M365 Cyber Governance Daily

ClickFix Malware and AI Swarms in M365

Wednesday's briefing opens with today's Citrix KEV deadline and the EWS allow-lists due 10 Oct. It then walks through the ClickFix variant that hides its VBScript in the browser cache and how to hunt for it in Defender. Next is AI-agent security: Defender agent runtime protection, Agent 365 observability, the Artex and OpenAI agent incidents, and the MCP SDK token flaw. It ends with Purview label and DLP changes, the Entra SMS/voice retirement and passkeys, the Intune Windows 11 26H2 baseline, and breaches including the Denmark CPR follow-up.