Microsoft is preparing a major change to how organisations protect user sign-ins through Microsoft Entra ID. Beginning on September 1, 2026, passkeys will start becoming the default authentication method for public-cloud tenants, gradually replacing the familiar SMS codes and automated voice calls many users still rely on for multi-factor authentication.

A basic server configuration mistake has revealed the tools, credentials and operational methods behind three separate phishing actors using Evilginx and related adversary-in-the-middle techniques. The exposure originated from a virtual private server in Budapest that had been running a simple Python HTTP service with directory listing enabled. Because the server was left publicly accessible, anyone who found it could browse and download files stored inside.

A newly identified threat group known as Helix is using convincing phone calls and Microsoft Teams conversations to trick employees into granting access to corporate Microsoft 365 accounts. Rather than exploiting an unpatched software vulnerability, the attackers rely on social engineering, impersonation and legitimate Microsoft authentication processes. Once inside an account, they search SharePoint, OneDrive and Exchange Online for sensitive information that can be stolen and later used to pressure or extort the organisation.

A sophisticated phishing platform targeting Microsoft 365 users is raising concern because it does not rely solely on stolen passwords. Known as ARToken, the service is designed to trick victims into approving a legitimate Microsoft device sign-in request controlled by an attacker. Once that approval is given, the attacker may receive valid access and refresh tokens, allowing continued access to the victim's Microsoft 365 account, email and potentially SharePoint data

Microsoft is once again encouraging users to move to the new Outlook for Windows, and this time the company is highlighting more than 15 productivity features that it says make the new app more useful and ready for everyday work.