Defender's Corner

Single sign-on (SSO) is the system that lets you log in once and stay logged into multiple apps and services without re-entering your credentials. Microsoft has quietly made this easier to manage for IT teams, according to Help Net Security.

Windows 11 now supports a registry-based policy that lets administrators automatically accept SSO permission prompts on managed devices linked to Microsoft Entra ID (Microsoft's cloud identity platform). This removes friction for employees while keeping IT in control of what access is granted.

If you manage devices at work, you can deploy this through Group Policy, Microsoft Intune, or any compatible mobile device management tool.

What you should do: If you are an IT administrator running Windows 11 version 24H2 or 25H2 with Entra ID, review Microsoft's SSO policy documentation and test the registry setting in a small device group before rolling it out broadly. Less friction for users, more consistency in access control for you.

Microsoft is making passkeys the default login method for Entra ID (an enterprise identity service used by millions of organisations to manage employee logins) starting September 2026, according to Bleeping Computer. SMS and voice authentication codes will be fully retired in February 2027.

Passkeys work like a secure key stored on your device — no code to intercept, no phishing link that works. Microsoft reports that AI-assisted phishing campaigns now achieve click-through rates of 54%, compared to roughly 12% for traditional attacks. SMS codes are vulnerable to exactly that.

If you use Microsoft work accounts: ask your IT team whether you are on SMS-based login. If you are, register a passkey or Windows Hello before the September rollout. Microsoft's step-by-step setup guide is here.

Starting September 1, 2026, Microsoft will begin making passkeys the default sign-in method for Microsoft Entra ID (the identity system used by Microsoft 365 and most corporate Microsoft accounts), according to Help Net Security.

A passkey is a login credential stored on your device — your phone or laptop — that uses biometrics or a PIN instead of a password. It cannot be phished, because there is nothing to hand over to a fake website.

If your organisation uses SMS codes for multi-factor authentication (MFA), you will be prompted to set up a passkey the next time you log in. By February 2027, SMS-based MFA will no longer be accepted without registering a passkey first.

You do not need to do anything right now — Microsoft will prompt you. But when that prompt appears, accept it. Passkeys are meaningfully more secure than SMS codes, which can be intercepted.

A SentinelOne investigation into a multi-year espionage campaign against Pakistani law enforcement reveals a technique worth understanding: attackers disguised malware as a legitimate software update for a portal already trusted by staff, according to The Hacker News.

The implant was named to look like a routine plugin for a complaint management system. Staff had no reason to question it.

This is called a trojanised update (legitimate-looking software that secretly contains malicious code), and it works precisely because users trust update prompts from systems they use daily.

What you can do: Treat unexpected software updates with the same scepticism you would give an unexpected email attachment. If a portal or internal tool prompts you for an update you were not expecting, verify it with your IT team before clicking. Legitimate updates from your organisation will always be communicable through an official channel. When in doubt, ask first.

A study of 281 free Android VPN apps found widespread problems including traffic leaks, unencrypted data transmission, and hidden tracking, according to Bleeping Computer. A VPN is meant to create a secure, private tunnel for your internet traffic — but an untrustworthy one can expose exactly what you were trying to protect.

Free VPNs with no clear business model often fund themselves through your data.

What to do: If you use a VPN on Android, stick to well-reviewed paid services or widely trusted free options with published transparency reports. Check your current app's permissions — a VPN has no business accessing your contacts or microphone. If you are not sure whether your VPN is legitimate, removing it is safer than keeping it.

GitHub released npm 12 this week, and one change directly addresses the kind of supply chain attack described in today's breach story. According to The Hacker News, install scripts — small programs that run automatically when you download a code package — are now disabled by default.

Previously, a malicious package could execute code the moment a developer ran an install command. Now, those scripts must be explicitly approved first.

If you are a developer: upgrade to npm 12 now. Run npm approve-scripts --allow-scripts-pending to review any scripts in your current project before approving them. Think of it like previewing a contract before signing it, rather than having it auto-signed the moment it arrives.

Not a developer? Forward this to whoever manages your team's software builds. This one matters.

Get npm 12 at npmjs.com.

The Friendly Fire research above makes one defensive tool directly relevant today: AWS has released the Claude Apps Gateway, described by Help Net Security. It is a self-hosted control plane for organisations using Claude Code (Anthropic's autonomous coding tool) in a team setting.

Instead of each developer holding their own long-lived credentials, the gateway issues short-lived tokens that expire within an hour. It centralises policy controls and enforces tool permissions across your whole team. Organisations managing multiple developers can use it to limit which tools agents can access and revoke access instantly by removing a developer from your identity provider.

This directly limits the blast radius if an agent is manipulated into executing malicious code. Fewer permissions mean less damage. Find it via Help Net Security.

Langflow is a drag-and-drop tool for building AI agent pipelines — popular with developers connecting large language models to external services. It has been having a rough year.

CISA (the US Cybersecurity and Infrastructure Security Agency) has ordered federal agencies to patch CVE-2026-55255, an actively exploited flaw in Langflow, according to Bleeping Computer. Attackers who exploit it can access other users' data flows and harvest cloud credentials and compute resources for botnet use.

If you or your team runs a Langflow instance, update it immediately. Attackers are already exploiting this, and the prize — live LLM API keys and cloud credentials — is exactly the kind of access that funds further attacks.

Check your Langflow version at langflow.org and apply the latest update. If your instance is internet-facing, take it offline until patched.

Microsoft is enabling its Windows settings backup tool by default for organisations running Windows 11 26H2, according to Bleeping Computer. The feature, available on Microsoft Entra-joined devices, automatically backs up a user's Windows settings so they can be restored after a device is reset, replaced, or wiped.

This matters from a security standpoint: when employees lose a device or face a ransomware recovery, having settings backed up cuts recovery time significantly and reduces the window of exposure.

What you should do: If your organisation uses Microsoft Entra (formerly Azure Active Directory), check whether the backup policy is configured intentionally. IT administrators can manage the setting through Microsoft Intune or Group Policy. If your organisation operates in an EU Digital Markets Act region, the default-on behaviour does not apply — but enabling it manually is still worth considering.

Most people send hundreds of emails a week without realising the protocol was designed with almost no authentication at all. That gap is one of the most commonly exploited entry points for phishing and brand impersonation attacks, according to a Help Net Security feature on email security strategy.

The practical fix for businesses and individuals running their own domains is DMARC (Domain-based Message Authentication, Reporting and Conformance — a standard that tells receiving mail servers what to do when an email claiming to be from your domain fails authentication checks). Without it, anyone can send email pretending to be you.

Check whether your domain has DMARC configured using MXToolbox's free DMARC lookup — enter your domain and it will tell you in seconds. If it shows no record, ask your email provider or IT contact to set one up. Start with a policy of p=none to monitor, then move to p=reject to block fakes entirely.