1667 matches found
Fake-download campaign uses trojanized installers to deliver monetization payloads
In this article 1. Attack chain overview 2. Mitigation and protection guidance 3. Learn More Microsoft Threat Intelligence has identified an evolving fake-download campaign targeting users searching for cracked commercial software, free games, activators, plugins, and unofficial utilities. The...
Microsoft named a Leader in the 2026 Gartner® Magic Quadrant™ for AI Agent Management Platforms
Microsoft has been named a Leader in the inaugural 2026 Gartner® Magic Quadrant™ for AI Agent Management Platforms. We believe this recognition reflects Microsoft’s approach to helping organizations manage, secure, and scale their AI investments through Microsoft Agent 365. Figure 1: Gartner, Mag...
What exploited vulnerabilities have in common: A data-driven analysis of real-world attacks
In this article 1. Classifying the vulnerability landscape 2. Vulnerabilities exploited in the wild 3. Where defenders should focus 1. Patching is slow, while exploitation is fast 2. Impact, exposure and where to focus 3. Next in line 4. How Microsoft Security helps defenders act 5. References 6...
Inside a malicious Claude Code-branded extension and its persistent SSH backdoor
In this article 1. Attack chain overview 1. Attack chain 2. Host reconnaissance collection 3. SSH authorization and tunnel identities 4. Protocol Tunneling T1572: reverse SSH forwarding 5. Platform-specific startup persistence 2. Mitigation and protection guidance 1. Immediate actions 2...
From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths
In this article 1. Activity overview 2. Attack chain overview 3. Portable runtime staging and execution variants 4. Host discovery and AD CS assessment 5. Case 1: ESC1 abuse and the cost of an identity exclusion 6. Case 2: PetitPotam and ESC8 turn a workstation into a domain-controller identity 7...
IDC MarketScape names Microsoft a Leader in the 2026 Worldwide Modern Endpoint Security for Enterprises Vendor Assessment
Today, we're proud to share thatMicrosoft has been named a Leader in the 2026 IDC MarketScape for Worldwide Modern Endpoint Security for Enterprises Doc US54123526, September 2026. The IDC Marketscape calls out three strengths that we believe matter most in endpoint security today: Autonomous...
Tracking AI adoption in North Korean threat actor tradecraft
In this article 1. Stages of AI adoption by North Korean threat actors 2. AI use across North Korean threat operations 1. AI-assisted targeting and reconnaissance 2. AI-assisted social engineering and identity deception 3. AI-assisted software and tooling development 4. AI-assisted operational...
The CISO’s evolving role: Protecting and defending in the agentic era
October is Cybersecurity Awareness Month, and it's a good time to think about how much the world has changed for chief information security officers CISOs in the last 12 months. A year ago, we thought we were already in the thick of AI and starting to understand it. Since then, agents have spread...
Inside the LiteLLM 1.107.0 supply chain compromise: Credential theft through Python startup hooks
In this article 1. Attack overview 2. Technical details 3. Mitigation and protection guidance 4. Indicators of compromise 5. References 6. Learn More On October 21, 2026, a compromised LiteLLM 1.107.0 release was published to the Python Package Index PyPI and distributed through official containe...
AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise
In this article 1. What’s happening 2. What is ARTEX? 3. Mitigation and protection guidance 4. References 5. Learn more As early as September 2026, Storm-0940, a China-state aligned actor, used the agentic AI penetration testing framework ARTEX to automate attacks targeting hundreds of...
Agents are your newest insiders. Security must move at their speed.
Agents are rapidly becoming part of how work gets done. They can support a range of activities from writing code and researching products to analyzing revenue, processing expenses, and acting across the systems that run the business. To be most useful, they often need access to company data,...
Managing open-weight model risk in enterprise deployments
The growing AI landscape is giving enterprises more choice in how they build, customize, and deploy increasingly capable models. Open-weight models are an important part of that landscape. They give enterprises access to model weights and greater flexibility to inspect, evaluate, modify, and run...
The hidden network: Inside the phishing infrastructure ecosystem powering global cybercrime
In this article 1. Uncovering the shadow world of a phishing kit ecosystem 2. Storm-3119: YAM Store, the power broker 3. Storm-2990: The Iron Man System phishing kit 4. Downstream activity from Storm-2990 phishing kits 5. Mitigation and protection guidance 6. Microsoft Defender detections 7...
Post-quantum authentication: Why organizations should start testing certificate ecosystems now
In this article 1. Why post-quantum authentication presents a different challenge 2. Why organizations should begin preparing now 3. Microsoft's perspective on readiness 4. Testing the future certificate ecosystem 5. Expanding end-to-end testing 6. What organizations can do today 7. Looking ahead...
3 lessons from frontier AI vulnerability research
In this article 1. Shift 1. From frontier capability to scale 2. Shift 2. From token consumption to reasoning economics 3. Shift 3. Validation and remediation as a continuous learning loop 4. Transferring security research to help open source projects 5. Open-source vulnerability reporting snapsh...
CISO perspectives on managing vulnerability risks in the age of AI
Most of what has been written about AI and vulnerability management focuses on speed: how much faster frontier AI models can scan code, find weaknesses, design patches, and build exploits than any human team. That part is true, and it matters to how we remediate vulnerabilities. The more...
CISO perspectives on managing vulnerability risks in the age of AI
Most of what has been written about AI and vulnerability management focuses on speed: how much faster frontier AI models can scan code, find weaknesses, design patches, and build exploits than any human team. That part is true, and it matters to how we remediate vulnerabilities. The more...
Preparing governments for an era of interconnected cyber risk
According to this year’s Microsoft Digital Defense Report, government agencies and services were the sector most impacted by cyber threats in 2026, accounting for 27% of observed activity, up from 17% in 2025. Governments are also the most frequently targeted sectors for nation-state activity. Th...
Preparing governments for an era of interconnected cyber risk
According to this year’s Microsoft Digital Defense Report, government agencies and services were the sector most impacted by cyber threats in 2026, accounting for 27% of observed activity, up from 17% in 2025. Governments are also the most frequently targeted sectors for nation-state activity. Th...
Insights from the 2026 Microsoft Digital Defense Report
Every year, the Microsoft Digital Defense Report gives us an opportunity to step back from individual threats and look broadly at what Microsoft’s security and threat intelligence teams are seeing. Today, we released the 2026 Report, which reflects a security environment that continues to grow mo...
Insights from the 2026 Microsoft Digital Defense Report
Every year, the Microsoft Digital Defense Report gives us an opportunity to step back from individual threats and look broadly at what Microsoft’s security and threat intelligence teams are seeing. Today, we released the 2026 Report, which reflects a security environment that continues to grow mo...
Secure what’s next: Your guide to Microsoft Security at Microsoft Ignite 2026
In this article 1. Why you should attend Microsoft Ignite 2. Make the most of your time at Microsoft Ignite 3. Explore the Security sessions at Microsoft Ignite 2026 4. Build your schedule In the agentic era, the stakes are higher: AI agents now act with real access to your identities, your data,...
Unauthenticated command injection on internet-facing mail servers: tracking CVE-2026-73570
In this article 1. Attack chain overview 2. Mitigation and protection guidance 3. References 4. Learn More Microsoft Threat Intelligence identified and tracked exploitation of CVE-2026-73570 , an unauthenticated OS command injection vulnerability in the Zimbra Collaboration Suite SNMP notificatio...
Unauthenticated command injection on internet-facing mail servers: tracking CVE-2026-73570
In this article 1. Attack chain overview 2. Mitigation and protection guidance 3. References 4. Learn More Microsoft Threat Intelligence identified and tracked exploitation of CVE-2026-73570 , an unauthenticated OS command injection vulnerability in the Zimbra Collaboration Suite SNMP notificatio...
Phishing Abuses RMM Tools for Persistent Access
In this article 1. Attack chain overview 2. Mitigation and protection guidance 3. Learn More In July 2026, Microsoft Defender Experts observed phishing campaigns targeting organizations across multiple industries that distributed a masqueraded MSP360 Remote Monitoring and Management RMM installer...
Phishing Abuses RMM Tools for Persistent Access
In this article 1. Attack chain overview 2. Mitigation and protection guidance 3. Learn More In July 2026, Microsoft Defender Experts observed phishing campaigns targeting organizations across multiple industries that distributed a masqueraded MSP360 Remote Monitoring and Management RMM installer...
Beyond source code: A path to the keys to the kingdom
What began as a single compromised identity quickly expanded into an organization's development and cloud environments. In our latest Cyberattack Series report, we examine how the Microsoft Detection and Response Team DART—the team that delivers Microsoft Defender Experts Cybersecurity Incident...
Star Blizzard refines phishing and malware delivery with the RedFlick technique
In this article 1. Star Blizzard TTPs observed in 2026 2. Defending against Star Blizzard and RedFlick-related activity 3. Microsoft Defender detections 4. Hunting queries 5. Indicators of compromise Since January 2026, Microsoft has observed Russian state threat actor Star Blizzard evolve their...
Star Blizzard refines phishing and malware delivery with the RedFlick technique
In this article 1. Star Blizzard TTPs observed in 2026 2. Defending against Star Blizzard and RedFlick-related activity 3. Microsoft Defender detections 4. Hunting queries 5. Indicators of compromise Since January 2026, Microsoft has observed Russian state threat actor Star Blizzard evolve their...
NeedyMantis: Unpacking a post-compromise malware family used in targeted operations
In this article 1. Observed operators and targeting 2. Malware packaging and distribution 3. NeedyMantis architecture and capabilities 4. Mitigation and protection guidance 5. Hunting queries 6. Indicators of compromise Microsoft Threat Intelligence has identified NeedyMantis, a modular...
Storm-3168: Agentic-driven cloud attacks using compromised service principals
In this article 1. Attack overview 2. Technical analysis 3. Mitigation and protection guidance 4. References 5. Learn More Microsoft Security Research has identified malicious cloud activity associated with JADEPUFFER, a threat actor discovered by Sysdig in July 2026 and reported to be the first...
Storm-3168: Agentic-driven cloud attacks using compromised service principals
In this article 1. Attack overview 2. Technical analysis 3. Mitigation and protection guidance 4. References 5. Learn More Microsoft Security Research has identified malicious cloud activity associated with JADEPUFFER, a threat actor discovered by Sysdig in July 2026 and reported to be the first...
What’s new in Microsoft Security: September 2026
AI agents are now running on employee devices, cloud platforms, and across developer workflows. Security teams need to see those agents, govern what they can reach, and contain them when something goes wrong. This month's updates help you discover and control local AI agents, extend Zero Trust to...
Beyond the ransomware: Tracking Storm-2570’s consistent tradecraft across deployments
In this article 1. Who is Storm-2570? 2. Storm-2570 attack chain: From initial foothold to impact 3. What Storm-2570 activity means for defenders 4. Mitigation and protection guidance 5. Microsoft Defender detections 6. Hunting queries Activity associated with Storm-2570, a ransomware affiliate...
Beyond the ransomware: Tracking Storm-2570’s consistent tradecraft across deployments
In this article 1. Who is Storm-2570? 2. Storm-2570 attack chain: From initial foothold to impact 3. What Storm-2570 activity means for defenders 4. Mitigation and protection guidance 5. Microsoft Defender detections 6. Hunting queries Activity associated with Storm-2570, a ransomware affiliate...
Reimagining the SOC for the agentic era in Microsoft Defender
The physics of cybersecurity are changing. So must the security operations center SOC. Cyberattackers are using agents to automate execution at unprecedented scale. What once required entire teams now requires a single operator and an agent framework. That shift has exposed a hard truth: security...
Unmasking EvilTokens: Getting to the root of device code phishing
In this article 1. What is device code phishing? 2. EvilTokens platform and operations 3. EvilTokens phishing emails 4. Mitigation and protection guidance 5. Microsoft Defender XDR detections 6. Hunting queries Following its emergence in February 2026, EvilTokens quickly became one of the most...
Unmasking EvilTokens: Getting to the root of device code phishing
In this article 1. What is device code phishing? 2. EvilTokens platform and operations 3. EvilTokens phishing emails 4. Mitigation and protection guidance 5. Microsoft Defender XDR detections 6. Hunting queries Following its emergence in February 2026, EvilTokens quickly became one of the most...
From guidance to action: Security fundamentals that materially reduce risk
AI has already made fundamental changes to the operating environment for cybersecurity. Cyberattackers are testing more paths, adapting their techniques, and moving across digital environments with greater speed and persistence. The weaknesses they exploit remain familiar: excessive permissions,...
Improving email security outcomes with real-world Microsoft Defender insights
Every benchmark tells a story. The most valuable ones tell us where to improve next. For five consecutive quarters Microsoft has published email security benchmarking reports to provide greater transparency into real-world protection outcomes. The results have shown strong Microsoft Defender...
Protecting organizations from AI-assisted executive impersonation and invoice fraud
In this article 1. Attack chain overview 1. Email Delivery 2. Domain registration 3. Generative AI usage 2. Mitigation and protection guidance 1. Microsoft Defender detections 2. Microsoft Security Copilot 3. Threat intelligence reports 4. MITRE ATT&CK Techniques observed 5. Indicators of...
Protecting organizations from AI-assisted executive impersonation and invoice fraud
In this article 1. Attack chain overview 1. Email Delivery 2. Domain registration 3. Generative AI usage 2. Mitigation and protection guidance 1. Microsoft Defender detections 2. Microsoft Security Copilot 3. Threat intelligence reports 4. MITRE ATT&CK Techniques observed 5. Indicators of...
Detect and disrupt AI-themed attacks with Microsoft Defender
Every wave of technology excitement creates a new opportunity for cyberattackers, and AI is no exception. Microsoft Threat Intelligence has published research showing a growing set of campaigns that impersonate popular AI platforms and tools, including ChatGPT, Microsoft Copilot, DeepSeek, and...
Threat matrix: Mapping threats across cloud web applications
In this article 1. Overview 2. Technique Catalog 3. Privilege Escalation 4. Mitigation and protection guidance 5. References 6. Learn more Microsoft introduces the cloud web applications threat matrix, a MITRE ATT &CK-aligned framework that helps defenders understand, prioritize, and mitigate...
Passkey-themed social engineering leads to identity and cloud compromise
In this article 1. Attack chain overview 2. Attribution 3. Mitigation and protection guidance 4. Learn more Microsoft Security Research is tracking active cloud-based intrusions spanning multiple accounts in which unusual sign-ins were followed by threat actor-added authentication methods,...
Passkey-themed social engineering leads to identity and cloud compromise
In this article 1. Attack chain overview 2. Attribution 3. Mitigation and protection guidance 4. Learn more Microsoft Security Research is tracking active cloud-based intrusions spanning multiple accounts in which unusual sign-ins were followed by threat actor-added authentication methods,...
How to secure edge AI in customer-owned environments
In this article 1. Edge AI changes the trust model for AI systems 2. Constrain model actions through deterministic mediation 3. Establish trust before releasing sensitive assets 4. Verify runtime before releasing sensitive assets 5. Verify artifacts that shape model behavior 6. Next steps Edge AI...
How to secure edge AI in customer-owned environments
In this article 1. Edge AI changes the trust model for AI systems 2. Constrain model actions through deterministic mediation 3. Establish trust before releasing sensitive assets 4. Verify runtime before releasing sensitive assets 5. Verify artifacts that shape model behavior 6. Next steps Edge AI...
ASCII smuggling crosses over from AI prompt injection to phishing evasion
In this article 1. What is ASCII smuggling? 2. Writing a practical ASCII-smuggling signature 3. What we observed: ASCII smuggling repurposed for phishing 4. What is known and what is new 5. Is there a detection gap? 6. Mitigation and protection guidance 7. References 8. Learn More Microsoft...
ASCII smuggling crosses over from AI prompt injection to phishing evasion
In this article 1. What is ASCII smuggling? 2. Writing a practical ASCII-smuggling signature 3. What we observed: ASCII smuggling repurposed for phishing 4. What is known and what is new 5. Is there a detection gap? 6. Mitigation and protection guidance 7. References 8. Learn More Microsoft...