Microsoft says threat groups Storm-3032 and Storm-3121 have been calling or texting employees on personal devices since May, posing as internal IT helpdesks to steal credentials and bypass corporate authentication protections. The attackers then abuse the Microsoft Graph API to exfiltrate corporate data at scale, and researchers believe they hand off this access to extortion gangs such as ShinyHunters. No specific breaches have yet been tied directly to these campaigns.
darkreading.com
· 2026-09-10
Switzerland's Federal Chancellery is spending 9 million Swiss francs to move 3,000 government workstations off Microsoft 365 tools like Outlook and Teams, adopting the open-source openDesk suite instead. The decision follows a successful pilot program called PoC BOSS, which tested the software with 172 federal employees who found it workable for standard office tasks, though large-scale video conferencing showed some limitations. The rollout is planned to be complete by the end of 2027, with potential to expand further across the federal workforce.
techspot.com
· 2026-09-09
Following a proof-of-concept with 172 employees, Switzerland's Federal Council has expanded testing of the German open-source suite openDesk to 3,000 government workstations, about 7% of the federal workforce. The pilot, running alongside Microsoft 365, aims for full migration by end of 2027, while the country's Cyber Command plans to fully replace Microsoft 365 with openDesk by October 2026.
yro.slashdot.org
· 2026-09-07
CloudSEK researchers infiltrated the admin panel of a phishing-as-a-service tool called BigBear 2.0 and found it had harvested over 5,000 Microsoft 365 credentials from 258 organizations. The kit uses an Evilginx2-based adversary-in-the-middle proxy to intercept usernames, passwords, and session cookies even after victims complete multi-factor authentication, letting attackers replay stolen sessions to hijack accounts.
bleepingcomputer.com
· 2026-09-07
The Swiss Federal Chancellery is spending CHF 9 million to test the openDesk open-source suite as a replacement for Microsoft 365 across 3,000 federal employees, roughly 7% of the workforce, with migration targeted for completion by end of 2027. The pilot follows a proof-of-concept with 172 employees that rated document editing and email positively but flagged limitations in large-scale video conferencing, and it will run alongside Microsoft 365 rather than replace it immediately.
itsfoss.com
· 2026-09-07
Microsoft confirmed widespread service degradation across its 365 suite, affecting Outlook, OneDrive, SharePoint, Teams, Copilot and Universal Print. Users reported problems sending or receiving emails, loading files, and accessing print jobs, though Microsoft says availability has largely stabilized above 99 percent.
androidauthority.com
· 2026-09-02
A multi-day outage tied to Microsoft's Exchange Online authentication system continues to disrupt Outlook and other Microsoft 365 services into Tuesday, even after Monday's mitigation efforts. Microsoft says the root cause was a misconfiguration preventing authentication components from deploying properly across parts of its infrastructure, affecting SharePoint, Teams, Copilot, Defender XDR, Purview, the admin center, and Universal Print alongside Outlook.
techcrunch.com
· 2026-09-01
Microsoft confirmed a widespread outage of Exchange Online on Monday, causing Outlook users to experience delayed or failed emails, authentication errors, and search failures. The company traced the problem to an authentication component and began testing a fix on part of its infrastructure before a broader rollout. Downdetector logged over 5,000 user reports by 2 PM ET, with complaints also flooding social media.
techcrunch.com
· 2026-08-31
Researchers have identified a subscription-based phishing toolkit called NovaCookies that uses adversary-in-the-middle techniques to intercept live Microsoft 365 login sessions. Rather than just harvesting usernames and passwords, the kit captures session cookies, letting attackers bypass multi-factor authentication and take over accounts directly. It is being sold as a service for roughly $320 a month, making advanced phishing capability accessible to less-skilled criminals.
darkreading.com
· 2026-08-26
Microsoft is rolling out a new Teams meeting protection policy letting admins automatically block all identified external bots from joining meetings, without requiring organizer approval. This expands on a June update that flagged bots in the lobby but still let organizers admit them manually. The feature is off by default, deploying via targeted release through August with general availability expected by late September.
bleepingcomputer.com
· 2026-08-24
GoKawiil