Microsoft is warning IT administrators not to wait for VBScript removal to disrupt Windows activation automation. Organizations that still rely on `slmgr.vbs` should begin moving critical workflows to PowerShell, using Microsoft’s newer activation module where it is supported.

Source

A new TerminalFix campaign is using counterfeit Cloudflare CAPTCHA pages to trick Windows users into pasting PowerShell commands that ultimately turn infected PCs into network pivot points. Instead of stopping at information theft, the multistage intrusion establishes persistence, maps Active Directory, and deploys an encrypted reverse tunnel capable of reaching internal systems.

Source

Microsoft’s Continuous Access Evaluation (CAE) can revoke access before a normal one-hour token expires, but its protection is far from universal across Microsoft 365. An analysis of 740 first-party resource tokens found that only 33 included the CAE claim, while some Microsoft clients still request ordinary tokens even when connecting to CAE-capable services.

Source

Microsoft is tracking an active fake software campaign that regenerates malicious archives behind familiar download filenames, then uses Windows components such as `msiexec.exe` to execute payloads from randomized public directories. The Silver Fox-linked activity has compromised organizations in healthcare, manufacturing, gaming, technology, logistics, government, and education, particularly those with China-based operations or Chinese-speaking users.

Source