Loading story…
Microsoft confirmed that a recent Microsoft Edge update introduced a regression that disables the right-click Paste option in the Microsoft Teams desktop client, leaving the context-menu entry greyed out for URLs, text, and images. The issue affects Windows and macOS systems running Teams desktop version 26072.519.4556.7438, which relies on an Electron-based framework and the Edge WebView2 runtime; Teams for Web is not affected.
Users reported the problem across enterprise and personal accounts, including Teams Free and Insider builds, and Microsoft said reinstalling Teams or clearing its cache does not fix it. The company has identified the cause and is deploying a staged fix while monitoring telemetry, but has not given a firm timeline for full remediation. Until the update reaches affected users, Microsoft is advising use of keyboard shortcuts such as Ctrl+V on Windows and Cmd+V on macOS and encouraging feedback or service health reports from impacted tenants.
See real exploitation activity before you spend the cycle.
3 events from the most recent confirmed update back to the earliest known activity.
Microsoft said it identified the cause of the regression and started deploying a fix in stages while monitoring telemetry. As of the reporting, the company had not provided a firm timeline for full remediation to all affected users.
Microsoft acknowledged the issue in a service health notification and said a recent Microsoft Edge update introduced a regression affecting Teams desktop clients that rely on the Edge WebView2 runtime. The company noted that keyboard shortcuts such as Ctrl+V and Cmd+V still worked as a workaround, while Teams for Web was not affected.
Users started reporting that the Microsoft Teams desktop client could no longer paste URLs, text, or images via the right-click context menu on Windows and macOS. Reports indicated the issue affected enterprise and personal accounts, and reinstalling Teams or clearing its cache did not fix it.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
3 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcebleepingcomputer.com
Open sourcelearn.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft reverted a service update after it caused some **Microsoft Teams desktop client** users to become stuck on the loading screen with the error, “We’re having trouble loading your message. Try refreshing.” The company tracked the disruption as incident `TM1283300`, initially describing it as a transient service infrastructure issue before identifying the root cause as a regression in the Teams client build-caching system that pushed some older desktop builds into an unhealthy state. Microsoft said the impact appears limited to the **desktop client**, with no indication that web or mobile users were affected. The company reported that its automated recovery system helped remediate the issue, then fully rolled back the problematic update and monitored telemetry and customer feedback to confirm recovery. Impacted users were instructed to fully quit and restart Teams so the reverted configuration could propagate, though Microsoft did not disclose how many customers or regions were affected.
Jun 29, 2026
Opera has added **Paste Protect** to block `ClickFix` attacks that trick users into copying and running malicious commands from fake browser errors, CAPTCHA prompts, system warnings, or other social-engineering lures. Enabled by default in the latest browser release, the feature analyzes copied content with platform-specific rules for **Windows, macOS, and Linux**, cancels suspicious clipboard actions, warns the user, and delays any manual override. The move comes as ClickFix has grown from a fringe crimeware tactic into a widely used intrusion method and was formalized in **MITRE ATT&CK** as `T1204.004` for malicious copy-and-paste user execution. Recent analyses show ClickFix being used to deliver malware and evade detection through trusted tools and compromised websites. One observed chain pushed victims to paste a **PowerShell** command that downloaded a decoy PDF and `Twinkle.exe`, which unpacked a trojanized **AeroAdmin** instance and ultimately deployed **Vidar Stealer** to harvest browser credentials, messaging data, FTP and cloud secrets, cryptocurrency wallet data, and other files before deleting artifacts. Other campaigns used watering-hole compromises to inject obfuscated JavaScript that profiled visitors and launched `mshta`-based payloads from attacker-controlled domains, while lab research demonstrated how Windows `nslookup` and DNS responses can carry ClickFix payloads in ways that leave limited DNS telemetry and complicate defender visibility.
Jul 12, 2026
Threat actors are expanding **ClickFix**-style social engineering beyond simple “copy/paste this command” lures, including a campaign that abuses **Pastebin comments** to push victims toward executing attacker-supplied **JavaScript** in their browser to hijack cryptocurrency swap flows. The Pastebin comments promote a fake “Swapzone.io arbitrage exploit” and route users through a `rawtext[.]host` link to a Google Doc (“Swapzone.io – ChangeNOW Profit Method”) that instructs users to run JavaScript which can modify the swap process in-session and redirect funds to attacker-controlled wallets; the reporting notes this may be an early example of ClickFix being used to directly alter webpage functionality for theft. Separately, Objective-See documented ClickFix as a rapidly growing infection technique on **macOS and Windows** that relies on persuading users to paste attacker-controlled commands into a terminal, enabling execution without exploiting software vulnerabilities and potentially bypassing macOS protections such as **Gatekeeper** and **Notarization**. The post describes a practical macOS-focused mitigation that intervenes at “paste time” to disrupt many ClickFix attempts, implemented in *BlockBlock*, while also outlining limitations and potential bypasses—reinforcing that ClickFix is primarily a user-manipulation problem that defenders should address with both technical controls and user-execution friction.
Jun 29, 2026