Sandworm-linked attackers are using fake IT recruitment campaigns to trick system administrators into installing a modified WireGuard VPN client. The malware targets both Windows and Linux, decrypts hidden code, and downloads additional payloads after the victim connects to the supposed corporate VPN.

Source

SharePoint Online now supports Microsoft Purview sensitivity labels for OneNote sections and MP4 video files, extending protection beyond traditional Office documents and PDFs. Administrators must enable the new file types separately, and OneNote requires an updated SharePoint Online Management Shell.

Source

A new PowerShell report gives Microsoft Planner project coordinators a six-week view of unresolved work, with one weekly count and an average per user. The scheduled Saturday-based report reads historical data from a SharePoint Online list and highlights whether task backlogs are shrinking.

Source

Intelligent Terminal 0.2 adds native local model support, allowing agents to run against Ollama or other OpenAI-compatible endpoints without sending prompts to the cloud. The Windows Terminal fork also adds per-tab agent and model selection, WSL-aware profiles, and first-class OpenCode support.

Source

Windscribe has released deGDID, a free, open-source PowerShell script that removes Microsoft’s Global Device Identifier (GDID) from Windows and blocks the system from creating it again. The privacy tradeoff is significant: the protection can disrupt Xbox, Outlook, Microsoft Store, and other Microsoft-connected services.

Source

Microsoft Teams PowerShell module 7.9.0 changes how interactive Windows sign-ins work by using Web Account Manager (WAM). WAM is the Windows sign-in component that brokers a user's authentication for an application. The release also adds commands and policy parameters for voicemail, channels, meetings, calling, events, and AI agents, while removing the Teams Shifts Connection commands. This article separates settings you can use now from parameters for features that Microsoft says are not fully released.

Source

Microsoft’s new Exchange Online PowerShell cmdlet, Invoke-ChangeMeetingOrganizer, is now rolling out to commercial tenants, but some administrators will see “Transfer meeting action is disabled” until backend updates reach their tenant. The feature can eliminate much of the manual work involved in reassigning future meetings after an employee leaves, but online-meeting details still require hands-on cleanup.

Source

Microsoft has withdrawn Microsoft 365 Copilot’s Domain Exclusion feature only about a week after beginning its rollout. The administrator control, designed to block up to 1,000 websites from Copilot’s web-grounding results, has also been removed from organizations that already received it.

Source

Microsoft is pushing the new OneDrive Photos app onto Windows 11 enterprise PCs, including Intune-managed devices, even though it only supports personal Microsoft accounts. Removing its shortcut is temporary because the app returns with OneDrive updates, leaving administrators with an ongoing cleanup problem.

Source

Microsoft Entra Global Secure Access migrations no longer have to start with rebuilding every application and policy manually. The open-source Migrate2GSA toolkit preserves existing Secure Service Edge configuration, converts it into a reviewable format, and provisions approved changes through Microsoft Graph—with safeguards designed to keep administrators in control.

Source