://thehackernews.com/2026/06/vs-code-adds-2-hour-extension-auto.html

> A worm loose in #Microsoft's own repos.
> A phone flaw is already being used to break in.
> Accounts stolen just by chatting with a support bot.
> A browser update that quietly mined crypto.
> Fake job ads hunting people with security clearances.
> A spy sitting in one inbox for five months.

That was just last week.

Here's everything you missed 👇 https://thehackernews.com/2026/06/weekly-recap-instagram-account-hacks.html

🛑 One trusted Microsoft link could have been enough.

> No fake login page
> No password theft
> No second click

Researchers showed how 3 chained bugs in #Microsoft 365 Copilot Enterprise Search could let an attacker pull emails, calendar data, indexed files, and one-time codes.

See how the attack worked: https://thehackernews.com/2026/06/one-click-microsoft-365-copilot-flaw.html

PureLogs Stealer now hides behind Blogger pages and a fake PDF JavaScript file.

Experts say VEIL#DROP uses PowerShell, dynamic Blogspot URLs, fileless .NET loading, and #Microsoft-signed LOLBins to evade detection.

How the chain unfolds: https://thehackernews.com/2026/07/veildrop-malware-chain-uses-blogger.html

🔥 Alleged Scattered Spider hacker caught by his own Windows device ID.

Per a new court filing, he hid the attack behind proxies and fake names.

But #Microsoft records tied one device ID to his ngrok access, then to his personal accounts and trips. That overlap is how the FBI found him.

Criminals, take notes 🠖 https://thehackernews.com/2026/07/court-filing-reveals-windows-device-id.html

⚡ Microsoft patched RoguePlanet weeks after the Defender flaw was publicly disclosed.

CVE-2026-50656 affects the #Microsoft Malware Protection Engine and could let local attackers gain SYSTEM-level privileges, according to the researcher who disclosed it.

Full story here → https://thehackernews.com/2026/07/microsoft-patches-rogueplanet-defender.html

🚨 Hackers are using fake #Microsoft Entra passkey pages to target Microsoft 365 accounts.

The vishing campaign steals credentials and MFA responses, then attempts to register attacker-controlled passkeys while adapting to prompts in real time.

Read how the attack works: https://thehackernews.com/2026/07/hackers-use-fake-microsoft-entra.html

🛑 One open directory exposed three Microsoft 365 phishing operations.

The operations used two paths into #Microsoft 365: Evilginx session theft and device code phishing. One campaign logged 218 captured accounts across 12 countries, 94% of them corporate mailboxes.

Read the full investigation: http://thehackernews.com/2026/07/misconfigured-server-reveals-three.html

🚨 Hackers spent a year stealing data from #Salesforce environments without exploiting a single platform flaw.

#Microsoft mapped the ShinyHunters-linked activity to trusted OAuth apps, stolen vendor tokens, and misconfigured guest access while sign-in monitoring stayed quiet.

How the three attack paths worked: https://thehackernews.com/2026/07/microsoft-maps-year-long-shinyhunters.html

⚠️ Attackers can validate stolen #Microsoft Entra credentials without generating a successful sign-in event.

Researchers tracked two campaigns using spoofed OAuth client IDs, including one that targeted over 2 million users. App-scoped detections may miss it.

Read why Entra logs may miss it: https://thehackernews.com/2026/07/oauth-client-id-spoofing-lets-attackers.html

🛑 Right after #Microsoft’s July Patch Tuesday, Chaotic Eclipse dropped a Windows 0-Day PoC that still works on every supported desktop and server release.

It is the latest turn in the researcher’s months-long dispute with Microsoft.

Here's what LegacyHive exploit can do - https://thehackernews.com/2026/07/researcher-drops-new-windows-zero-day.html