CIA Brief 20260509

Here’s a summary of the 10 stories posted in the Patrons News channel over the last 7 days, grouped by topic.

Security & Threat Intelligence

• SOHO router compromise leads to DNS hijacking and AiTM attacks — Microsoft Threat Intelligence reports that Russian military-linked actor Forest Blizzard (sub-group Storm-2754) has compromised insecure home/small-office routers, redirecting DNS to attacker-controlled infrastructure to enable adversary-in-the-middle attacks against Outlook on the web. Over 200 organisations and 5,000 consumer devices have been impacted since August 2025. https://www.microsoft.com/en-us/security/blog/2026/04/07/soho-router-compromise-leads-to-dns-hijacking-and-adversary-in-the-middle-attacks/

• ClickFix campaign uses fake macOS utilities to deliver infostealers — Threat actors are posting fake macOS troubleshooting guides on Medium, Squarespace and Craft pages instructing users to paste Terminal commands that install Macsync, Shub Stealer or AMOS infostealers, which exfiltrate Keychain entries, iCloud data and crypto wallet keys (and sometimes replace Ledger, Trezor and Exodus apps with trojanised versions). https://www.microsoft.com/en-us/security/blog/2026/05/06/clickfix-campaign-uses-fake-macos-utilities-lures-deliver-infostealers/

• Multi-stage ‘code of conduct’ phishing leads to AiTM token compromise — A large credential-theft campaign (April 14–16) targeted ~35,000 users across 13,000 organisations in 26 countries, mostly US, using polished “internal regulatory” emails with PDF attachments. The chain ran through CAPTCHAs and staging pages before hitting an AiTM Microsoft sign-in flow that captures auth tokens. https://www.microsoft.com/en-us/security/blog/2026/05/04/breaking-the-code-multi-stage-code-of-conduct-phishing-campaign-leads-to-aitm-token-compromise/

Microsoft 365 Product Updates

• What’s new in Microsoft Teams – April 2026 — Headline features include Copilot call delegation, Interpreter agent enhancements (consecutive interpretation, sign-language attribution), targeted messages from agents, sensitivity-label inheritance for recordings and Loop notes, an External Domains Anomalies Report, and Teams Phone user multi-line (up to 10 numbers per user). https://techcommunity.microsoft.com/blog/microsoftteamsblog/whats-new-in-microsoft-teams–april-2026/4515907

• Microsoft 365 E7 and Agent 365 are now generally available — Microsoft’s new top-tier M365 SKU and the Agent 365 platform have moved to general availability (announced 1 May 2026). https://techcommunity.microsoft.com/blog/microsoft_365blog/microsoft-365-e7-and-agent-365-are-now-generally-available/4516295

• Get more out of Microsoft Clipchamp with these little-known features — A walk-through of Brand kits for consistent logos/colours/fonts, fade and blur transitions, automatic captions, aspect-ratio presets for repurposing content, and built-in stock search — plus Copilot in the Clipchamp video hub for searchable, summarised playback. https://techcommunity.microsoft.com/blog/microsoft365insiderblog/get-more-out-of-microsoft-clipchamp-with-these-little%E2%80%91known-features/4514855

Identity, Security & SIEM Platform

• Lock down AI, web and private apps – what’s new in Internet Access and Private Access — Updates to Microsoft Entra’s Global Secure Access covering tighter controls for AI traffic, web and private application access. https://techcommunity.microsoft.com/blog/microsoft-entra-blog/lock-down-ai-web-and-private-apps-what%E2%80%99s-new-in-internet-access-and-private-acce/3847825

• What’s new in Microsoft Sentinel – April 2026 — RSAC-aligned updates including OSINT reports inside Threat Analytics, hard cost-limit enforcement for KQL queries and notebooks, new connectors (CrowdStrike, Imperva Cloud WAF, AWS ELB, rebuilt Logstash output plugin), Sentinel data federation, custom graphs, MCP entity analyzer GA and a Claude MCP connector. https://techcommunity.microsoft.com/blog/MicrosoftSentinelBlog/what%E2%80%99s-new-in-microsoft-sentinel-april-2026/4516354

CIAOPS Content

• CIA Brief 20260502 — Robert’s weekly roundup of Microsoft 365, Copilot, AI and security news for the week ending 2 May 2026, covering items including the M365 E7 / Agent 365 GA announcement. https://blog.ciaops.com/2026/05/02/cia-brief-20260502/

Archive / Reference

• The Future of SharePoint (2016 post) — Jeff Teper’s original “Future of SharePoint” announcement from May 2016, unveiling the cloud-first, mobile-first SharePoint vision, modern team sites, the SharePoint mobile app and the SharePoint Framework. Reposted to the channel for reference. https://www.microsoft.com/en-us/microsoft-365/blog/2016/05/04/the-future-of-sharepoint/

After hours

Why Would Anyone Live in NYC? – https://www.youtube.com/watch?v=POg3_b9txwM

Editorial

If you found this valuable, the I’d appreciate a ‘like’ or perhaps a donation at https://ko-fi.com/ciaops. This helps me know that people enjoy what I have created and provides resources to allow me to create more content. If you have any feedback or suggestions around this, I’m all ears. You can also find me via email director@ciaops.com and on X (Twitter) at https://www.twitter.com/directorcia.

If you want to be part of a dedicated Microsoft Cloud community with information and interactions daily, then consider becoming a CIAOPS Patron – www.ciaopspatron.com.

Watch out for the next CIA Brief next week