“Microsoft”

Threat group O UNC 066 uses phone-based phishing to trick employees into registering attacker-controlled Entra passkeys to hijack accounts.

GigaWiper backdoor combines disk-wiping, overwriting, and fake ransomware behaviors to deliver destructive Windows intrusions.

Researchers detail GodDamn ransomware's use of a signed PoisonX kernel driver to disable security tools and evade detection.

Microsoft released fixes for the RoguePlanet Defender zero-day (CVE-2026-50656), addressing privilege escalation in the Malware Protection Engine.

CISA reports active exploitation of a patched SharePoint RCE; prioritize remediation across SharePoint servers.

Active exploitation of the Microsoft Defender privilege escalation flaw CVE-2026-33825 is fueling ransomware campaigns. Patches available; prioritise rapid remediation.

Threat actors redirect audit logs and telemetry to attacker storage; tighten bucket controls.

Fortinet VPN credential exposure affects ~73k devices; patch now and rotate credentials to reduce risk.

DragonForce uses Teams relays to conceal C2 traffic. Review Team relay configs and enforce network segmentation and EDR visibility.

A three-stage path (SearchLeak) enables exfiltration of emails and MFA data via trusted Copilot links. Restrict Copilot usage and tighten monitoring.

GreatXML exposes Windows BitLocker bypass via recovery XML, highlighting recovery-Partition risks.

Miasma worms compromised a large set of Microsoft GitHub repositories via a supply-chain attack.

June 2026 cycle patches 198 flaws, including 3 zero-days actively exploited; prioritize critical systems first.

Vulnerability enables token theft from GitHub via a simple interaction; affects developer workflows.

A single-click payload can exfiltrate GitHub OAuth tokens from vulnerable repos via VS Code workflows.

A single code setting bypassed protections exposing billions of Microsoft Android app downloads; immediate review of token/access handling recommended.

Coordinated disruption of Glassworm infrastructure; assess supply-chain risk and harden package sources.

Microsoft SharePoint Server remote code execution vulnerability disclosed and patched as CVE-2026-45659.

Active exploitation of zero-days and RCE in common software calls for tighter patch cadence.