Windows 11 looks like it’ll get its basic search functionality seriously bolstered, with a natural language searching feature progressing nicely through testing – but it’s only for those with Copilot+ PCs.
These ‘local semantic search’ powers have arrived in the latest preview release in the Beta channel (build 26120.3585, as noticed by Neowin), for Copilot+ laptops with AMD or Intel processors. Furthermore, they’ve also turned up in Release Preview for Snapdragon (Arm-powered) Copilot+ PCs.
The move means you can use natural language for a search query in Windows, such as “find photos of me with my dog” or “find that document which is my holiday packing checklist,” rather than having to remember any exact file names.
This doesn’t just work in terms of searching your files and folders (meaning File Explorer), but also with searches in the Settings app – so you can perform queries such as “show me the Bluetooth devices connected to my PC” to pick out another example.
All of this leverages the power of the NPU of the Copilot+ PC. All the processing is done locally, with no data sent to the cloud, which obviously means that you don’t have to be connected to the internet.
Also worked into this particular piece of functionality is the ability to use this AI-enhanced search to find photos in the cloud, should you wish.
Microsoft explains: “In addition to photos stored locally on your Copilot+ PC, photos from the cloud will now show up in the search results together. In addition to searching for photos, exact matches for your keywords within the text of your cloud files will show in the search results.”
This is for OneDrive only for now, but Microsoft says it’s working to bring support to third-party cloud storage services.
As for caveats, right now, searching for Windows settings will only work within the Settings app itself, but the eventual aim is to have these results flagged from the search box on the desktop taskbar (as is the case with the normal search function).
It’s worth noting that if you are a Windows tester in the Beta channel, this feature is only gradually rolling out, so you may not see it for a while yet (and you may need a couple of reboots of your Copilot+ PC to fully trigger the AI-bolstered search when it does turn up).
(Image credit: Future) Analysis: A golden gift for Copilot+ PCsA natural language search is a nifty ability for Windows 11 search, and a good use of that NPU. Windows 11’s search powers have always been rather sluggish and lacking, often proving not just slow, but failing to find anything useful, and flagging up weird results (or pointless web content). It’s been a long-complained-about area of Windows (the same is true of Windows 10), so hopefully this will go some way towards pepping up the overall experience, as well as making the functionality a lot more convenient.
Of course, with semantic indexing, Microsoft’s AI is effectively cataloguing (read: rifling through) all your files in order to have the search work in a more timely and responsive manner. Hence the reason why the company clarifies that all processing and data is stored locally, and doesn’t leave your PC – due to the potential privacy implications otherwise. This is especially important because as Microsoft notes elsewhere: “Semantic indexing is enabled by default on Copilot+ PCs.”
You can turn it off, mind, or you can selectively exclude certain files or folders (or drives). All these options are housed in the Settings app, in Privacy & Security > Searching Windows > Advanced indexing options.
This AI-driven search feature was seen in the Dev channel a while ago, so the fact that it has progressed to Beta (and Release Preview for Snapdragon-powered Copilot+ PCs) suggests it’s close to arriving in the finished version of Windows 11 for these devices.
Still, we can never be sure any feature in testing will see the light of day, but it seems very likely in this case. As it’s a complex piece of functionality, though, Microsoft could still have some tweaking and debugging on its plate. This is something Microsoft really needs to nail for release, as it’ll show off a considerable advantage of a Copilot+ PC if it turns out well – which will be a much-needed addition to the list of selling points for these computers.
You may also like...Consumers might not realize it, but their internet experience is highly dependent on networks of servers called CDNs, or Content Delivery Networks. CDN servers consist of a network connected to different Points of Presence (PoPs) around the world, and—as their name suggests—are designed to deliver content to end users as quickly as possible. They function by minimizing the distance that data needs to travel to best distribute a user’s traffic quickly and efficiently, according to their request.
Historically, the best CDN providers have been focused on specific geographic regions, like Western Europe or the United States. Today, however, more companies are beginning to take a multi-CDN approach.
At a basic level, multi-CDNs are two or more CDNs aggregated into a single system. When a request comes in from an end user, a multi-CDN system can automatically determine which of its CDNs provides the fastest route—broadening coverage areas while reducing overhead. The result is a more robust, better-optimized content delivery system, which many businesses are finding indispensable for their increasingly globalized customer base.
Single-CDN vs. Multi-CDNFor businesses contemplating whether to choose a single-CDN vs. multi-CDN approach, their decision will potentially come down to the type of content they are trying to deliver. The key concept at play here is static versus dynamic.
Dynamic content—for instance, fluctuating ecommerce or live-streaming platform offerings—can typically be effectively delivered through single-CDN approaches. Some multi-CDN providers have a switching layer that continuously switches between the CDNs in their mix. Decisions are then made based on performance to change content delivery providers for a better result for the client. Although this can occasionally create issues for an end user watching a live stream, in most cases it does not.
Nevertheless, as the digital landscape shifts toward more dynamic content, vast swathes of internet content remain static. Static content (e.g. images, CSS files, data objects, JavaScript, and prerecorded videos) change infrequently, making it perfectly suited for high-performance multi-CDN distribution. For example, the AdTech and MarTech industries often depend on multi-CDNs for banners and other pre-rendered content that remains consistent for all end users.
Since the content doesn’t change, it simplifies delivery and allows it to load faster from any geographic caching point. Additionally, many streaming platforms offer static, “on-demand videos”, which can also benefit from multi-CDNs. By caching content across multiple CDNs in a coordinated way, multi-CDNs reduce the number of requests that need to be made to the media’s origin server, reducing traffic costs from both an ingress and egress perspective.
In all these cases, multi-CDNs can route traffic to the best-performing CDN, based on their region and request, to reduce latency and improve the user experience. In comparison to a single-CDN, global providers who offer multi-CDN solutions can all but guarantee uptime, availability, and reliability—if one CDN has an outage or has performance issues, another can take over to ensure continuous availability.
For organizations with a global customer base, multi-CDNs offer a better experience for end users, delivering content quickly from the geographically closest node, providing the most efficient path – especially when compared to a region with some hyperscalers’ – irrelevant of their location. Moreover, for organizations aiming to futureproof and remain competitive, prioritizing speed and efficiency has become essential—particularly as the world becomes driven by AI technologies.
Multi-CDNs in an AI WorldAI has been integrated into almost every application. This has, inevitably, created a demand for high availability—one that multi-CDN strategies are uniquely well-equipped to meet.
AI solutions depend on high-quality data and content to succeed. These foundational elements provide the context necessary for AI to generate accurate and relevant outputs. While not dependent on multi-CDNs, AI models leverage them to retrieve data more quickly from the nearest server, delivering dynamic content with high speeds and low latency.
It is important to note that AI has also raised users’ digital expectations. Consumers now require faster, more accurate, and more relevant results across their digital experience. Thus, any solution within one's portfolio must match the speed and capabilities of AI technology. Multi-CDNs are also able to rise to this challenge by delivering dynamic content with higher speeds and lower latency, ultimately expanding global reach, and enhancing the user experience.
In addition to being delivered faster, content is also delivered more reliably. Most organizations that deploy single-CDN technology, of course, have a back-up provider in place in case the first one goes down. However, spinning up that second provider can take a long time—potentially frustrating customers and damaging business operations. However, there are various types of Multi-CDNs, including configurations of multiple single CDNs.
In some cases, a valuable switching layer is added, enabling real-time delivery optimization by dynamically switching between CDNs every second based on performance. This approach is particularly beneficial in environments where it eliminates the spin-up time required for a secondary CDN, while ensuring seamless and uninterrupted content delivery. Meanwhile, additional content caching can be accomplished, further reducing the cost of traffic both to and from its origin.
While AI does not rely directly on using multiple CDNs, the infrastructure that supports AI services—such as content delivery, data storage, and real-time inference—works better with a multi-CDN approach. By pooling the strengths of multiple individual CDN providers into one optimized system, it ensures a level of redundancy and reliability that no single CDN could possibly offer on its own.
Choosing a Multi-CDN ProviderOver the years, many organizations have turned to hyperscalers for their computing and storage needs. While these companies offer a wide array of resources, they have a dominant status in the market; and therefore, have been able to charge what some would argue are excessively high fees.
These providers will usually offer credits to welcome new buyers to their platforms, but they often do not extend a tiered or competitive price point once those credits expire, leaving organizations in a tight financial bind. The result is that companies will jump from provider to provider using up free credits, before seeking out a more cost-effective option. Additionally, hyperscalers often deploy multiple single-CDNs instead of a multi-CDN, leaving their users vulnerable to down-time and lost revenue.
As strategies shifted, enterprise to SMB organizations have begun to implement their own solutions involving multiple single-CDN providers. However, the challenges involved with this are often significant, thus creating a need for multi-CDN providers. Leading multi-CDN providers emerge as significant disruptors in this space by offering CDN services that compete with the hyperscalers’ – at a lower cost and with improved performance and reliability.
Where to Go from HereCDNs are designed to deliver content as quickly as possible. With the modern internet user, there are more dynamic expectations of the digital experience that multi-CDNs are better equipped to handle, especially with AI-based services and performance.
Organizations should strongly consider integrating a multi-CDN approach with a provider who can increase efficiency, uptime, availability, and speed with a global network. While a multi-CDN approach will not fit every scenario, more businesses are finding that the ease, flexibility, and scale vastly exceed those of traditional single-CDNs for a wide variety of use cases and workloads.
We've compiled an extensive list of the best AI tools.
This article was produced as part of TechRadarPro's Expert Insights channel where we feature the best and brightest minds in the technology industry today. The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/news/submit-your-story-to-techradar-pro
Google Maps is one of the apps that gets the most love from Google in terms of regular updates, and we've spotted another couple of upgrades rolling out to the mapping app in recent days – upgrades to add some extra convenience to your travels.
Firstly, the app is changing up how it displays route overviews. As Android Police has noted, the info card you see when you select any place on the map on Android now shows you more details about parking availability and any applicable toll fees.
This information was previously available in Google Maps, but you had to dig around a little bit to find it – now it's included on the main route overview pop-up, alongside the estimated travel time and the current traffic conditions.
It's a small tweak but one that's potentially very useful. It brings together more of the data Google Maps has in the same place, which means you're more clued up about your journeys and you can get moving more quickly. It doesn't look as though the update is live for everyone yet, but it should be eventually.
More AI in Google MapsGemini is starting to let you ask about places you view on Google MapsGemini's 'Ask about place' chip for Google Maps has started showing up.✅ Details - https://t.co/wAU6mY4VJQ pic.twitter.com/q6ne9kbxbwMarch 25, 2025
Our second new feature concerns Google's favorite tech of the moment: AI. As spotted by Android Authority, if you select a place on the map in Google Maps for Android, then activate Gemini (with a long press on the power button for example), you get a new Ask about place chip you can tap.
Gemini being able to tell you about places isn't new, but the addition of a specific shortcut means you can get some AI-generated information about a location much more quickly from Google Maps. Just watch out for hallucinations, as always.
For example, you could ask when a certain place opens or closes, or ask if it's suitable for kids. The responses will then be displayed in a Gemini overlay on top of the screen, as usual, and you can ask follow-up questions if needed.
We can expect much more in the way of Gemini integration in Google Maps and Google's other apps in the future, too. Google has been busy pushing the AI bot into as many apps as it can, while it continues to work on retiring Google Assistant.
You might also likeGoogle is now pushing out Android Auto 14.0 to phones, and while the update doesn't feature anything major in terms of the user-facing interface, it does prepare the way for a big change further down the line: replacing Google Assistant with Gemini.
As spotted by 9to5Google, there are hidden references in the code for the latest Android Auto app that mention Gemini and Gemini Live, suggesting you'll soon be able to talk to Google's more modern AI model from your vehicle.
There are text strings here too, telling you that "Gemini is now the personal AI assistant in your car" and asking for feedback on the "Gemini experience" – clear signs that the switch is coming sooner rather than later.
We also get a mention of "message summary content", so it sounds as though Gemini might be able to summarize your messages as they come in, so you can keep your eyes on the road. Let's hope Google can make sure those summaries are accurate, and sensitive to bad news.
Out with the old, in with the new Google Assistant had a good innings (Image credit: Shutterstock)None of this is any surprise of course. Google has been pushing Gemini as a Google Assistant replacement for a while now, and earlier this month announced that Google Assistant would be retired this year as far as smartphones go.
Getting other devices on Gemini – smart speakers, wearables, car dashboards – is going to take longer. Gemini is more demanding than Google Assistant in terms of the processing power and memory it needs, so older devices may miss out.
In terms of timescales, a lot of this is still up in the air. Google, understandably, doesn't want to commit to a schedule – but it would seem Android Auto (which is just an extension of Android, after all) is next in line for a Gemini upgrade.
Google Assistant had a good run, first appearing in 2016, but Gemini is now the future. You may have already noticed certain minor features being removed from Google Assistant on smart devices as Google prepares to discontinue its development.
You might also likeOura has announced a major upgrade to its activity tracking algorithms and platform that it says will more accurately detect steps and active calories burned during exercise.
"Today, we’re excited to announce all-new updates to Oura’s activity tracking platform and algorithms, empowering our members to more accurately track all the ways they move—from yard work to yoga," the company said in a press release.
Oura says it has developed a "new and improved" algorithm that will improve the accuracy of step counts and active calories burned. Dubbed "Real Steps", the company says the change is the next iteration of its step-counting algorithm.
Rather than estimating step count using generic movement, the new update "enables Oura to act more like a pedometer, using a more advanced machine-learning model to more accurately determine when ring movement is a step."
This should mean more accurate step counting, but I've got some bad news. Oura says you will likely see a drop in your step count compared to what you're used to, with members seeing an average decrease of 20%.
So if you've been using your Oura Ring to walk 10,000 steps a day, the chances are you might only have been walking 8,000.
Oura Active Calories (Image credit: Future)Oura's Active Calorie burn metrics now include the intensity of your movement during exercise, as measured by your heart rate. As such, if you're doing more intensive workouts like high-intensity interval training, you might see an increase in calories burned.
However, lower-intensity exercises like walking and yoga will likely yield a decrease in what you're used to seeing.
These changes aren't specific to any one model, so they should be available on the company's best smart ring, the Oura Ring 4, as well as the older Oura Ring 3.
Oura didn't specify how the change is rolling out, so just make sure to keep your Oura app and your Ring's firmware up-to-date.
While getting more accurate fitness tracking on a health and fitness device is always welcome, it sounds like some users might be in for a bit of a shock when they get their new step counts for the first time.
You may also like...Top Democrats call for an investigation into how war plans were shared with a journalist on Signal. And, federal employees face complications and shortages when returning to the office.
(Image credit: Andrew Harnik, Kevin Dietsc)
The RIG M2 Streamstar is a baffling product. Despite being billed as a premium microphone for streamers and more general gaming, it’s about as simple as they come with plug-and-play functionality and no included software.
You just need to slot the included cable into a free USB port, select it as your preferred recording device in the likes of OBS or Audacity, and you’re ready to go in a matter of seconds.
This, on top of its impressively compact size, could make it a decent pick if you’re looking for a portable microphone that you can easily use with a gaming laptop to keep up with your streams when on the move.
Sadly, its actual feature set is highly limited with just a basic gain dial, mute functionality, and sidetone to play around with. On top of a standard 3.5mm headphone jack it does offer the option of Bluetooth 5.4 connectivity for that side tone monitoring, with Qualcomm aptX HD codec compatibility for 24-bit hi-res audio.
This is quite innovative, and the world's first in a wired microphone according to Nacon, but ultimately doesn’t seem like the most useful thing to have. It works very well and is extremely responsive overall with no noticeable delay, but I can’t imagine that most streamers wouldn’t already have a decent pair of wired gaming earbuds, or similar, on hand for microphone monitoring.
With a unique angular appearance, the design of the microphone is quite striking and refreshingly subtle for a gaming product and this helps set it apart. Unfortunately, though, the materials used feel disappointingly cheap for the price.
It’s plasticky in the hands, with flimsy dials that even wobble slightly while being turned. This is hard to stomach when you’re dealing with a $129.99 product and when countless other options all the way from the cheaper Blue Yeti and HyperX DuoCast to more expensive SteelSeries Alias are considerably more premium and better built.
As for the performance, it’s decent but nothing to write home about. The microphone offers a 24-bit resolution with sample rates of up to 192kHz, so is proper studio quality, but can sound rather muffled and is hard to position properly without a boom arm.
The lack of software also means nothing in the way of any substantial noise cancellation, so avoid this model unless you already have a quiet recording space or software solution in place.
(Image credit: Future) RIG M2 Streamstar: Price and availabilityThe RIG M2 Streamstar costs $129.99 and is available via Amazon in the US. This price puts it towards the more premium end of the market, but, beyond its 24-bit audio and 192kHz sample rate, it really doesn’t have much to show for it. The HyperX DuoCast is just one example of a cheaper competitor that benefits from a robust set of included software, great audio performance, and a more premium design.
As for more expensive options, the JBL Quantum Stream Studio and SteelSeries Alias offer significantly more features. Thnd play compatibility, plus more strong optioe JBL Quantum Stream Studio has a variety of pickup patterns to choose from, making it a better fit for many setups, and, again, some great software. As for the SteelSeries Alias, you get a comparatively luxurious design, equally good plug and play software.
The sample rate of the RIG M2 Streamstar is considerably higher than the competition though (with most models capping out at 48 or 96kHz), so might make that high cost a little easier to stomach if that’s important to you. There’s also the unique Bluetooth side tone functionality which, depending on your peripherals and setup, could prove useful and perhaps worth the price of admission.
RIG M2 Streamstar: Specs RIG M2 Streamstar: Design and featuresThe RIG M2 Streamstar has quite an attractive design. The capsule has an angular shape, with a distinct blend of smooth rectangles and trapezoids. It looks almost futuristic and is very compact to boot, coming in at roughly 6.5in / 165mm tall when using its included stand.
The front of the microphone is dominated by a large metallic grille, which sits just above two dials. The top dial controls your headphone settings when a compatible pair is connected via the 3.5mm jack or Bluetooth. Twisting the dial increases or decreases the overall headphone volume, while pressing it once mutes the headset. Holding the button enables Bluetooth paring mode, indicated by a flashing ring light around the base of the button.
The other dial controls the microphone gain, though it’s a little tricky to adjust. It’s hard to tell your current level unless you’re using the side tone. Normally, I would simply boot up a microphone’s software to change my current settings to the precise level that I wanted - but as there isn’t any of that here you just need to do it by ear.
The lack of software also means that simple actions like enabling the side tone or changing the sample rate are convoluted and require you to fiddle around in your system settings. The included Quick Start Guide is filled with screenshots of an older version of the Windows sound settings tab, which makes it unhelpful for those on Windows 11. Simplicity is a good thing and I generally love plug-and-play functionality, but there comes a point where not having quick access to important settings is just annoying.
Pressing the gain dial quickly mutes the microphone, which is standard at this price but nevertheless a handy feature to have. Both dials are constructed from plastic and feel very cheap, even wobbling slightly when they’re being adjusted. The action of rotating the dial also leads to a lot of audible feedback, which is going to be a problem if you’re used to using a model where you can quickly adjust your settings on stream.
The included stand is basic and underwhelming, effectively a two-part lump of plastic with a rubberized underside that doesn't feel particularly sturdy and is held together by cheap screws. The microphone is compatible with most boom arms via a standard 5/8 thread though, which is good and gives you more options to work with.
One little detail I do appreciate is the fact that the microphone has a small plastic panel on its rear that is held in place by magnets and can be removed easily. This is intended to be a place where you can display your own branding, which is a cute and novel idea.
(Image credit: Future) RIG M2 Streamstar: PerformanceThe setup process is very easy, but I quickly found that the RIG M2 Streamstar tends to sound quite muffled unless you’re careful about positioning. I'm used to testing lots of different cardioid mics, but my usual spot just didn’t seem to work this time around. Instead, the microphone needed to be right below mouth in order to pick up speech reliably so it’s definitely worth investing in a boom arm if you don’t already have one.
Everything that I did manage to record once I found that position sounded good, at least. The high-fidelity recordings I produced in Audacity were very detailed and captured my voice well - at least when there wasn’t any background noise. On that note, the RIG M2 Streamstar picks up background noise easily, with everything from the click of my mouse to passing cars coming across in life-like detail.
This wouldn’t be an issue in a studio environment, but if you’re a streamer or content creator you’re going to need a separate software solution for noise cancellation in the likes of OBS. This isn’t the end of the world, but almost every gaming model from major brands at this price comes with its own noise-cancellation features out of the box.
The side tone features perform well when the microphone is connected to either a wired or wireless audio device. There’s no noticeable latency at all over Bluetooth, which is very impressive. I tested the microphone with a few different pairs of wireless headphones (both gaming and more general consumer models) and every model paired easily. As connected headphones can be used as audio output devices, this could double as a way to enable Bluetooth 5.4 audio on your PC if it doesn’t support it.
(Image credit: Future) Should I buy the RIG M2 Streamstar? Buy it if...You want strong specs
The RIG M2 Streamstar has very strong specs on paper, boasting a leading 192kHz sample rate. It also has Bluetooth 5.2 support, with support for the low latency aptX HD codec.
You need a compact mic
The RIG M2 Streamstar is impressively small and could easily be used with a laptop when you’re on the go.
You want a more premium design
There’s no avoiding the fact that this microphone just feels cheap for the price. If you shop around you can easily find models with more premium materials.
You rely on included software
The lack of software is also frustrating and could be problematic if you don’t already have your own solution set up.View Deal
After some other options? These two models give the RIG M2 Streamstar a run for its money.
HyperX DuoCast
The HyperX DuoCast is cheaper than the RIG M2 Streamstar but still sounds good out of the box. It offers one more polar pattern and a pleasing design with RGB lighting that would look great as part of any streamer’s setup.
For more information, check out our full HyperX DuoCast review
JBL Quantum Stream Studio
If you’re willing to pay a little bit more, you can get this high-end option from JBL. It’s got the same high 192 kHz sample rate, plus more pickup patterns and a robust suite of software to experiment with.
For more information, check out our full JBL Quantum Stream Studio review.
(Image credit: Future) How I tested the RIG M2 StreamstarI tested the RIG M2 Streamstar for a week, putting it through its paces in a number of scenarios using my home PC with an RTX 3060, I5-11400F, and 32GB of RAM. This time included a number of work meetings and gaming sessions with friends, in addition to testing its compatibility with popular streaming software OBS. I also evaluated its audio quality with a number of recording tests, most notably recording several samples in Audacity in a variety of different conditions.
Throughout my time with the microphone I compared my experience with my hands-on testing of countless other models ranging all the way from reliable budget options such as the Blue Snowball to more premium alternatives like the Blue Yeti and Steelseries Alias and SteelSeries Alias Pro.
First reviewed March 2025.
Sorry, but The Witcher 4 is probably another two years away, at least according to CD Projekt.
As spotted by PC Gamer, a snippet of information from CD Projekt's latest earnings presentation has clued us in as to when we can expect The Witcher 4 to release. Or rather, that it's probably not going to hit shelves and digital storefronts until 2027 at the very earliest.
"Even though we do not plan to release The Witcher 4 by the end of 2026, we are still driven by this financial goal," says CD Projekt, commenting on its share-based incentive programs.
"We are not going to announce the precise launch date for the game yet," added CD Projekt CFO Piotr Nielubowicz. "All we could share now to give more visibility to investors is that the game will not be launched within the time frame of the first target for the incentive program, which ends December 31, 2026."
We at least know that The Witcher 4 has entered full-scale production. According to the presentation, the upcoming game has 411 staff members working on it as of February 28, 2025.
A remaining 296 developers are working on other projects at CD Projekt, including Orion (the Cyberpunk 2077 sequel), Sirius, Hadar and others.
You might also like...New research suggests seals sense internal oxygen levels to know when to come up for air. Digital version of story that already aired. Skedded for pub Weds. 3/26 at 6 a.m. Reporter: Lambert. Editor: Khan.
(Image credit: University of St. Andrews Sea Mammal Research Unit)
A Guatemalan immigrant without legal status says she took a wrong turn on a highway near the Canadian border and was detained with her two children, who are American citizens. They were held for five days.
(Image credit: Matthew Hatcher)
Just as we think we’re getting one step ahead of cybercriminals, they find a new way to evade our defenses.
The latest method causing trouble for security teams is that of device code phishing, a technique that tricks users into granting access to sensitive accounts without attackers needing to steal a password.
Microsoft recently issued a warning about a particular device code phishing campaign being conducted by Storm-2372, where a supposed Russian-backed threat actor was wreaking havoc by hijacking user sessions through legitimate authentication flows. These attacks are trickier to detect than usual given that they exploit real login pages (rather than the spoofed versions that traditional phishing techniques relied on) and are capable of bypassing multi-factor authentication (MFA).
The recent warning from Microsoft will most likely be the first of many. Various other platforms follow the same style of authentication flows and attackers will most likely replicate the technique elsewhere. It is down to security teams once again to identify the warning signs of this new breed of phishing, and implement the best cybersecurity practices to get ahead of the curve.
Understanding device code phishingUnlike traditional credential phishing attacks, device code phishing is unique in that there is no need to directly steal a password. Instead, attackers manipulate victims into handing over access to their accounts by exploiting authentication methods designed to make logging in easier.
They start the same way as most email attacks do: through social engineering. By impersonating a trusted colleague or IT administrator, the attackers send an email invitation to an online meeting (often a Microsoft Teams meeting) that looks legitimate. The email is designed to appear normal – for instance, it might look like a genuine Teams meeting invite.
When the victim clicks the link in the fake invite, they are prompted to log in using a special code (the “device code”), which is provided by the attacker. And because the website they land on is a real Microsoft login page, the user doesn’t suspect anything phishy.
What makes this technique especially dangerous is that it exploits legitimate authentication systems without creating counterfeit ones. This removes the need for attackers to steal passwords. Instead, they can gain access by capturing session tokens which allow them to operate without triggering additional authentication prompts. And because the tokens are already verified, attackers can often bypass MFA.
At first glance, nothing seems unusual. Suspicion is reduced due to the official Microsoft website, and therefore, victims won’t hesitate to enter a device code to authenticate the session. However, instead of linking their own device, they are unknowingly authorizing the attacker's session. Once access is granted, the attacker has the keys to the kingdom and is free to operate within the victim’s account, access sensitive information, and launch lateral attacks.
How users can recognize and avoid these attacksDevice code phishing has created a minefield where legitimate tools are utilized for malicious purposes. Organizations must be proactive in recognizing these attacks and be sure to have effective authentication security measures in place.
Users should always treat unexpected meeting invites with suspicion, especially if they contain login prompts that require immediate action. Before entering any device code, users should verify the legitimacy of the request through a separate communication channel, such as a direct phone call or an internal messaging platform. If a login request appears out of the blue, it’s always best to avoid proceeding until its authenticity is confirmed.
Device codes are particularly impactful as they are designed to be entered on trusted devices. As a result, users should never share a login code with another person or enter a code they receive via email or chat unless they personally initiated the request. Legitimate services will never email a device code and then ask a user to input it on a separate website. If workforces can get to grips with this fundamental security principle, it can prevent many device code phishing attempts from succeeding.
Organizational steps to mitigate riskProtecting against these attacks can’t rely solely on the user and organizations must take steps to reduce the risk of device code phishing.
One of the most effective measures is to disable any unnecessary device code authentication flows. If it isn’t essential for business operations, then it should be removed to eliminate a significant attack vector. Security teams should regularly review authentication policies and restrict device code logins to only trusted devices.
Conditional access policies go one step further, as they can restrict authentication attempts based on user behavior, device type, geographic location, and risk level. If a login attempt occurs from an unfamiliar location or outside of approved business hours, access can be blocked or require additional verification.
This is why it’s key to embrace behavioral AI measures which can establish baseline “normal” behaviors within an organization's IT environment, and in turn question anything that seems out of the ordinary. Behavioral AI systems analyze characteristics like login patterns to detect anomalies, such as multiple authentication attempts from different locations or unusual device code submissions. By comparing these activities to known-good user behaviors, deviations from the norm can be flagged as suspicious.
And since device code phishing hinges on meeting invites to spread the attack, these should also be monitored. Security teams should regularly audit and flag unusual meeting request patterns, particularly those originating from compromised accounts.
Lastly, security awareness programs should be an ongoing feature of any cybersecurity strategy. Cyber threats evolve constantly, so training should also be continuous. Employees must be trained to recognize the warning signs of device code phishing and understand the risks of entering authentication codes without verification. Creating a culture where security is front of mind when handling unexpected requests is vital.
The time to act is nowAs this latest technique continues to prove effective, cybercriminals will no doubt expand their use of device code phishing. Organizations must act now to defend against this emerging threat. A combination of user awareness and strong security policies which are strengthened by advanced threat detection can help organizations to stay ahead.
The sooner organizations implement these measures, the sooner they can reduce their exposure to device code phishing and protect their employees, data, and systems from this growing cyber threat.
We've listed the best identity management software.
This article was produced as part of TechRadarPro's Expert Insights channel where we feature the best and brightest minds in the technology industry today. The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/news/submit-your-story-to-techradar-pro
StubHub has a "Recommended Tickets" filter that only displays some tickets but not others. It's automatically turned on — and it's upsetting users.
(Image credit: Courtesy of Susan Burke)
A proposal to severely limit guns that use detachable magazines is approaching final passage in the Colorado legislature. The state's Democratic governor, Jared Polis, is expected to sign it into law.
(Image credit: Hyoung Chang)
The partial solar eclipse will be visible in various locations in the U.S. Northeast.
(Image credit: Bill Ingalls/NASA)
The John F. Kennedy Center for the Performing Arts in Washington, D.C., has dissolved its Social Impact division, which partnered with local organizations to bring in diverse artists and audiences.
(Image credit: Kennedy Center)
More than three-quarters of U.S. wells make just 6% of the country's oil. They're called marginal wells because of their small output. But they're a big deal to oil producers and environmentalists.
(Image credit: September Dawn Bottoms for NPR)
Many rural counties are short on dentists, and if they lose water fluoridation, tooth decay could surge to levels that have not been seen in decades, experts warn.
(Image credit: Katie Adkins)