Threat actors are targeting technology, manufacturing, and financial organizations in campaigns that combine device code phishing and voice phishing (vishing) to abuse the OAuth 2.0 Device ...

Microsoft Edge Secure Network VPN promises built-in privacy, but a security researcher says it behaves like a browser proxy than a full VPN.

The AgreeTo add-in for Outlook has been hijacked and turned into a phishing kit that stole more than 4,000 Microsoft account ...

Microsoft patches CVE-2026-20841, a high-severity Windows Notepad flaw that could allow code execution via malicious Markdown ...

Scammers are impersonating Microsoft with urgent deadline threats and fake legal language to rush victims into clicking ...

A high-severity Windows Admin Center vulnerability (CVE-2026-26119) could allow privilege escalation in enterprise ...

A Microsoft Outlook add-in was abandoned and taken over by hackers, who used it to collect email accounts and banking data.

It's taking a while.

Unwitting employees register a hacker’s device to their account; the crook then uses the resulting OAuth tokens to maintain persistent access.

Scammers are sending emails that appear to come from Microsoft, warning users their accounts face suspension or deletion. The ...

Windows 11 often auto-enables a OneDrive feature called Folder Backup without telling users that it is doing so.

First malicious Outlook add-in abused an abandoned domain to host a fake Microsoft login page, stealing 4,000+ credentials in a supply chain attack.