Microsoft 365
Hackers target Microsoft Entra accounts in device code vishing attacks
Threat actors are targeting technology, manufacturing, and financial organizations in campaigns that combine device code phishing and voice phishing (vishing) to abuse the OAuth 2.0 Device Authorization flow and compromise Microsoft Entra accounts. Unlike previous attacks that utilized malicious OAuth applications to compromise accounts, these campaigns instead leverage legitimate Microsoft OAuth client IDs and the […]
Microsoft says bug causes Copilot to summarize confidential emails
Microsoft says a Microsoft 365 Copilot bug has been causing the AI assistant to summarize confidential emails since late January, bypassing data loss prevention (DLP) policies that organizations rely on to protect sensitive information. According to a service alert seen by GeekFeed, this bug (tracked under CW1226324 and first detected on January 21) affects the Copilot “work […]
Microsoft 365 outage takes down admin center in North America
Microsoft is investigating an outage that blocks some administrators with business or enterprise subscriptions from accessing the Microsoft 365 admin center. While the company has yet to disclose which regions are affected by this ongoing service degradation, it is tracking it on its official service health status page to provide impacted organizations with up-to-date information. […]
Microsoft to shut down Exchange Online EWS in April 2027
Microsoft announced today that the Exchange Web Services (EWS) API for Exchange Online will be shut down in April 2027, after nearly 20 years. EWS is a cross-platform API for developing apps that can access Exchange mailbox items, such as email messages, meetings, and contacts, retrieved from various sources, including Exchange Online and on-premises editions […]
Microsoft fixes Outlook bug blocking access to encrypted emails
Microsoft has fixed a known issue that prevented Microsoft 365 customers from opening encrypted emails in classic Outlook after a December update. This bug affects users who try to open messages encrypted with “Encrypt Only” permissions, a policy that doesn’t restrict forwarding, printing, or copying the email. On impacted systems, users are seeing a message_v2.rpmsg attachment […]
Microsoft: Windows 365 update blocks access to Cloud PC sessions
Microsoft confirmed that a recent Windows 365 update is blocking customers from accessing their Microsoft 365 Cloud PC sessions. Windows 365 is a cloud-based service that runs on Azure Virtual Desktop and allows enterprise customers to stream Windows Cloud PCs to end users under Windows 365 Enterprise or Windows 365 Business subscriptions. The incident began […]
Microsoft to enforce MFA for Microsoft 365 admin center sign-ins
Microsoft will start enforcing multi-factor authentication (MFA) for all users accessing the Microsoft 365 admin center starting next month. While MFA requirements for the admin center began rolling out in February 2025, Microsoft will now enforce this for all users and block those without MFA enabled from signing in to the Microsoft 365 administrative portal […]
Microsoft cancels plans to rate limit Exchange Online bulk emails
Microsoft announced today that it has canceled plans to impose a daily limit of 2,000 external recipients on Exchange Online bulk email senders. The change was announced in April 2024, when Microsoft said that it would add new External Recipient Rate (ERR) limits starting January 2025 to fight spam, with plans to begin enforcing the limit on […]
Microsoft Teams to let admins block external users via Defender portal
Microsoft announced that security administrators will soon be able to block external users from sending messages, calls, or meeting invitations to members of their organization via Teams. The new feature will start rolling out in early January, integrating Microsoft Teams with Defender for Office 365, and enabling admins to manage blocked external contacts through the […]
Nigeria arrests dev of Microsoft 365 ‘Raccoon0365’ phishing platform
The Nigerian police arrested three individuals linked to targeted Microsoft 365 cyberattacks via Raccoon0365 phishing platform. The attacks led to business email compromise, data breaches, and financial losses affecting organizations worldwide. The law enforcement operation was possible thanks to intelligence from Microsoft, shared with the Nigeria Police Force National Cybercrime Centre (NPF–NCCC) via the FBI. The […]