Security
- The hidden network: Inside the phishing infrastructure ecosystem powering global cybercrime
Microsoft Threat Intelligence maps a Chinese-language phishing marketplace where kits, hosting and stolen accounts are sold as a service, including the Storm-2990 “Iron Man” kit and the YAM Store broker run by Storm-3119. The point for MSPs is that convincing phishing is now cheap and industrialised, so you can’t expect users to spot it every time. Worth a look for the mitigation and Defender detection guidance at the end, and a good prompt to check phishing-resistant MFA and Safe Links are actually turned on for clients.
https://www.microsoft.com/en-us/security/blog/2026/10/14/the-hidden-network-inside-the-phishing-infrastructure-ecosystem-powering-global-cybercrime/ - Disrupting the service economy behind transnational cybercrime operations
This is the legal side of the same story. Microsoft’s Digital Crimes Unit and Health-ISAC are moving to take down YAM Store, CoGUI and Iron Man, which together have pushed more than a billion malicious messages at over 75,000 organisations since January. Good reminder that the fake toll, parcel and tax texts your clients keep getting come from organised supply chains, not lone scammers, and that one takedown won’t stop the flow.
https://blogs.microsoft.com/on-the-issues/2026/10/14/disrupting-the-service-economy-behind-transnational-cybercrime-operations/ - Hacker claims ‘123456’ password let them breach the Danish national registry
8.8 million records were pulled from Denmark’s national population register through a third-party IT provider, Pays ApS, whose account was reportedly protected by the password “123456”. Nobody noticed for 12 days, until an invoice showed unusual activity. Good reminder that your security is only as strong as the weakest supplier login, so check that every third-party and service account touching client data has MFA and isn’t on a shared, weak password.
https://www.tomshardware.com/tech-industry/cyber-security/hacker-claims-123456-password-let-them-breach-the-danish-national-registry-accessing-8-8-million-records-it-and-data-services-company-with-weak-passwords-linked-source-of-the-hack - MC1507808 – Microsoft-managed CA policy will be enforced soon: Require risk remediation for high-risk users
Microsoft has dropped a managed Conditional Access policy into tenants that uses Entra ID Protection to make high-risk users self-remediate. It’s been in report-only mode, and if you do nothing it switches on from the week of 28 October. Worth checking each client tenant now, because self-remediation depends on users being registered for MFA and on licensing, and you don’t want surprise lockouts next month.
https://mc.merill.net/message/MC1507808 - Cyber security priorities for boards of directors 2025–26
The ACSC’s guidance for directors says cyber should be treated as a core governance and enterprise risk, covering risk management, incident readiness, supply chain oversight and clear reporting to the board. Nothing groundbreaking, but it’s an official Australian document you can put in front of SMB owners and boards when they ask why security keeps showing up on the invoice. Handy for QBRs and risk conversations.
https://www.cyber.gov.au/business-government/protecting-business-leaders/cyber-security-for-business-leaders/cyber-security-priorities-for-boards-of-directors-2025-26
Microsoft 365 & Windows
- Retiring NTLM: Frequently asked questions
Microsoft’s FAQ confirms NTLM will be switched off by default in the next major Windows Server and client release. It isn’t being removed yet, and current versions keep supporting it. You can turn it back on by policy for edge cases, but Microsoft won’t publish a list of its own apps that still rely on it. Nothing groundbreaking, but now is the time to start NTLM auditing on client networks and find the old NAS boxes, line-of-business apps and web servers that will break.
https://techcommunity.microsoft.com/blog/windows-itpro-blog/retiring-ntlm-frequently-asked-questions/4550522 - Introducing a team knowledge base, curated by Copilot and agents
In Frontier preview, Copilot and agents can build and maintain a team knowledge base in SharePoint, made of linked markdown files pulled from email, meetings, chats and site content, and use it to ground agents working with the team. Still early, but this is Microsoft’s answer to agents giving poor answers because team knowledge is scattered and stale. It also means SharePoint structure and permissions hygiene matter even more before you switch it on for clients.
https://techcommunity.microsoft.com/blog/spblog/introducing-a-team-knowledge-base-curated-by-copilot-and-agents/4564203 - What’s New in Notebooks | October 2026
Copilot Notebooks can now be created just by describing your goal, take Markdown, TXT and RTF files as references, and let you edit Word, Excel and PowerPoint files without leaving the notebook. Expanded reference types are generally available, while the rest is rolling out to Frontier first. Worth a look if clients are struggling to find a day-to-day use for Copilot, as project notebooks are one of the easier wins to show.
https://techcommunity.microsoft.com/blog/microsoft-copilot-blog/whats-new-in-notebooks–october-2026/4559105 - SharePoint Skills
The PnP community has published a library of around 60 free skills for Copilot in SharePoint, covering governance, document management, project reporting, site management and more. You install a skill once and call it when needed, rather than everyone writing their own prompts. Worth a look as a quick way to show clients practical Copilot value in SharePoint without building agents from scratch, though treat community content as something to test first.
https://pnp.github.io/sharepoint-skills/
Cloud & AI
- Frontier Pre-training at Microsoft AI
Microsoft AI has finished pre-training MAI-Base-2, a 2.8 trillion parameter model it says beats every open-weight model it tested. It was trained on its own data, not distilled from other models, and Microsoft plans to license it to partners through Foundry. Still early, as post-training is still underway, but it’s another clear sign Microsoft is reducing its reliance on OpenAI, and that will shape what ends up powering Copilot and Foundry.
https://microsoft.ai/news/frontier-pre-training-at-microsoft-ai/ - Microsoft wins approval for 96MW Sydney data centre
NSW has approved Microsoft’s A$1.26bn, 96MW data centre at Huntingwood in Western Sydney, though federal environmental approval is still pending before construction can start. For Aussie MSPs this means more local Azure and AI capacity in the years ahead, which helps with data residency and latency conversations. Worth noting for clients who still think “cloud” means their data leaves the country.
https://thetechcapital.com/microsoft-wins-approval-for-96mw-sydney-data-centre/ - MC1506318 – Copilot Studio: end of support for selected AI models
Copilot Studio is retiring several older models, including GPT-4.1 and GPT-4.1 mini, on both the Standard and GitHub Copilot harnesses. Affected agents will be moved to a replacement model automatically, with the first migration dates in November. Good reminder to list which client agents are pinned to older models and retest them before the switch, because a model change can quietly change how an agent behaves.
https://mc.merill.net/message/MC1506318 - Introducing Microsoft Copilot for legal
Microsoft has made more than 20 legal-specific skills and partner plugins generally available in Copilot. They do native tracked-change redlining in Word, draft from approved precedents held in SharePoint, and run multi-step contract work in Cowork. If you look after law firms or in-house legal teams, worth a look, because this is the first vertical package that makes a real Copilot business case for them. Just make sure precedent libraries and permissions are in order first.
https://techcommunity.microsoft.com/blog/microsoft-copilot-blog/introducing-microsoft-copilot-for-legal/4564246 - Introducing Grok Voice 3.0
xAI’s new speech-to-speech model tops Artificial Analysis’s Speech-to-Speech Index, with response times under a second, and it’s in the API at the same price as the previous version. Still early for most SMBs, but voice agents for after-hours phone answering and first-line support keep getting cheaper and better. Expect clients to start asking whether they can replace their phone answering service.
https://x.ai/news/grok-voice-3 - GPT 6.1 beats Gemini 4 Argon
My latest model shoot-out in Copilot Cowork: GPT 6.1 Sol scored 9.15 against 7.55 for Google’s Gemini 4 Argon on the same prompt, and the full evaluation is linked in the post. Nothing groundbreaking for most users, as leaving Copilot on Auto is fine, but it’s a useful data point if clients ask whether they should pay for a separate Gemini subscription.
https://blog.ciaops.com/2026/10/14/gpt-6-1-beats-gemini-4-argon/
After hours
Tesla’s Flying Roadster Revealed: Everything That Happened in 10 Minutes – https://www.youtube.com/watch?v=TWHXrLzUKJc
Editorial
If you found this valuable, the I’d appreciate a ‘like’ or perhaps a donation at https://ko-fi.com/ciaops. This helps me know that people enjoy what I have created and provides resources to allow me to create more content. If you have any feedback or suggestions around this, I’m all ears. You can also find me via email director@ciaops.com and on X (Twitter) at https://www.twitter.com/directorcia.
If you want to be part of a dedicated Microsoft Cloud community with information and interactions daily, then consider becoming a CIAOPS Patron – www.ciaopspatron.com.
Watch out for the next CIA Brief next week
