The Week at a Glance

  • 🔴 EvilTokens phishing platform is stealing employee credentials at scale - a disrupted but still-active Phishing-as-a-Service operation uses AI-generated lures to steal authentication tokens, bypassing passwords and multi-factor authentication entirely; organizations without phishing-resistant MFA and Conditional Access policies face immediate account-takeover risk.
  • 🔴 Storm-3168 is actively attacking Azure cloud accounts via compromised app identities - attackers linked to a known threat group are using stolen service principal credentials to probe, delete resources, and harvest credentials inside Azure environments, a direct threat to cloud infrastructure integrity and business continuity.
  • 🟡 AI agents are proliferating faster than governance frameworks - employees can now build and share Copilot agents with one prompt, and without agent inventory, access controls, and tool-blocking policies in place, organizations face growing data-exposure and compliance risk as the agent estate expands.
  • 🟢 Microsoft is broadly upgrading its Copilot and device management platforms - new capabilities across Intune, SharePoint, and the Copilot app are rolling out this month and next, bringing productivity improvements that require light IT readiness but no urgent decisions.

Sources: Microsoft Security Blog - EvilTokens · Microsoft Security Blog - Storm-3168 · Microsoft Security Blog - September 2026 Roundup

Why This Week Matters

Two confirmed, active threat campaigns this week target the specific trust assumptions most organizations have not yet closed: device code authentication flows that bypass MFA, and cloud application identities that carry elevated permissions with little ongoing scrutiny. At the same time, the rapid expansion of employee-built AI agents is creating a shadow estate of automated systems that can access email, calendars, SharePoint, and third-party services, often without IT visibility. Leadership needs to understand that the identity perimeter and the AI governance perimeter are now the same conversation.

Sources: Microsoft Security Blog - EvilTokens · Copilot Studio Blog - Agentic Governance

Risk & Compliance

  • 🔴 EvilTokens device code phishing campaign: This Phishing-as-a-Service platform uses AI-generated lures to steal authentication tokens and bypass MFA, giving attackers persistent access to Microsoft 365 accounts without needing a password; this directly threatens HIPAA, SOC 2, and CMMC access-control requirements, and cyber insurance policies that mandate phishing-resistant authentication - act immediately to restrict device code flow and enforce Conditional Access.

  • 🔴 Storm-3168 cloud identity attacks on Azure: Attackers are actively exploiting compromised service principals (the machine identities that connect apps and automation to Azure) to delete resources and steal credentials, exploiting an implicit-trust gap that most organizations leave unmonitored; this is a NIST CSF Protect and Detect control failure, and affected organizations may face cloud outage, data loss, and breach notification obligations.

  • 🔴 Storm-2570 ransomware affiliate using consistent cross-platform tradecraft: This group deploys multiple ransomware families (Qilin, DragonForce, Anubis, BERT) using the same post-compromise playbook across victims, meaning defenders who know the pattern can disrupt attacks before encryption begins; organizations without endpoint detection and response coverage should treat this as an urgent gap given active deployments.

  • 🔴 NeedyMantis post-compromise malware framework: This modular malware is designed to survive inside a network long after initial compromise, using encrypted components and extensible modules to evade detection and maintain access for follow-on operations; organizations without behavioral endpoint detection or network segmentation face prolonged undetected intrusions, a direct trigger for breach disclosure under HIPAA, GDPR, and state privacy laws.

  • 🟡 AI agent governance gap as employee-built agents proliferate: Employees can now create Copilot agents in a single prompt and share them across teams, granting those agents access to email, calendars, Teams conversations, and SharePoint content - without IT visibility unless agent inventory and access controls are configured; this creates a data-exposure risk relevant to HIPAA minimum-necessary rules, GDPR data minimization, and SOC 2 access management controls.

  • 🟡 MCP server tool-blocking controls now available in Agent 365: Organizations can now centrally block agents from connecting to risky or unauthorized MCP servers (the external connectors that let agents take actions in third-party apps), but this control only protects you if administrators actively review and govern the tool catalog; plan a policy review within 30 days as agent adoption grows.

  • 🟡 Purview auto-labeling capacity increase to 500,000 files per day: Microsoft is raising the ceiling on automatic sensitivity labeling in SharePoint and OneDrive, arriving November 2026, which gives organizations a material opportunity to close data-classification gaps before Copilot accesses that content; organizations with HIPAA, GDPR, or CMMC obligations should plan to expand labeling policies to cover previously untagged files.

  • 🟢 Microsoft Cloud PKI now available for GCC High environments: Government contractors and regulated agencies in GCC High can now manage device certificate infrastructure entirely in the cloud, removing a common on-premises dependency; this strengthens device-trust verification and supports CMMC and FedRAMP certificate-based authentication requirements with no new hardware.

  • 🟢 Chromium browser vulnerabilities patched in Microsoft Edge: Multiple high-severity flaws in the browser engine underlying Edge were disclosed and patched this week, including memory corruption and race condition bugs; organizations managing Edge through Intune should confirm automatic updates are enabled, as unpatched browsers remain a common initial access vector.

Sources: Microsoft Security Blog - EvilTokens · Microsoft Security Blog - Storm-3168 · Microsoft Security Response Center

What Your Employees Will Notice

  • Planner looks different. Microsoft Planner has a cleaner, modernized interface rolling out now, with improved navigation and a new Goals feature in basic plans. Expect questions from project managers and team leads; a brief communication noting the change is cosmetic and functionality is preserved will reduce tickets.
  • Copilot Chat can now read text inside images. Copilot can extract and search text embedded in scanned documents, images in Word files, and picture-based tables in PowerPoint - content that previously returned no results. Users working with scanned contracts or image-heavy presentations will notice meaningfully better search results starting in October.
  • Outlook mobile is getting scheduled send back. The ability to schedule when an email is delivered is returning to Outlook on iOS and Android in October, along with improved accessibility via keyboard and voiceover on iOS.
  • Teams call history is reorganizing for multi-line users. Employees who manage multiple phone lines in Teams will see a redesigned call history with separate tabs per line, arriving in November. This is a positive change for those users, but brief training notes for your telephony-heavy teams will help.
  • Copilot agents are appearing in shared workspaces. As colleagues build and share Copilot agents, employees will see them in Copilot Chat, Teams, and the Agent Store. Help desk and communications teams should be prepared for questions about what these agents can access and who authorized them.

Sources: M365 Roadmap - Planner · M365 Roadmap - Copilot Chat image search · M365 Roadmap - Outlook mobile send availability

What Your Help Desk Should Expect

  • Phishing and token-theft reports: Given active EvilTokens campaigns, expect an uptick in reports of suspicious authentication prompts, unexpected MFA challenges, and potential account compromise tickets. Help desk staff should have an escalation path to security operations ready.
  • “What is this agent?” questions: As employee-built Copilot agents spread through teams, help desk will receive questions about unfamiliar agents appearing in Copilot Chat and the Agent Store, what they can access, and how to remove or report them.
  • Planner UI confusion: The Planner interface update is live this month; expect navigation questions from users who manage tasks across Teams and the web, particularly around the new Goals feature.
  • Edge browser update confirmations: After this week’s batch of Chromium vulnerability patches, some users and IT staff may ask for confirmation that their browsers are current. Be ready to point them to the Edge version check and confirm automatic updates are active.
  • Android device enrollment questions: New Android Enterprise upgrade options and eSIM bulk management features may surface questions from IT staff managing corporate-owned Android fleets, particularly around the Gmail-to-managed-domain account upgrade path.

Sources: Microsoft Security Blog - EvilTokens · Intune What’s New - Android Enterprise · M365 Roadmap - Planner

Cost & Licensing

  • Copilot agent usage tracking is now available. The new Monitor tab in Agent Builder shows sessions, daily active users, and which knowledge sources agents draw on. Before your next licensing review, use this data to distinguish agents with real adoption from those sitting idle - this will inform decisions about Copilot license seat counts and whether agent investments are delivering value.
  • Cloud PKI for GCC High eliminates on-premises infrastructure costs. Organizations currently running on-premises certificate authorities for GCC High device authentication can now migrate to Microsoft Cloud PKI through Intune, removing hardware, maintenance, and staffing costs tied to that infrastructure.
  • Purview auto-labeling capacity increase arrives at no additional cost. The jump from 100,000 to 500,000 files labeled per day in November is a platform capacity increase within existing Purview licensing - organizations that have been rate-limited on labeling can now accelerate data classification projects without a licensing change.

Sources: Microsoft Mechanics - Copilot Agent Monitor · Intune What’s New - Cloud PKI GCC High · M365 Roadmap - Purview Auto-labeling

Planning Horizon

Immediate (this week):

  • Immediate - EvilTokens device code phishing: Engage your identity or security team today to confirm device code authentication flows are restricted via Conditional Access and that phishing-resistant MFA (passkeys or certificate-based) is enforced for all privileged accounts.

  • Immediate - Storm-3168 Azure service principal attacks: Direct your Azure security team to audit service principal permissions, rotate credentials for any principals with broad access, and confirm alerting is active for anomalous Azure resource activity.

Within 30 days:

  • Within 30 days - AI agent governance and MCP tool controls: Approve a policy defining who can create, share, and publish Copilot agents, what data sources agents may access, and which MCP server tools are permitted - before agent sprawl outpaces your ability to govern it.

  • Within 30 days - MDE AI agent runtime protection for Windows: Decide whether to enable Audit mode (detect and alert) or Block mode (prevent) for AI agent runtime threats on Windows endpoints; this requires a policy decision from security leadership, not just IT configuration.

  • Within 30 days - Purview auto-labeling expansion (arriving November): Prepare updated labeling policies to take advantage of the 5x capacity increase, prioritizing SharePoint and OneDrive content that Copilot will access so sensitive files are classified before AI surfaces them.

  • Within 30 days - Copilot legal plugins for Word (arriving October): Brief your legal and compliance teams that Copilot will gain purpose-built legal document capabilities in Word in October, and determine whether any review or approval process is needed before legal staff begin using them with client or regulatory documents.

60-90 days:

Sources: Microsoft Security Blog - Storm-3168 · Copilot Studio Blog - Agentic Governance · M365 Roadmap - Purview Auto-labeling

If You Take No Action

EvilTokens token-theft campaign: Without restricting device code authentication flows and enforcing phishing-resistant MFA, your organization remains fully exposed to a live, scaled attack that bypasses your current MFA investment entirely. A compromised account does not require a password - attackers hold a valid session token and can access email, files, and connected systems until that token expires or is revoked. The downstream consequences include data exfiltration, regulatory breach notification obligations, and the reputational and financial cost of an incident that was preventable with controls already available in your existing Microsoft licensing.

Storm-3168 service principal compromise: Service principals are the automated identities behind your cloud integrations, workflows, and deployed applications. Without auditing their permissions and monitoring for anomalous behavior, an attacker who obtains a single compromised credential can traverse your Azure environment, delete resources, and pivot to additional accounts - potentially causing sustained cloud outages or data destruction. Organizations in regulated industries face additional exposure: a cloud resource deletion event may constitute a breach or business continuity failure triggering contractual, regulatory, or cyber-insurance notification requirements.

AI agent governance gap: Every Copilot agent a colleague builds and shares can be granted access to organizational email, Teams conversations, SharePoint files, and third-party systems. Without a governance policy, your organization has no reliable way to know what agents exist, what data they can reach, or whether they have been shared with unauthorized users. As the agent estate grows, the window for establishing controls narrows - retrofitting governance onto a large, undocumented agent population is significantly harder and more disruptive than defining the rules before widespread adoption takes hold.

Sources: Microsoft Security Blog - EvilTokens · Microsoft Security Blog - Storm-3168 · Copilot Studio Blog - Agentic Governance