Microsoft 365
ProductAm I affected?
Checked against NVD affected-version data on our server. Nothing you type is stored.
Threat actors named alongside
Source: RedTeamDaily stories that mention bothSecurity timeline
- Named in breach reports by Cyber Security NewsAttackers abuse stolen Microsoft Entra ID and Azure DevOps credentials to reach 27 organisations
- Advisory or policy news by The Register (Security)UK NCSC warns AI-powered ransomware could hit critical infrastructure by 2028
Recent news
Attackers abuse stolen Microsoft Entra ID and Azure DevOps credentials to reach 27 organisations
An ongoing campaign since 1 November 2026 has abused stolen Microsoft Entra ID application credentials and Azure DevOps identities to access Microsoft 365 and Azure environments, targeting managed service providers and their customers. Investigators recorded searches across about 25 tenants, downloads of 81 files and access to roughly 2,279 mailbox items, including password lists and private keys. App-only sign-ins are not covered by user-focused Conditional Access or MFA prompts, so workload-specific policies are needed.
ARTEX AI framework used by state-linked and criminal hackers to automate enterprise attacks
ARTEX is a multi-agent AI penetration-testing framework that can plan and run reconnaissance, exploitation and post-compromise steps, reviewing tool output and adjusting its next action. Google Threat Intelligence Group and Mandiant reported its use in Active Directory attacks, privilege escalation, cloud reconnaissance, lateral movement and exfiltration preparation, Microsoft linked it to Storm-0940, and CrowdStrike tied it to VAPOR PANDA, which targeted more than 200 organisations. The article stresses that the main risk is how quickly existing weaknesses, such as stolen passwords and excessive permissions, can be found and chained together.
UK NCSC warns AI-powered ransomware could hit critical infrastructure by 2028
The NCSC, in its annual review, says AI-powered malware is highly likely to feature in a ransomware attack on UK critical national infrastructure by 2028. It notes that open source AI security tools built for researchers are already being repurposed by attackers, and that an autonomous attacker operating beyond its operator's control is a realistic possibility. The report also outlines Cyber Shield, a staged agentic defence programme, and urges organisations to invest more in security.