Cybersecurity agencies from the U.S., U.K. and Netherlands, alongside the FBI, issued a joint advisory exposing an Iranian state-linked campaign using Windows malware called CHOSEN BRICK to spy on dissidents, journalists and activists. Attackers pose as trusted contacts or tech support over WhatsApp and Telegram, luring victims into launching disguised fake apps that secretly install the spyware and evade Windows Defender.
bleepingcomputer.com
· 2026-09-16
A researcher using the alias Nightmare Eclipse publicly released details of a new zero-day exploit dubbed 'ShieldCrash' targeting Microsoft Defender, timed to appear right after Microsoft's September 2026 Patch Tuesday updates. The exploit reportedly allows attackers to gain SYSTEM-level access on affected Windows machines, the highest level of privilege on the system.
bleepingcomputer.com
· 2026-09-09
Microsoft researchers identified a large phishing operation that inserts invisible Unicode 'Tags' characters inside finance-related keywords—splitting words like 'funding' into fragments—to slip past email filters that scan for suspicious terms. The campaign peaked at 2.37 million daily messages in late February and, despite a drop in volume by May, remains active, with Defender for Office 365 tracing it to 148 finance-themed sender domains.
bleepingcomputer.com
· 2026-09-06
Microsoft says spammers have repurposed ASCII smuggling, a technique once used mainly to sneak hidden prompt-injection instructions into AI systems, to disguise spam keywords and slip past Office 365 filters. The company detected daily signature hits jump from about 21,000 to over 1.3 million in early February, reaching 2.5 million within days before tapering off by mid-May.
arstechnica.com
· 2026-09-04
On September 2, Microsoft's Safe Links feature within Defender for Office 365 began misidentifying Google Search URLs shared in emails and Teams messages as malicious, blocking users from opening them. The outage, tracked internally as MO1465962, lasted about seven and a half hours before Microsoft resolved the faulty detection logic, though some users may have experienced lingering effects.
techspot.com
· 2026-09-03
Microsoft confirmed its Defender for Office 365 Safe Links feature is incorrectly flagging legitimate Google search URLs as malicious, showing users 'not safe' warnings when they try to click them. The company said the problem stems from an inaccurate security classification and is generating false alerts for IT admins in Microsoft Sentinel and the Defender portal. Pasting the blocked links directly into a browser does not bypass the warning.
bleepingcomputer.com
· 2026-09-02
Microsoft confirmed a bug causing the Windows Security app to falsely display 'Microsoft Defender Antivirus is turned off' notifications after recent Defender updates, even though protection remains active. The issue, which has quietly affected Windows Insiders since June, now impacts all supported Windows client and server versions, including Windows 11 26H1 and Windows Server 2025. Microsoft says a fix is in development and will roll out in a future Defender update.
bleepingcomputer.com
· 2026-08-31
GoKawiil