- Published
- Source
- The Hacker News
- Filed under
- Microsoft, Malware & exploits
- Technique
- T1566 Phishing (opens in a new tab)
Security researchers ran their own code inside a protected part of Windows that is meant to stay sealed off even when the rest of the computer is taken over. The protected area is a VBS enclave, an isolated slice of memory the operating system uses to guard secrets, and the one they broke into handles passwords for a Windows anti-phishing feature. The work was done in a lab as a proof of…
Practical steps for any organisation
- Patch quickly, starting with anything facing the internet.
- Use multi-factor authentication everywhere it is offered.
- Keep tested, offline backups – and a plan for the day you need them.
More helpNCSC: 10 Steps to Cyber Security (opens in a new tab)NCSC: incident management (opens in a new tab)
Defender’s notebook
The attacker technique behind this story, in MITRE’s terms – and what to check in your own estate.
Phishing
Initial AccessWhat a defender checks
- Search mail flow for the sender, subject and links, and pull every copy from mailboxes.
- Check who clicked or replied, and what signed in afterwards.
- Block the sender and URLs, and tell staff what to look for.
Build the skillBlue Team Analyst · Email & Phishing Investigation
© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation.
MyCyberWay training
Microsoft SC-200 exam training
Defender and Sentinel in the headlines? That's the SC-200 toolkit.
Tutor-led SC-200 preparation: running security operations in Microsoft Sentinel and Defender XDR, responding to incidents across identity, endpoint, email and cloud, and threat hunting with KQL.
- Microsoft Sentinel and Defender XDR
- Incident response across Microsoft 365
- Threat hunting with KQL
Headlines and short summaries only, except where a public body publishes under an open licence. Every story links to its publisher, who owns it. MyCyberWay does not edit or endorse third-party reporting.
