https://pwn.watch/t/microsoft-365 Live security incidents worldwide: CVEs, patch status, fixed versions, advisories and the posts that broke them. en Fri, 23 Oct 2026 00:37:32 GMT https://pwn.watch/i/connectwise-cloud-backup-m365-hijack https://pwn.watch/i/connectwise-cloud-backup-m365-hijack Fri, 23 Oct 2026 00:37:32 GMT critical <p>ConnectWise disabled Cloud Backup after a compromised credential let attackers authenticate as the application and sign in to at least 173 customer Microsoft 365 tenants.</p> <p><strong>Status:</strong> live · <strong>Patch:</strong> partial</p> <p><strong>Latest updates:</strong></p><ul><li>2026-10-22: Microsoft details Storm-0940's Oct 10-14 password spray (151,000+ failed logons, peak 2,900/min) before the Oct 15 takeover of ConnectWise cloud app identities; ConnectWise says phased service restoration will take several days. (<a href="https://thehackernews.com/2026/10/china-linked-hackers-use-artex-ai.html">source</a>)</li><li>2026-10-22: ConnectWise CEO Manny Rivelo says the affected application connections are contained and services are being restored gradually, but cutting those connections won't necessarily evict attackers who already set up persistent access in customer tenants. Microsoft hasn't said how many customers were compromised. (<a href="https://www.theregister.com/security/2026/10/22/microsoft-says-connectwise-breach-let-chinese-spies-loose-on-2250-cloud-tenants/5304687">source</a>)</li><li>2026-10-22: Wiz Research says the same ARTEX-using actor, overlapping with Storm-0940, is also targeting other IT and software vendors: password-spraying Okta and Entra, abusing Cognito and account-recovery endpoints, and probing Microsoft 365 integrations and tenant isolation. Wiz published IPs and user agents to hunt for. (<a href="https://www.wiz.io/blog/artex-in-the-wild-storm-0940-expands-targeting-of-it-and-software-vendors">source</a>)</li></ul> https://pwn.watch/i/microsoft-midnight-blizzard-corporate-email-breach https://pwn.watch/i/microsoft-midnight-blizzard-corporate-email-breach Tue, 02 Apr 2024 00:00:00 GMT high <p>Russia's Midnight Blizzard (APT29) password-sprayed a legacy, non-production Microsoft test tenant without MFA, then abused an OAuth app to read email of Microsoft senior leadership and security staff. Microsoft detected the attack on 2024-01-12. Stolen emails included correspondence with US federal agencies, so CISA issued Emergency Directive 24-02 ordering agencies to analyze the exposed emails and reset any compromised credentials.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> no-fix-needed</p> <p><strong>Latest updates:</strong></p><ul><li>2024-04-02: CISA issues Emergency Directive 24-02 for agencies whose email with Microsoft was exposed (<a href="https://www.cisa.gov/news-events/directives/ed-24-02-mitigating-significant-risk-nation-state-compromise-microsoft-corporate-email-system">source</a>)</li><li>2024-01-25: Microsoft publishes guidance for responders on the Midnight Blizzard attack (<a href="https://www.microsoft.com/en-us/security/blog/2024/01/25/midnight-blizzard-guidance-for-responders-on-nation-state-attack/">source</a>)</li><li>2024-01-12: Microsoft detects a nation-state attack on its corporate systems (<a href="https://www.microsoft.com/en-us/security/blog/2024/01/25/midnight-blizzard-guidance-for-responders-on-nation-state-attack/">source</a>)</li></ul> https://pwn.watch/i/microsoft-storm-0558-forged-tokens-exchange-online-2023 https://pwn.watch/i/microsoft-storm-0558-forged-tokens-exchange-online-2023 Wed, 06 Sep 2023 00:00:00 GMT critical <p>China-based Storm-0558 used a stolen Microsoft consumer (MSA) signing key, plus a token validation bug, to forge tokens and read Exchange Online and Outlook.com mail at about 25 organisations, including US government agencies. Microsoft later said the key leaked through a 2021 crash dump.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> patched</p> <p><strong>Latest updates:</strong></p><ul><li>2023-09-06: Microsoft: the key most likely leaked via a 2021 crash dump that reached its corporate network (<a href="https://msrc.microsoft.com/blog/2023/09/results-of-major-technical-investigations-for-storm-0558-key-acquisition/">source</a>)</li><li>2023-07-14: Microsoft details how the stolen MSA key was used to forge tokens (<a href="https://www.microsoft.com/en-us/security/blog/2023/07/14/analysis-of-storm-0558-techniques-for-unauthorized-email-access/">source</a>)</li><li>2023-07-11: Microsoft discloses the intrusion; CISA and FBI publish AA23-193A (<a href="https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-193a">source</a>)</li></ul>