Microsoft Security Research

A security researcher has published a write-up describing how they could have accessed 17 trillion Microsoft records through a vulnerability. The blog post walks through the flaw and how access was theoretically possible. Hacker News readers are discussing the finding, debating the scale of the exposure and how Microsoft handles responsible disclosure.

Cybersecurity researchers are warning about a phishing site impersonating a Microsoft login page, hosted on a Google Sites address with a deceptive domain mimicking Microsoft's online sign-in. The link has been defanged for safety and submitted for technical analysis on the urlDNA scanning platform. The case highlights how attackers abuse legitimate services like Google Sites to host credential-stealing pages.

Attackers are reportedly using Microsoft Defender's exclusion settings to conceal malware from antivirus scanning, according to a report by Spanish security blog elhacker.NET. By adding malicious files or folders to Defender's exclusion list, malware can run undetected on Windows systems. The technique highlights ongoing concerns that trusted security tools themselves can be manipulated by attackers to bypass endpoint protection.

Security researchers report that four separate spyware groups deployed the same exploit kit targeting Google Chrome and Microsoft Windows, all within a single week. The finding suggests the groups are sharing or purchasing identical hacking tools rather than developing their own, raising fresh concerns about the proliferation of surveillance capabilities. Cybersecurity commentators are highlighting the case as evidence of a growing grey market for exploits used against journalists, dissidents and other targets.

Microsoft researchers have detailed attacks exploiting a Zimbra command injection vulnerability, CVE-2026-73570, in which a single crafted email is enough to run code on the mail server. The documented attacks involve deploying web shells, gaining root access, and stealing cryptographic keys. Security teams running Zimbra are being urged to patch and review their servers for signs of compromise.

Security firm Proofpoint reports that the threat group TA419 impersonated prominent AI-policy figures and used a real-time Microsoft 365 phishing proxy to steal authenticated login sessions. The highly targeted campaign hit fewer than ten specialists. Researchers say it shows how attackers can capture live sessions, though successful compromises and government attribution remain unclear.

A critical vulnerability, CVE-2026-73570 with a CVSS score of 8.9, in Zimbra Collaboration Suite allowed unauthenticated attackers to run operating system commands through its SNMP service. According to Microsoft Security Research, attackers exploited the flaw to deploy web shells and steal mailbox credentials. A patch has been released, and security teams are urged to update affected servers promptly.

Security researchers have published a two-part technical write-up of a Windows vulnerability tracked as ZDI-26-708, described as a cross-context proxy authentication coercion in the Network Connectivity Status Indicator (NCSI). The disclosure is circulating among security professionals sharing the detailed analysis. Details on affected versions and patches remain unclear from the discussion so far.

Microsoft has published an analysis of NeedyMantis, a malware family deployed after attackers have already breached a network, with use in targeted operations against specific victims. The report breaks down how the malware behaves once inside a compromised environment. Security researchers and practitioners are sharing the findings, warning organisations to review the indicators of compromise Microsoft disclosed.

Autonomous System 8075, the network operated by Microsoft, was observed announcing IP address space located in Oslo, Norway. The observation was logged and shared on 25 September 2026 with the cybersecurity community under the tag #shodansafari. This type of sighting is used by security researchers to track how large cloud and technology providers extend their network presence into new regions and data centre locations.