Loading story…
Windows 11 has introduced several significant changes that impact both enterprise security and digital forensics, particularly as organizations prepare for the end of Windows 10 support in October 2025. Despite Windows 11 being available for several years, enterprise adoption has lagged, with many organizations still relying on Windows 10 and even Windows 7, according to data from Kaspersky’s Global Emergency Response Team. As Windows 10 reaches end-of-life, a shift toward Windows 11 is expected, which will bring new challenges and opportunities for incident response teams. One of the most notable new features in Windows 11 is Recall, an AI-powered tool that continuously takes screenshots of the user’s display, analyzes them locally, and stores extracted information in a searchable database. This feature, available broadly since May 2025 on ARM-based systems with dedicated NPUs, has sparked controversy due to its privacy implications and the potential forensic value of its artifacts. Recall’s database could provide investigators with a detailed timeline of user activity, but it also raises concerns about the security and retention of sensitive information. In parallel, Microsoft has expanded the capabilities of Copilot, its AI assistant, within Windows 11. Copilot can now link to both Microsoft and Google accounts, allowing users to access files, emails, and calendar data from services like OneDrive, Outlook, Google Drive, Gmail, and Google Calendar directly through the Windows interface. This integration, currently available to Windows 11 Insiders, enables users to query Copilot for specific information across multiple platforms, such as retrieving contact details or locating recent documents. The process involves connecting accounts through the Copilot app’s settings, after which the AI can search and retrieve data as requested. These advancements in AI-driven features not only enhance user productivity but also introduce new vectors for data exposure and complicate the forensic landscape. Security professionals must now account for the presence of AI-generated artifacts and the expanded data access capabilities when conducting investigations or assessing organizational risk. The combination of Recall’s comprehensive activity logging and Copilot’s cross-platform data access underscores the need for updated security policies and forensic methodologies tailored to Windows 11’s evolving ecosystem. As organizations transition to Windows 11, understanding these features and their implications will be critical for maintaining robust security postures and effective incident response.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Securelist published research on Windows 11 forensic artifacts in the context of Windows 10 reaching end of life. The reference indicates a technical analysis release rather than a discrete security incident.
ZDNET published an article describing a practical test of Copilot against the author's Microsoft and Google accounts and reporting the observed results. The reference does not provide additional incident details beyond the publication itself.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
zdnet.com
Open sourcedoublepulsar.com
Open sourcesecurelist.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft has announced a major upgrade to its Copilot AI integration in Windows 11, introducing a new feature called Copilot Actions. This feature enables AI agents to perform real tasks on users' local files and applications, moving beyond simple chatbot interactions to more advanced, agentic capabilities. Copilot Actions allows users to interact with their PC using natural language, voice commands, and visual cues, enabling the AI to open and close apps, update documents, organize files, book tickets, and send emails on behalf of the user. The feature is currently being tested by members of the Windows Insider Program and will eventually be rolled out to all Windows 11 PCs, regardless of whether they are classified as Copilot+ devices. Microsoft has emphasized the importance of security and privacy in the design of Copilot Actions, especially in light of previous controversies such as the Recall feature. To address potential risks, Copilot Actions requires explicit user permission before taking any action, and users retain the ability to control or revoke access at any time. Each AI agent operates within its own isolated Agent Workspace, ensuring that actions taken by one agent do not affect others or the broader system. Agents run under distinct standard Windows accounts with no administrative privileges, and their activities are governed by strict application and file system access rules. Microsoft has also implemented operational trust measures, such as digitally signed agents, and all agent activities are subject to the Microsoft Privacy Statement and Responsible AI Standard. The company is optimizing these workspaces to minimize any impact on system performance and has confirmed that there will be no changes to Windows 11 hardware requirements. The introduction of Copilot Actions represents a significant shift in how users interact with their PCs, transforming AI from a passive assistant to an active digital collaborator. However, this evolution also raises new questions about trust, as users must decide whether to allow AI agents access to sensitive files and applications. Microsoft is addressing these concerns by building in robust security guardrails and transparency around agent actions. The company is taking a cautious approach, learning from past experiences and ensuring that security controls are in place before the feature becomes widely available. As Copilot Actions moves from testing to general availability, Microsoft is expected to continue refining its security and privacy measures based on user feedback and ongoing risk assessments. The rollout of Copilot Actions is part of Microsoft's broader vision to deeply integrate AI into the Windows desktop environment, aiming to enhance productivity while maintaining user trust and system integrity. Security professionals and CISOs should closely monitor the deployment of Copilot Actions, assess the potential risks associated with agentic AI, and ensure that organizational policies are updated to address these new capabilities. The evolution of Copilot in Windows 11 underscores the growing importance of balancing innovation with security and privacy in the age of AI-driven computing.
Jun 29, 2026
Microsoft has introduced new agentic AI features in Windows 11, allowing background AI agents to perform tasks such as organizing files, scheduling meetings, and sending emails. These features, currently available as an optional toggle in Windows Insider test builds, are designed to enhance user productivity by enabling AI agents to act as digital collaborators. However, Microsoft has acknowledged that these agentic capabilities introduce novel security risks, particularly if attackers are able to manipulate the agents to execute malicious instructions or access sensitive user data. To mitigate these risks, AI agents are given separate user accounts and operate within a restricted workspace, but they may still require access to key user folders such as Documents, Downloads, and Desktop. Microsoft has issued explicit warnings that the agentic AI features should only be enabled by users who fully understand the security implications, and the setting is disabled by default. The company has published detailed support documentation outlining how these agents function, the permissions they require, and the potential for malware installation if the feature is misused. Security experts and Microsoft itself emphasize the importance of balancing productivity gains with the need to safeguard user data and system integrity as these advanced AI capabilities become more deeply integrated into the Windows operating system.
Jul 12, 2026
Windows 11 adoption has accelerated to roughly three-quarters of the desktop Windows install base, while Windows 10 usage has fallen sharply following Microsoft’s decision to end support for the older OS. Reporting citing StatCounter data puts Windows 11 at **~72.8%** share versus **~26.3%** for Windows 10, with the shift attributed to a mix of PC refresh cycles and users moving off an unsupported platform. The same coverage notes that Windows 11’s stricter hardware requirements and its push toward Microsoft-account-based setup have been persistent friction points, driving some users to seek workarounds that Microsoft has increasingly tried to block. Separately, ongoing debate about Windows privacy has continued to focus on Microsoft’s collection of diagnostic data (*telemetry*) from Windows PCs. Commentary on the issue argues that claims of “spying” are often made without evidence, and points to the availability of network monitoring and inspection tools that allow users to review what telemetry is transmitted. The discussion also highlights that Microsoft’s telemetry practices have been subject to scrutiny by government privacy regulators (particularly in the EU), keeping telemetry and data-handling transparency as a recurring enterprise risk consideration alongside OS lifecycle and upgrade planning.
Jun 29, 2026