Microsoft Patches 167 Security Vulnerabilities, Including SharePoint Zero-Day and Windows Defender Flaw — How to Identify & Stay Safe

INDIA — By BharatSecure Threat Intelligence Team · Updated May 25, 2026

Severity: MEDIUM | View Full Scam Details

Microsoft Patches 167 Security Vulnerabilities in 2026: Beware of SharePoint and Windows Defender Phishing Scams in India

Scammers in India are exploiting Microsoft’s latest security patch announcement to trick users into phishing attacks that could cost you money and data.

What Is the Microsoft Patches 167 Security Vulnerabilities, Including SharePoint Zero-Day and Windows Defender Flaw?

In 2026, Microsoft released an urgent security update addressing 167 vulnerabilities across its products, including a critical zero-day flaw in SharePoint and a significant weakness in Windows Defender. These vulnerabilities, if left unpatched, could allow hackers to take control of systems, steal data, or spread malware undetected. SharePoint is widely used by Indian businesses for document management, and Windows Defender is the default antivirus for most Windows computers, making the threat particularly relevant to millions in India.

Cybercriminals have quickly taken notice and are leveraging this announcement in phishing scams targeting Indian internet users, especially small businesses and professionals who rely on Microsoft 365 services for work. The Indian Computer Emergency Response Team (CERT-In) and the Indian government’s Integrated Financial Crime and Cybercrime (I4C) Cell have issued alerts to warn users about fake emails and WhatsApp messages impersonating Microsoft support teams. These scams are growing in India due to the widespread use of WhatsApp and increasing digital dependency post-pandemic.

How This Scam Works — Step by Step

1. Fake Microsoft Alert Message: Scammers send a message via WhatsApp, email, or SMS, claiming to be from Microsoft Support. The message warns of the newly discovered vulnerabilities and urges urgent action to “secure” your account or device.

2. Urgent Call to Action: The message often includes a link to a fake website mimicking Microsoft’s official patch update page or a phone number to call for “technical support.”

3. Social Engineering Tactics: When you visit the fake website or call the number, scammers pose as genuine tech support agents. They pressure you to share remote access to your device, disclose Microsoft login credentials, or install a “security patch” that is actually malware.

4. Data Theft and Account Compromise: With access, scammers steal your Microsoft account details, which could include emails, sensitive business documents, or linked payment options.

5. Financial Losses: The attackers use stolen information to request money transfers through UPI apps, initiate fraudulent payments, or even manipulate Aadhaar-linked accounts if compromised.

6. Continued Exploitation: After the initial attack, scammers may use the access to spread the scam to your contacts or steal personal data for identity theft.

Real Warning Signs to Watch For

• Messages or calls claiming to be urgent Microsoft support without prior contact.
• Requests for remote desktop access or installation of unofficial security software.
• Links directing you to websites with URLs that look suspicious or differ slightly from microsoft.com.
• Communications that pressure you to act immediately or threaten account suspension.
• Unsolicited WhatsApp or SMS messages from unknown numbers about Microsoft patches.
• Requests for OTPs or passwords during phone calls or chats.
• Promises of guaranteed protection or refund in exchange for account details.

What Happens to Victims

Victims in India often face serious financial and emotional consequences. Fraudsters may empty UPI-linked bank accounts, causing irreversible monetary loss because UPI transactions are instant and usually non-reversible without bank intervention. Aadhaar misuse through compromised accounts can lead to identity theft, affecting loans, PAN records, and credit scores. Often, victims also undergo SIM swap frauds where their mobile numbers get hijacked, cutting off access to OTPs and banking alerts, making it harder to detect fraudulent transactions. The stress of losing sensitive documents or facing threats due to leaked business data can be devastating for small entrepreneurs and professionals who rely heavily on Microsoft tools.

What RBI and CERT-In Say

The Reserve Bank of India (RBI) has reinforced cybersecurity guidelines for financial platforms and advised users to be wary of phishing that masquerades as official software updates. CERT-In has issued alerts warning against suspicious messages and recommends verifying any security patch notifications directly on official Microsoft channels. The I4C also encourages users to report such incidents immediately.

If you encounter such scams, you can reach the 1930 National Cyber Crime Reporting Portal helpline or the RBI helpline number to seek assistance. Both agencies emphasize never sharing OTPs, PINs, or passwords, and urge users to remain vigilant with unexpected digital communications.

How to Protect Yourself

1. Always verify security update announcements on Microsoft’s official website or trusted news sources, never click on links in unsolicited messages.
2. Do not share remote desktop access with anyone who contacts you unexpectedly.
3. Ignore messages demanding immediate action or password disclosure for security patches.
4. Confirm with your IT department if you work in an organization before making any updates related to Microsoft products.
5. Keep your operating system and antivirus software updated through official channels only.
6. Regularly monitor your UPI and bank accounts for unusual transactions and link Aadhaar only with trusted apps.
7. Report suspicious Microsoft-related messages to BharatSecure.app or cybercrime.gov.in for investigation.

What to Do If You've Been Targeted

1. Immediately disconnect your computer from the internet and do not share any more information.
2. Change all passwords related to Microsoft accounts and other linked services from a different, safe device.
3. Freeze your bank accounts and block UPI payments temporarily through your bank’s customer care.
4. Report the incident to the National Cyber Crime Reporting Portal (cybercrime.gov.in) and call the 1930 cybercrime helpline.
5. Inform your bank and request a fraud alert for your accounts.
6. Contact your mobile operator to check for possible SIM swap fraud.
7. Keep all evidence of communication safely for reporting and follow up with CERT-In guidelines.

Frequently Asked Questions

What should I do if I receive a Microsoft patch notification on WhatsApp?
Do not click on any links or call the numbers provided. Visit Microsoft’s official website to confirm updates or contact their verified support channels.

Can Microsoft ask for remote access through phone or WhatsApp?
No, Microsoft support never asks for remote access or passwords through such channels. Always refuse such requests.

Is it safe to update Windows Defender and SharePoint only through my device’s update settings?
Yes. Always update software using official update tools or directly via the Microsoft Store or Windows Update feature on your device.

Stay safe! If you receive suspicious Microsoft patch messages or calls, verify them first at BharatSecure.app before taking any action. Awareness and caution can protect you from cyber fraud in 2026 and beyond.