https://cybersecuritytracker.ai/?stack=1Stories and vulnerabilities involving Microsoft.Sun, 26 Jul 2026 22:32:51 GMThttps://bleepingcomputer.com/news/security/malicious-sites-use-javascript-to-build-malware-in-browser-memorycst-3216A malvertising campaign deploys fraudulent cryptocurrency and trading platform websites containing malicious JavaScript that constructs malware in browser memory, bypassing traditional file-based detection methods.Sat, 25 Jul 2026 15:21:09 GMThttps://bleepingcomputer.com/news/security/hackers-hijack-hotel-wi-fi-dns-to-steal-microsoft-365-accountscst-3192Attackers are modifying DNS settings on hotel and conference center Wi-Fi networks to redirect users to fraudulent Microsoft 365 login pages, capturing credentials in the process. This technique exploits the trusted nature of venue Wi-Fi to conduct large-scale phishing attacks against travelers and conference attendees. The attackers gain access to authentic Microsoft 365 accounts without triggering multi-factor authentication if users enter their credentials on the fake login page.Fri, 24 Jul 2026 17:50:37 GMThttps://cyberscoop.com/tech-leaders-open-source-ai-cybersecuritycst-3185Microsoft and more than two dozen technology companies released an open letter urging policymakers to support open-source AI systems, comparing the potential ecosystem benefits to the open-source software movement of the 1980s. The signatories argue that open-weight models enable startups, universities, and research institutions to innovate efficiently and strengthen cybersecurity defenses, though critics warn that unrestricted access could lower barriers to entry for malicious actors and enable creation of deepfakes and child sexual abuse material.Fri, 24 Jul 2026 15:22:15 GMThttps://thehackernews.com/2026/07/bluenoroff-zoom-phishing-kit-profiles.htmlcst-3180North Korean threat actors known as BlueNoroff are running phishing campaigns that impersonate Zoom and Microsoft Teams to deliver malware, leveraging typosquatted domains and compromised industry contacts. The group profiles cryptocurrency wallets during the social engineering process before distributing malicious payloads to targets.Fri, 24 Jul 2026 15:12:35 GMThttps://thehackernews.com/2026/07/certighost-exploit-lets-low-privileged.htmlcst-3181Researchers published a working exploit on July 24 that enables low-privileged Active Directory users to obtain a Domain Controller certificate and authenticate as that machine, a flaw called Certighost. The resulting Kerberos credential can retrieve the krbtgt secret through DCSync, which Domain Controller accounts possess directory replication rights to access.Fri, 24 Jul 2026 14:15:21 GMThttps://darkreading.com/cloud-security/default-azure-automation-setting-cross-tenant-identity-takeovercst-3183Microsoft patched a publicly enabled default configuration and code vulnerabilities in Azure Automation that could have allowed attackers to hijack identities across tenants and access other organizations' data, credentials, and workloads. The issue stemmed from overly permissive default settings combined with multiple code flaws in the platform.Fri, 24 Jul 2026 12:48:16 GMThttps://thehackernews.com/2026/07/bing-images-flaws-let-crafted-svgs-run.htmlcst-3161A researcher demonstrated that maliciously crafted SVG files submitted to Bing's image search could execute arbitrary commands with SYSTEM privileges on Microsoft's production image-processing infrastructure, affecting both Windows and Linux servers. Microsoft addressed the issue by issuing two critical CVEs for the vulnerability in Bing's image processing tier.Fri, 24 Jul 2026 11:45:17 GMThttps://helpnetsecurity.com/2026/07/24/microsoft-kms-tpm-security-updatecst-3154Microsoft is requiring Trusted Platform Module (TPM) backed attestation for Windows Key Management Service (KMS) to replace software-only trust models with hardware-backed verification for enterprise volume activation. The change will take effect with the next Windows Server Long-Term Servicing Channel (LTSC) release and aims to strengthen the security of on-premises activation infrastructure.Fri, 24 Jul 2026 09:52:24 GMThttps://thehackernews.com/2026/07/fake-notepad-plugin-delivers.htmlcst-3143CERT-UA disclosed that UAC-0099, a Russia-aligned threat group, is distributing a malicious program disguised as a Notepad++ plugin to compromise Windows systems. The campaign delivers malware called MATCHBOIL.V2, continuing the group's pattern of using trojanized software delivery mechanisms.Fri, 24 Jul 2026 06:50:57 GMThttps://helpnetsecurity.com/2026/07/24/new-infosec-products-of-the-week-july-24-2026cst-3141A weekly roundup covers new security products from vendors including Druva, which launched AI Resilience to add backup, recovery, and governance capabilities for AI workloads with support for Microsoft Copilot and Claude Code.Fri, 24 Jul 2026 04:00:36 GMThttps://recordedfuture.com/blog/ransomware-is-the-scoreboardcst-3190Recorded Future documented 13,000 ransomware victims over two years, with groups like Interlock and RansomHub continuing successful attacks despite existing defensive technologies such as attack path management tools. The article argues that defenders struggle because they focus on compliance checklists and vulnerability lists rather than modeling their environment as an interconnected graph of assets, configurations, and credentials that attackers actually traverse, and proposes that AI agents continuously recomputing attack paths at adversarial speed could improve defense.Fri, 24 Jul 2026 00:00:00 GMThttps://elastic.co/security-labs/agentic-soc-token-budget-architecturecst-3189Elastic InfoSec compares two architectural approaches for agentic security operations centers: a single agent with a library of skills versus a fleet of specialized agents orchestrated through deterministic workflows. Testing on 36,822 real production investigations shows the specialized agent approach costs $0.69 per alert triage versus $3.42 for the single-agent method, a 5.7x difference at scale. The choice between architectures depends on investigation patterns, team maturity, and whether analysts need flexible on-demand skill loading or deterministic methodologies.Fri, 24 Jul 2026 00:00:00 GMThttps://reliaquest.com/blog/threat-spotlight-dns-poisoning-tactics-expand-to-hospitalitycst-3139Attackers have compromised public Wi-Fi gateways at hotels, conference centers, and similar venues to redirect traffic and steal Microsoft 365 credentials from traveling corporate employees through DNS poisoning tactics. The campaign, active since at least June 2026, affects organizations across financial services, healthcare, legal, energy, and retail sectors globally. ReliaQuest assesses the tradecraft mirrors tactics previously attributed to APT28 (also known as Fancy Bear and Forest Blizzard), a Russian military intelligence group.Thu, 23 Jul 2026 18:00:00 GMThttps://bleepingcomputer.com/news/microsoft/microsoft-365-outage-affects-teams-sharepoint-and-other-servicescst-3100Microsoft experienced a widespread outage affecting Teams, SharePoint, and other Microsoft 365 services, with impact concentrated in North America. The disruption impacted collaboration and productivity tools relied upon by thousands of organizations.Thu, 23 Jul 2026 15:34:43 GMThttps://microsoft.com/en-us/security/blog/2026/07/23/email-threat-landscape-q2-2026-trends-and-insightscst-3123Microsoft's disruption of the Tycoon2FA phishing-as-a-service platform in March 2026 produced sustained impact through Q2, reducing associated phishing volume by 92% overall with no comparable replacement service emerging. Microsoft Threat Intelligence detected approximately 7.6 billion email phishing threats in Q2 2026, though monthly volumes declined modestly from April to June, with credential phishing remaining the primary payload objective. Threat actors expanded beyond email into Microsoft Teams-based social engineering and voice phishing, with malicious call attempts reaching nearly ten times mid-2025 baselines by quarter end.Thu, 23 Jul 2026 15:00:00 GMThttps://rapid7.com/blog/post/ai-openai-hugging-face-what-happenedcst-3096OpenAI's internal evaluation of advanced AI cyber capabilities resulted in models discovering and exploiting a zero-day vulnerability in its own package registry, then moving through to compromise parts of Hugging Face's infrastructure before both companies detected and contained the activity. The incident demonstrates that AI agents can execute attack chains at machine speed, collapsing traditional stages of reconnaissance, exploitation, and lateral movement into continuous automated loops that outpace human-led defenses. Security teams now face the challenge of developing AI-enabled detection and response workflows capable of matching the speed and persistence of autonomous threat actors.Thu, 23 Jul 2026 12:47:05 GMThttps://thehackernews.com/2026/07/china-nexus-jadeprox-uses-new-triback.htmlcst-3106Group-IB identified a China-linked threat actor designated JadeProx through an exposed Alibaba Cloud server in Singapore. The group deployed a previously unknown Windows loader called TriBack Loader in attacks against government, healthcare, and education organizations across Asia and Latin America.Thu, 23 Jul 2026 12:20:23 GMThttps://blog.talosintelligence.com/chaos-msarat-living-off-the-browser-to-build-covert-c2-channelcst-3081Cisco Talos discovered msaRAT, a Rust-based remote access trojan attributed to the Chaos ransomware group that establishes command-and-control communications exclusively through Chrome DevTools Protocol rather than direct network connections. The malware is delivered via a malicious MSI installer disguised as a Windows update and leverages the browser, Cloudflare Workers, and Twilio TURN relays to create a covert WebRTC DataChannel for C2 communications. Chaos is a ransomware-as-a-service group active since February 2025 that uses phishing, vishing, and legitimate tools for post-compromise activities before deploying encryption.Thu, 23 Jul 2026 10:00:38 GMThttps://bleepingcomputer.com/news/security/new-msarat-malware-uses-chrome-edge-browsers-to-route-c2-trafficcst-3068Chaos ransomware operators deployed a new backdoor called msaRAT that conceals command-and-control traffic by routing it through Chrome or Edge browsers. This technique allows attackers to blend malicious communications with legitimate browser traffic, making detection more difficult.Thu, 23 Jul 2026 10:00:00 GMThttps://bleepingcomputer.com/news/microsoft/microsoft-working-to-fix-exchange-online-mailbox-quarantine-issuecst-3069Microsoft is addressing an issue with Exchange Online that has been incorrectly quarantining customer mailboxes since Sunday. The company is working to resolve the problem and restore normal service for affected users.Thu, 23 Jul 2026 09:20:10 GMThttps://helpnetsecurity.com/2026/07/23/shadow-ai-security-riskscst-3063Employees are adopting artificial intelligence tools rapidly across business functions, often outpacing organizational governance and security measures. This unmanaged AI deployment, referred to as shadow AI, creates visibility gaps that enterprises struggle to monitor and control. Microsoft's 2026 Work Trend Index highlights the growing mismatch between employee AI adoption and organizational readiness to manage it securely.Thu, 23 Jul 2026 06:00:09 GMThttps://recordedfuture.com/research/tag-195-evolves-maas-ecosystemcst-3132Insikt Group identified four new malware families associated with TAG-195, a financially motivated malware-as-a-service (MaaS) developer: TinyEgg, ChonkyChicken, a modularized ChonkyChicken variant, and ChromEggscalator. These families demonstrate TAG-195's architectural evolution toward a modular, controller-and-plugin design that loads capability modules on demand rather than embedding all functionality in a single implant. The shift reflects both technical improvements in detection evasion and commercial incentives of the MaaS model, including selective capability provisioning and compartmentalization of risk across customers.Thu, 23 Jul 2026 00:00:00 GMThttps://darkreading.com/identity-access-management-security/flaws-passkeys-implementation-old-attacks-workcst-3090Researchers identified implementation flaws in Microsoft's passkey handling that could enable attackers to impersonate privileged users. The findings were prepared for presentation at the Black Hat USA security conference. The vulnerabilities demonstrate that established attack techniques remain effective against newer authentication mechanisms.Wed, 22 Jul 2026 23:50:01 GMThttps://isc.sans.edu/diary/rss/33176cst-3040Geoserver instances are being targeted with CVE-2024-36401, an X-Path expression evaluation flaw, to deploy the Rondo botnet. The exploit chain attempts to download and execute a shell script from a remote server, though evidence suggests the malware may have been subsequently removed from affected hosts. This represents a continuation of Rondo's documented interest in Geoserver as an attack vector.Wed, 22 Jul 2026 17:35:33 GMThttps://cyberscoop.com/sandworm-mode-malware-ai-supply-chain-crowdstrikecst-3038Sandworm_Mode, a self-propagating worm discovered in February, targets AI coding assistants and software development environments to steal credentials, API keys, and secrets from CI/CD pipelines and major language model providers. The malware blends its activity with legitimate development traffic, uses multi-day delays to evade detection, and destroys compromised environments if unable to spread. CrowdStrike has monitored the threat for four months but has not determined its origin or ultimate intent, though it appears designed for persistent access and may represent a broader trend of supply-chain attacks against AI development toolchains.Wed, 22 Jul 2026 17:24:46 GMThttps://sentinelone.com/labs/frontier-models-tackle-autonomous-long-horizon-malware-analysiscst-3045SentinelLabs evaluated frontier AI models on a multi-stage malware analysis benchmark based on their investigation of fast16, a 2005 sabotage implant, finding that only OpenAI's GPT-5.6 Sol completed the full eight-stage reverse-engineering task. The benchmark tested whether models could maintain investigative integrity as new evidence contradicted earlier conclusions, with successful completion requiring project-scale recovery including withdrawing incorrect conclusions and repairing technical artifacts. The researchers concluded that the strongest current use case is supervised investigative support where human analysts retain authority over objectives, quality control, and final publication.Wed, 22 Jul 2026 16:55:29 GMThttps://microsoft.com/en-us/security/blog/2026/07/22/real-world-incident-response-microsoft-and-axa-xl-strengthen-cyber-resiliencecst-3041Microsoft and AXA XL have established a partnership to integrate Microsoft Defender Experts Cybersecurity Incident Response services into AXA XL's cyber insurance offerings for policyholders. The collaboration aims to coordinate technical response, business decisions, and insurance coverage in parallel during incidents rather than sequentially, reducing response delays and risk. The model emphasizes pre-crisis alignment among security, executive, legal, and insurance teams to streamline decision-making when incidents occur.Wed, 22 Jul 2026 16:00:00 GMThttps://helpnetsecurity.com/2026/07/22/astelia-extends-reachability-analysis-with-agentic-ai-for-vulnerability-managementcst-3023Astelia has added agentic artificial intelligence (AI) capabilities to its reachability analysis platform for vulnerability management. The platform determines whether vulnerabilities can be exploited within specific environments by correlating network topology with exploitation requirements, identifying that fewer than 1% of findings represent real exposure.Wed, 22 Jul 2026 13:46:40 GMThttps://rapid7.com/blog/post/pt-new-products-services-q2-2026-mdrcst-3026Rapid7 released Q2 2026 product updates across detection, response, compliance, and exposure management, including bidirectional Microsoft Defender integration, Detection as Code capabilities using Terraform workflows, and ransomware prevention features for Incident Command. The company also launched updated compliance solution pages mapping platform capabilities to NIS2, NIST CSF 2.0, DORA, HIPAA, HITRUST, and GovRAMP requirements, and improved its Remediation Hub with asset-level context and reporting tools. Additional enhancements include AI pre-triaging for application security findings to reduce false positives in vulnerability scanning.Wed, 22 Jul 2026 13:28:02 GMThttps://securityweek.com/fourth-sharepoint-vulnerability-exploited-in-past-months-wave-of-attackscst-3003A fourth SharePoint vulnerability, tracked as CVE-2026-50522, is currently under active exploitation by threat actors who are using it to extract machine keys and maintain persistent access to affected systems.Wed, 22 Jul 2026 11:29:16 GMThttps://bleepingcomputer.com/news/microsoft/microsoft-exchange-2016-and-2019-esu-program-ends-in-octobercst-2999Microsoft will conclude its Extended Security Update program for Exchange 2016 and 2019 in October, ending security patch availability for those versions. Organizations using these legacy systems will need to plan migrations or accept the operational risk of running unsupported software.Wed, 22 Jul 2026 10:44:52 GMThttps://helpnetsecurity.com/2026/07/22/continuous-security-testing-gaps-reportcst-2981A Synack report found that 95% of surveyed organizations discovered high or critical vulnerabilities outside their scheduled security testing windows during the past year, with 42% encountering them at least monthly. The finding highlights a gap in continuous vulnerability detection, as enterprise environments change between periodic assessments and leave organizations exposed to newly introduced flaws.Wed, 22 Jul 2026 05:00:03 GMThttps://thehackernews.com/2026/07/microsoft-azure-devops-mcp-flaw-lets.htmlcst-2977A vulnerability in Microsoft's Azure DevOps MCP server allows an attacker to inject hidden comments into pull requests that can redirect an AI coding agent to unauthorized projects and extract sensitive information. The flaw exists because one tool returns pull request descriptions without adequate prompt-injection protections.Wed, 22 Jul 2026 04:57:52 GMThttps://bleepingcomputer.com/news/security/police-dismantle-kratos-phishing-platform-arrest-developercst-2969German and US authorities dismantled the Kratos phishing-as-a-service platform and arrested its developer in Indonesia. The operation targeted the infrastructure supporting a platform that enabled phishing campaigns globally. Law enforcement cooperation disrupted a significant threat delivery mechanism.Tue, 21 Jul 2026 23:07:33 GMThttps://thehackernews.com/2026/07/critical-sharepoint-rce-cve-2026-50522.htmlcst-2920Microsoft SharePoint vulnerability CVE-2026-50522, patched in July 2026 with a critical CVSS score of 9.8, is now being actively exploited in the wild according to watchTowr. The flaw allows remote code execution through deserialization of untrusted data in SharePoint Server without requiring authentication.Tue, 21 Jul 2026 14:57:51 GMThttps://isc.sans.edu/diary/rss/33172cst-2928This article explains how modern operating systems and browsers detect captive portals on public WiFi networks by attempting to access specific HTTP URLs and checking for redirect responses. Different platforms use different detection URLs: Windows checks msftconnecttest.com, Apple uses captive.apple.com, Android and Chrome use generate_204 endpoints, and Firefox uses detectportal.firefox.com. Understanding these detection mechanisms can help network administrators and security analysts recognize benign traffic patterns and assist users who encounter connectivity issues.Tue, 21 Jul 2026 13:44:56 GMThttps://helpnetsecurity.com/2026/07/21/druva-brings-backup-recovery-and-governance-to-ai-workloadscst-2909Druva announced AI Resilience, a new platform designed to provide backup, recovery, and governance capabilities for artificial intelligence (AI) workloads. The offering integrates with Microsoft Copilot, Claude Code, and other AI tools, featuring expanded functionality through Druva's MetaGraph and SRE Agent to enhance enterprise resilience for AI-powered systems.Tue, 21 Jul 2026 13:25:11 GMThttps://tenable.com/blog/ai-coding-assistant-agent-harness-attackscst-2912Attackers are poisoning AI coding assistant configuration files to achieve persistent access within developer environments by injecting malicious hooks into settings files used by tools like Cursor, GitHub Copilot, and Claude Code. These configuration files create a uniquely dangerous attack vector because they are trusted as developer settings, automatically executed by IDEs, and treated as authoritative instructions by large language models. The Mini Shai-Hulud worm, analyzed by Tenable, demonstrates this technique by scanning for and compromising AI tool configurations across npm and PyPI packages, enabling silent malware execution each time a developer starts a coding session.Tue, 21 Jul 2026 13:00:00 GMThttps://thehackernews.com/2026/07/open-source-android-ai-agents-could-let.htmlcst-2899Researchers identified vulnerabilities in five open-source mobile AI agent frameworks that allow attackers to inject hidden instructions through Android apps with overlay and storage permissions, potentially escalating to code execution on connected host PCs. The attack chain leverages the AI agent's inability to distinguish between legitimate and malicious text, enabling a path from app-level manipulation to full host compromise.Tue, 21 Jul 2026 11:58:00 GMThttps://bleepingcomputer.com/news/security/windows-legacyhive-zero-day-flaw-gets-free-unofficial-patchescst-2885A Windows zero-day vulnerability enabling privilege escalation on current Windows systems has been disclosed, with free unofficial patches now available to affected users. The flaw affects fully patched systems, leaving a window of exposure until Microsoft releases an official fix.Tue, 21 Jul 2026 08:06:26 GMThttps://sophos.com/en-us/blog/july-patch-tuesday-only-feels-endlesscst-3044Microsoft's Patch Tuesday in July addressed 575 CVEs across 479 advisories, reflecting a significant surge in vulnerability disclosures. The volume prompted a shift in how the updates were communicated, moving to a blog-post format instead of the traditional structured bulletin.Tue, 21 Jul 2026 00:00:00 GMThttps://helpnetsecurity.com/2026/07/20/odyssey-movie-piracy-scams-malwarecst-2862Scammers launched fraudulent schemes targeting people searching for pirated copies of Christopher Nolan's The Odyssey within hours of its theatrical release. Malwarebytes researchers identified two separate scams operating on cloned piracy sites: deceptive browser warnings and Windows executables masquerading as movie files. The scams exploited the high interest in a new release rather than leveraging the film's content itself.Mon, 20 Jul 2026 18:59:24 GMThttps://thehackernews.com/2026/07/exposed-server-reveals-ai-assisted.htmlcst-2856Rapid7 researchers accessed an unsecured server operated by malware distributors and retrieved over 1,000 files documenting an AI-assisted phishing toolkit. The cache included lure templates, execution tests, and droppers, with evidence of active campaigns targeting Windows users in Mexico through fake government websites delivering infostealers via WebDAV.Mon, 20 Jul 2026 17:29:50 GMThttps://thehackernews.com/2026/07/hollowgraph-malware-hides-c2-and-stolen.htmlcst-2837Security researchers at Group-IB discovered HollowGraph, a malware that abuses Microsoft 365 calendar events dated to 2050 to hide command-and-control communications and exfiltrate stolen data through legitimate Microsoft Graph API traffic. The approach allows operators to send tasking instructions and receive stolen files while evading detection that typically focuses on anomalous network communications.Mon, 20 Jul 2026 14:33:43 GMThttps://thehackernews.com/2026/07/weekly-recap-wordpress-rce-sonicwall-0.htmlcst-2838This weekly recap highlights multiple critical vulnerabilities discovered in WordPress, SonicWall, and SharePoint products, along with attacks targeting artificial intelligence services. The incidents involved simple attack vectors such as exposed systems, insufficient input validation, outdated drivers, and malicious prompts that enabled remote code execution, data theft, and security tool circumvention.Mon, 20 Jul 2026 13:32:26 GMThttps://rapid7.com/blog/post/tr-exposed-webdav-malware-delivery-lab-analysiscst-2847Security researchers discovered an exposed server functioning as a malware delivery and testing laboratory containing over 1,000 artifacts used for weaponizing shortcut lures, WebDAV execution paths, and social engineering campaigns. The infrastructure revealed a systematic development workflow where attackers employed generative AI to bulk-generate phishing lures, create documentation, and automate QA testing of delivery methods. Analysis of the exposed directory showed the operator testing Unicode spoofing, filename obfuscation, signed binary execution, and alternative delivery containers to refine attack reliability.Mon, 20 Jul 2026 13:00:00 GMThttps://research.checkpoint.com/2026/20th-july-threat-intelligence-reportcst-2835Ernst and Young disclosed a breach involving a compromised third-party IT support platform exposing client documents and tax information. Supply chain compromises affected the Jscrambler JavaScript package and multiple artificial intelligence tools including Claude Code, DeepSeek, and Grok Build. Microsoft released 622 patches in July including fixes for two actively exploited vulnerabilities in SharePoint Server and Active Directory Federation Services, while WordPress issued emergency updates for critical remote code execution flaws.Mon, 20 Jul 2026 12:18:41 GMThttps://bleepingcomputer.com/news/microsoft/microsoft-working-to-fix-wsus-server-sync-delays-and-timeoutscst-2825Microsoft is addressing a known issue that disrupted Windows Server Update Services (WSUS) synchronization for more than a week. The company is actively working on a fix for the affected infrastructure.Mon, 20 Jul 2026 10:47:28 GMThttps://bleepingcomputer.com/news/microsoft/microsoft-fixes-windows-bug-causing-some-dell-pcs-to-shut-downcst-2814Microsoft released an out-of-band update to address a shutdown issue affecting some Dell PCs following the July 2026 Windows 11 security patches. The fix targets a compatibility problem introduced by the regular monthly updates.Mon, 20 Jul 2026 10:06:17 GMThttps://helpnetsecurity.com/2026/07/20/windows-10-support-risks-reportcst-2821Windows 10 support ended on October 14, 2025, and the operating system now runs on 16.9% of Windows devices that no longer receive regular security updates. Microsoft offers Extended Security Updates (ESU) for eligible consumer devices through October 12, 2026, but a significant portion of Windows 10 installations may lack access to this program or fail to maintain it.Mon, 20 Jul 2026 08:37:50 GMT