CIA Brief 20260530

Introducing Microsoft 365 Business with Copilot: The new standard for small business(opens in new window) Microsoft is launching two new small-business SKUs on 1 July — Business Standard with Copilot and Business Premium with Copilot — with Copilot built directly into Word, Excel, PowerPoint and Outlook. They add 1,000+ connectors (Shopify, Xero, Docusign and more), “Work IQ” business context, and access to OpenAI and Anthropic models. Built-in security controls like sensitivity labels and access revocation ensure Copilot only surfaces what each user is permitted to see.
Introducing a new design for Microsoft 365 Copilot(opens in new window) Microsoft has redesigned the Copilot experience across Microsoft 365, turning the prompt line into a task-aware workspace with a single consistent entry point across apps and a progressive-disclosure interface. Performance improved with load times cut by more than half and complex prompts answering ~10% faster, alongside new agentic modes (Designer, Researcher, and in-app Word/Excel/PowerPoint agents). Microsoft reported usage gains of Word +27%, Excel +33%, PowerPoint +43% and Outlook +30%.

Security / Industry News

The Gentlemen ransomware: Dissecting a self-propagating Go encryptor(opens in new window) Microsoft Threat Intelligence analysed “The Gentlemen,” a ransomware-as-a-service threat (operators tracked as Storm-2697) written in Go that uses per-file Curve25519 + XChaCha20 encryption and spreads aggressively through lateral movement. It employs double extortion, disables Microsoft Defender, and deletes shadow copies and logs to hinder recovery. Activity has been observed globally across education, transport, healthcare and finance sectors.

After hours

Mark Rober’s $60 Million Science Experiment – https://www.youtube.com/watch?v=RDFGkBE2O50

Editorial

If you found this valuable, the I’d appreciate a ‘like’ or perhaps a donation at https://ko-fi.com/ciaops. This helps me know that people enjoy what I have created and provides resources to allow me to create more content. If you have any feedback or suggestions around this, I’m all ears. You can also find me via email director@ciaops.com and on X (Twitter) at https://www.twitter.com/directorcia.

If you want to be part of a dedicated Microsoft Cloud community with information and interactions daily, then consider becoming a CIAOPS Patron – www.ciaopspatron.com.

Watch out for the next CIA Brief next week

Need to Know podcast–Episode 365

In this episode, we dig into Cowork Skills and why they represent a genuine shift from “AI as a novelty” to “AI as part of how work actually gets done.” Not more prompts. Not more tools. But fewer decisions, less friction, and more consistency across the business.
If you’ve ever thought “Copilot is interesting, but it’s not really embedded yet”, this episode is for you.

Brought to you by www.ciaopspatron.com

you can listen directly to this episode at:

https://ciaops.podbean.com/e/episode-365-skills-not-apps/

Subscribe via iTunes at:

https://itunes.apple.com/au/podcast/ciaops-need-to-know-podcasts/id406891445?mt=2

or Spotify:

https://open.spotify.com/show/7ejj00cOuw8977GnnE2lPb

Don’t forget to give the show a rating as well as send me any feedback or suggestions you may have for the show

Resources

CIAOPS Need to Know podcast – CIAOPS – Need to Know podcasts | CIAOPS

X – https://www.twitter.com/directorcia

director@ciaops.com

CIAOPS Blog – CIAOPS – Information about SharePoint, Microsoft 365, Azure, Mobility and Productivity from the Computer Information Agency

Join my Teams shared channel – Join my Teams Shared Channel – CIAOPS

CIAOPS Merch store – CIAOPS

Become a CIAOPS Patron – CIAOPS Patron

CIAOPS Brief – CIA Brief – CIAOPS

CIAOPS Labs – CIAOPS Labs – The Special Activities Division of the CIAOPS

Support CIAOPS – Support CIAOPS

Get your M365 questions answered via email

Please fill out this form

A special thanks to the CIAOPS Patron community for making this podcast possible. You can find the benefits of a subscription to the community and become a member at https://www.ciaopspatron.com
CIAOPS MSP Skills

Microsoft Build

Choose how OneNote opens Microsoft 365 file links

How Storm-2949 turned a compromised identity into a cloud-wide breach

Disrupting Fox Tempest: A cybercrime service that turned “verified” software into a pathway for ransomware

Exposing Fox Tempest: A malware-signing service operation

A faster, more efficient Editor experience with Narrator in Word

Launched: Microsoft 365 Copilot Adoption Hub Redesign

CIA Brief 20260523

Security & Threat Intelligence

Mini Shai Hulud: Compromised @antv npm packages enable CI/CD credential theft (2026-05-20) — Microsoft Security details a supply-chain attack on @antv npm packages that steals CI/CD credentials. https://www.microsoft.com/en-us/security/blog/2026/05/20/mini-shai-hulud-compromised-antv-npm-packages-enable-ci-cd-credential-theft/(opens in new window)
How Storm-2949 turned a compromised identity into a cloud-wide breach (2026-05-19) — Case study on how a single compromised identity escalated into a tenant-wide cloud breach. https://www.microsoft.com/en-us/security/blog/2026/05/18/storm-2949-turned-compromised-identity-into-cloud-wide-breach/(opens in new window)
Disrupting Fox Tempest: A cybercrime service (2026-05-19) — Microsoft on the Issues post on the legal/operational action taken against Fox Tempest, which abused “verified” software signing to deliver ransomware. https://blogs.microsoft.com/on-the-issues/2026/05/19/disrupting-fox-tempest-a-cybercrime-service/(opens in new window)
Exposing Fox Tempest: A malware-signing service operation (2026-05-19) — Companion Security Blog post with the technical anatomy of the Fox Tempest malware-signing-as-a-service operation. https://www.microsoft.com/en-us/security/blog/2026/05/19/exposing-fox-tempest-a-malware-signing-service-operation/(opens in new window)
Microsoft Defender for Business — the MSP reality check (2026-05-17) — CIAOPS blog post examining the practical pros and cons of Defender for Business from an MSP delivery perspective. https://blog.ciaops.com/2026/05/17/microsoft-defender-for-business-the-msp-reality-check/(opens in new window)

Microsoft 365 Apps & Productivity

Choose how OneNote opens Microsoft 365 file links (2026-05-21, also re-posted 2026-05-19) — New OneNote setting that lets users control whether linked M365 files open in the desktop app, browser, or Teams. https://techcommunity.microsoft.com/blog/Microsoft365InsiderBlog/choose-how-onenote-opens-microsoft-365-file-links/4520886(opens in new window)
A faster, more efficient editor experience with Narrator in Word (2026-05-19) — Improvements to Narrator’s performance and behaviour inside Word for screen-reader users. https://techcommunity.microsoft.com/blog/microsoft365insiderblog/a-faster-more-efficient-editor-experience-with-narrator-in-word/4507584(opens in new window)

Microsoft 365 Copilot

Launched: Microsoft 365 Copilot Adoption Hub Redesign (2026-05-19) — Announcement of the refreshed Copilot Adoption Hub, with reorganised guidance and resources for rolling out Copilot. https://techcommunity.microsoft.com/blog/microsoft365copilotblog/launched-microsoft-365-copilot-adoption-hub-redesign/4520841

After hours

Clarkson’s Farm Series 5 | Official Trailer – https://www.youtube.com/watch?v=GJxPc3B2osU

Editorial

If you want to be part of a dedicated Microsoft Cloud community with information and interactions daily, then consider becoming a CIAOPS Patron – www.ciaopspatron.com.

Watch out for the next CIA Brief next week

CIA Brief 20260516

Security & Threat Intelligence

Configuration becomes vulnerability: Exploitable misconfigurations in AI apps (14 May) Microsoft Defender researchers found that AI and agentic apps deployed on Kubernetes (Mage AI, kagent, AutoGen Studio, MCP servers, and others) are frequently exposed to the internet with weak or missing authentication, enabling remote code execution, credential theft, and data exposure without any zero-day exploit. Defender for Cloud signals show >50% of cloud-native workload exploitations stem from these misconfigurations. https://www.microsoft.com/en-us/security/blog/2026/05/14/configuration-becomes-vulnerability-exploitable-misconfigurations-ai-apps/(opens in new window)
Kazuar: Anatomy of a nation-state botnet (14 May) Deep technical analysis of Kazuar, a Russian state actor (Secret Blizzard) malware family that has evolved from a traditional backdoor into a modular peer-to-peer botnet with Kernel/Bridge/Worker components, leader-election for stealth, and multiple fallback C2 channels (HTTP, WebSockets, Exchange Web Services). Used to target government and diplomatic organisations in Europe, Central Asia, and Ukraine. https://www.microsoft.com/en-us/security/blog/2026/05/14/kazuar-anatomy-of-a-nation-state-botnet/(opens in new window)
Undermining the trust boundary: Stealthy intrusion through third-party compromise (12 May) Microsoft Incident Response details a 100+ day intrusion in which attackers abused a compromised third-party IT services provider and the legitimate HPE Operations Agent platform to deploy VBScripts, malicious network providers, and password filter DLLs on domain controllers, harvest credentials, and persist via web shells and ngrok tunnels — all without malware-heavy techniques. https://www.microsoft.com/en-us/security/blog/2026/05/12/undermining-the-trust-boundary-investigating-a-stealthy-intrusion-through-third-party-compromise/(opens in new window)

Microsoft 365 & Teams

Goodbye Together mode, hello simplified meeting layouts in Microsoft Teams (15 May) Microsoft is retiring Together mode (and its scenes/seat assignments) from Teams on 30 June 2026. The modern Gallery view — which scales up to 49 participant tiles and adapts to device capability — becomes the single meeting layout, freeing engineering effort for video quality, super-resolution, denoising, and colour accuracy improvements. https://techcommunity.microsoft.com/blog/microsoft365insiderblog/goodbye-together-mode-hello-simplified-meeting-layouts-in-microsoft-teams/4519312(opens in new window)

Windows

Improving Windows quality: Making Taskbar and Start more personal (15 May) Windows Insiders in the Experimental channel can now move the taskbar to the top, left, or right of the screen (with matching icon alignment and Start flyout positioning), enable a smaller compact taskbar, and use new section-level toggles for Pinned / Recommended / All in the Start menu. “Recommended” is also being renamed to “Recent”. https://blogs.windows.com/windows-insider/2026/05/15/improving-windows-quality-making-taskbar-and-start-more-personal/(opens in new window)

Power Platform

What’s new in Power Platform: May 2026 feature update (15 May) Power Fx user-defined types (UDTs) and the Grid container control are now generally available. New previews include custom MCP-powered tools and rich Fluent UI widgets for app-based Copilot conversations, generative pages with input context, a new high-performance Data Grid modern control, OnSelect on the Icon control, and a PowerCAT skill for migrating retired InfoPath forms to Canvas Apps using AI coding agents. https://www.microsoft.com/en-us/power-platform/blog/2026/05/14/whats-new-in-power-platform-may-2026-feature-update/(opens in new window)

AI & Copilot

Microsoft tests ‘ClawPilot’ AI agent for 3,000 staff (9 May) Microsoft is piloting an OpenClaw-based “ClawPilot” AI agent with more than 3,000 employees, aiming to deliver always-on assistants that handle tasks across Microsoft 365 — part of a broader industry push around agent governance. https://www.msn.com/en-us/news/other/microsoft-tests-clawpilot-ai-agent-for-3000-staff/gm-GM67972661

After hours

Reimagining the mouse pointer with AI – https://www.youtube.com/watch?v=pZNzfQLgGsA

Editorial

If you want to be part of a dedicated Microsoft Cloud community with information and interactions daily, then consider becoming a CIAOPS Patron – www.ciaopspatron.com.

Watch out for the next CIA Brief next week

Need to Know podcast–Episode 364

A weekly roundup of Microsoft Cloud news with a focus on SMBs. Key topics include Microsoft’s internal testing of an always-on AI assistant, major security threats such as Russian state-sponsored router hijacking and advanced phishing attacks, updates to Microsoft Teams, and a retrospective on SharePoint’s evolution. Robert also discusses the challenges and strategies for adopting AI in business, emphasizing the need for a unified, collaborative approach to AI usage within organizations.

Brought to you by www.ciaopspatron.com

you can listen directly to this episode at:

https://ciaops.podbean.com/e/episode-365-siloed-ai/

Subscribe via iTunes at:

https://itunes.apple.com/au/podcast/ciaops-need-to-know-podcasts/id406891445?mt=2

or Spotify:

https://open.spotify.com/show/7ejj00cOuw8977GnnE2lPb

Don’t forget to give the show a rating as well as send me any feedback or suggestions you may have for the show

Resources

CIAOPS Need to Know podcast – CIAOPS – Need to Know podcasts | CIAOPS

X – https://www.twitter.com/directorcia

director@ciaops.com

CIAOPS Blog – CIAOPS – Information about SharePoint, Microsoft 365, Azure, Mobility and Productivity from the Computer Information Agency

Join my Teams shared channel – Join my Teams Shared Channel – CIAOPS

CIAOPS Merch store – CIAOPS

Become a CIAOPS Patron – CIAOPS Patron

CIAOPS Brief – CIA Brief – CIAOPS

CIAOPS Labs – CIAOPS Labs – The Special Activities Division of the CIAOPS

Support CIAOPS – Support CIAOPS

Get your M365 questions answered via email

Join the CIAOPS Email list – Please fill out this form

A special thanks to the CIAOPS Patron community for making this podcast possible. You can find the benefits of a subscription to the community and become a member at https://www.ciaopspatron.com

Show notes

Microsoft tests ‘ClawPilot’ AI agent for 3,000 staff

SOHO router compromise leads to DNS hijacking and adversary-in-the-middle attacks

What’s New in Microsoft Teams | April 2026

ClickFix campaign uses fake macOS utilities lures to deliver infostealers

The Future of SharePoint

Breaking the code: Multi-stage ‘code of conduct’ phishing campaign leads to AiTM token compromise

CIA Brief 20260509

Here’s a summary of the 10 stories posted in the Patrons News channel over the last 7 days, grouped by topic.

Security & Threat Intelligence

SOHO router compromise leads to DNS hijacking and AiTM attacks — Microsoft Threat Intelligence reports that Russian military-linked actor Forest Blizzard (sub-group Storm-2754) has compromised insecure home/small-office routers, redirecting DNS to attacker-controlled infrastructure to enable adversary-in-the-middle attacks against Outlook on the web. Over 200 organisations and 5,000 consumer devices have been impacted since August 2025. https://www.microsoft.com/en-us/security/blog/2026/04/07/soho-router-compromise-leads-to-dns-hijacking-and-adversary-in-the-middle-attacks/
ClickFix campaign uses fake macOS utilities to deliver infostealers — Threat actors are posting fake macOS troubleshooting guides on Medium, Squarespace and Craft pages instructing users to paste Terminal commands that install Macsync, Shub Stealer or AMOS infostealers, which exfiltrate Keychain entries, iCloud data and crypto wallet keys (and sometimes replace Ledger, Trezor and Exodus apps with trojanised versions). https://www.microsoft.com/en-us/security/blog/2026/05/06/clickfix-campaign-uses-fake-macos-utilities-lures-deliver-infostealers/
Multi-stage ‘code of conduct’ phishing leads to AiTM token compromise — A large credential-theft campaign (April 14–16) targeted ~35,000 users across 13,000 organisations in 26 countries, mostly US, using polished “internal regulatory” emails with PDF attachments. The chain ran through CAPTCHAs and staging pages before hitting an AiTM Microsoft sign-in flow that captures auth tokens. https://www.microsoft.com/en-us/security/blog/2026/05/04/breaking-the-code-multi-stage-code-of-conduct-phishing-campaign-leads-to-aitm-token-compromise/

Microsoft 365 Product Updates

What’s new in Microsoft Teams – April 2026 — Headline features include Copilot call delegation, Interpreter agent enhancements (consecutive interpretation, sign-language attribution), targeted messages from agents, sensitivity-label inheritance for recordings and Loop notes, an External Domains Anomalies Report, and Teams Phone user multi-line (up to 10 numbers per user). https://techcommunity.microsoft.com/blog/microsoftteamsblog/whats-new-in-microsoft-teams–april-2026/4515907
Microsoft 365 E7 and Agent 365 are now generally available — Microsoft’s new top-tier M365 SKU and the Agent 365 platform have moved to general availability (announced 1 May 2026). https://techcommunity.microsoft.com/blog/microsoft_365blog/microsoft-365-e7-and-agent-365-are-now-generally-available/4516295
Get more out of Microsoft Clipchamp with these little-known features — A walk-through of Brand kits for consistent logos/colours/fonts, fade and blur transitions, automatic captions, aspect-ratio presets for repurposing content, and built-in stock search — plus Copilot in the Clipchamp video hub for searchable, summarised playback. https://techcommunity.microsoft.com/blog/microsoft365insiderblog/get-more-out-of-microsoft-clipchamp-with-these-little%E2%80%91known-features/4514855

Identity, Security & SIEM Platform

Lock down AI, web and private apps – what’s new in Internet Access and Private Access — Updates to Microsoft Entra’s Global Secure Access covering tighter controls for AI traffic, web and private application access. https://techcommunity.microsoft.com/blog/microsoft-entra-blog/lock-down-ai-web-and-private-apps-what%E2%80%99s-new-in-internet-access-and-private-acce/3847825
What’s new in Microsoft Sentinel – April 2026 — RSAC-aligned updates including OSINT reports inside Threat Analytics, hard cost-limit enforcement for KQL queries and notebooks, new connectors (CrowdStrike, Imperva Cloud WAF, AWS ELB, rebuilt Logstash output plugin), Sentinel data federation, custom graphs, MCP entity analyzer GA and a Claude MCP connector. https://techcommunity.microsoft.com/blog/MicrosoftSentinelBlog/what%E2%80%99s-new-in-microsoft-sentinel-april-2026/4516354

CIAOPS Content

CIA Brief 20260502 — Robert’s weekly roundup of Microsoft 365, Copilot, AI and security news for the week ending 2 May 2026, covering items including the M365 E7 / Agent 365 GA announcement. https://blog.ciaops.com/2026/05/02/cia-brief-20260502/

Archive / Reference

The Future of SharePoint (2016 post) — Jeff Teper’s original “Future of SharePoint” announcement from May 2016, unveiling the cloud-first, mobile-first SharePoint vision, modern team sites, the SharePoint mobile app and the SharePoint Framework. Reposted to the channel for reference. https://www.microsoft.com/en-us/microsoft-365/blog/2016/05/04/the-future-of-sharepoint/

After hours

Why Would Anyone Live in NYC? – https://www.youtube.com/watch?v=POg3_b9txwM

Editorial

If you want to be part of a dedicated Microsoft Cloud community with information and interactions daily, then consider becoming a CIAOPS Patron – www.ciaopspatron.com.

Watch out for the next CIA Brief next week

CIAOPS Need to Know Microsoft 365 Webinar – May

laptop-eyes-technology-computer_thumb

Now in our tenth year!

Join me for the free monthly CIAOPS Need to Know webinar. Along with all the Microsoft Cloud news we’ll be taking a look at Copilot Cowork.

Shortly after registering you should receive an automated email from Microsoft Teams confirming your registration, including all the event details as well as a calendar invite.

You can register for the regular monthly webinar here:

May Registrations

(If you are having issues with the above link copy and paste – https://bit.ly/n2k2605 )

The details are:

CIAOPS Need to Know Webinar – May 2026
Friday 29th of May 2026
11.00am – 12.00am Sydney Time

All sessions are recorded and posted to the CIAOPS Youtube channel.

Also feel free at any stage to email me directly via director@ciaops.com with your webinar topic suggestions.

I’d also appreciate you sharing information about this webinar with anyone you feel may benefit from the session and I look forward to seeing you there.

CIA Brief 20260502

Microsoft 365 Copilot & AI Agents

Microsoft 365 E7 and Agent 365 are now generally available (1 May) — Microsoft’s new top-tier M365 SKU and the Agent 365 platform have moved to general availability. https://techcommunity.microsoft.com/blog/microsoft_365blog/microsoft-365-e7-and-agent-365-are-now-generally-available/4516295(opens in new window)
Copilot in Outlook — new agentic experiences for email and calendar (27 Apr) — New agent-driven capabilities in Outlook to autonomously triage email and manage calendar tasks. https://techcommunity.microsoft.com/blog/outlook/copilot-in-outlook-new-agentic-experiences-for-email-and-calendar/4514601(opens in new window)
GPT-5.5 Thinking and ChatGPT Images 2.0 in Microsoft 365 Copilot (27 Apr) — Both new OpenAI models are available today inside M365 Copilot, adding deeper reasoning and updated image generation. https://techcommunity.microsoft.com/blog/microsoft365copilotblog/available-today-gpt-5-5-thinking-and-chatgpt-images-2-0-in-microsoft-365-copilot/4514243(opens in new window)

Microsoft 365 Apps & Productivity

Get more out of Microsoft Clipchamp with these little-known features (1 May) — Tips on under-used Clipchamp features for video editing inside M365. https://techcommunity.microsoft.com/blog/microsoft365insiderblog/get-more-out-of-microsoft-clipchamp-with-these-little%E2%80%91known-features/4514855(opens in new window)
Microsoft 365 Backup — granular restore now GA (29 Apr) — Item-level / granular restore is now generally available in the M365 Backup service. https://techcommunity.microsoft.com/blog/microsoft_365blog/microsoft-365-backup-granular-restore-now-generally-available/4515936(opens in new window)
Converse naturally across languages with consecutive interpretation (25 Apr) — New M365 Insider feature delivering live consecutive interpretation between speakers. https://techcommunity.microsoft.com/blog/Microsoft365InsiderBlog/converse-naturally-across-languages-with-consecutive-interpretation/4514327(opens in new window)

Security & Defender

Enterprise Security Assessment — a strategic lens for mission-critical environments (30 Apr) — Framework for assessing security posture in mission-critical workloads. https://techcommunity.microsoft.com/blog/microsoftmissioncriticalblog/enterprise-security-assessment-a-strategic-lens-for-mission-critical-environment/4515991(opens in new window)
EDR coexistence by design — a practical starting point to Defender (30 Apr) — Guidance on running Microsoft Defender alongside third-party EDR tools during transition. https://techcommunity.microsoft.com/blog/microsoftsecurityexperts/edr-coexistence-by-design-a-practical-starting-point-to-defender/4515265(opens in new window)
Email threat landscape Q1 2026 — trends and insights (30 Apr) — Microsoft’s quarterly report on phishing, BEC and email-borne attack trends. https://www.microsoft.com/en-us/security/blog/2026/04/30/email-threat-landscape-q1-2026-trends-and-insights/(opens in new window)
Granular email content access with unified RBAC — now default for new Defender for Office 365 tenants (29 Apr) — New tenants get the granular RBAC model by default for controlling who can read email content during investigations. https://techcommunity.microsoft.com/blog/MicrosoftDefenderforOffice365Blog/granular-email-content-access-with-unified-rbac-%E2%80%93-now-the-default-for-new-defend/4505344(opens in new window)

Identity (Microsoft Entra)

You can’t govern what you can’t see — closing the identity visibility gap for apps (30 Apr) — Entra capabilities to discover and govern app identities that are typically invisible to admins. https://techcommunity.microsoft.com/blog/microsoft-entra-blog/you-can%E2%80%99t-govern-what-you-can%E2%80%99t-see-closing-the-identity-visibility-gap-for-apps/4507464(opens in new window)

Microsoft Sentinel

What’s new in Microsoft Sentinel — April 2026 (1 May) — Monthly roundup of feature updates, connectors, and detection improvements in Sentinel. https://techcommunity.microsoft.com/blog/MicrosoftSentinelBlog/what%E2%80%99s-new-in-microsoft-sentinel-april-2026/4516354(opens in new window)

Exchange Online

Deprecating legacy TLS and endpoints for POP and IMAP in Exchange Online (27 Apr) — Timeline and impact for the retirement of legacy TLS versions and older POP/IMAP endpoints. https://techcommunity.microsoft.com/blog/exchange/deprecating-legacy-tls-and-endpoints-for-pop-and-imap-in-exchange-online/4515201(opens in new window)

Corporate / Earnings

Microsoft FY26 Q3 earnings — press release & webcast (29 Apr) — Microsoft’s third-quarter FY26 financial results announcement page. https://www.microsoft.com/en-us/Investor/earnings/FY-2026-Q3/press-release-webcast

After hours

Starship – Test like you Fly – https://www.youtube.com/watch?v=ANe_HW4X8oc

Editorial

If you want to be part of a dedicated Microsoft Cloud community with information and interactions daily, then consider becoming a CIAOPS Patron – www.ciaopspatron.com.

Watch out for the next CIA Brief next week