1609 matches found
TerminalFix campaign deploys a reverse tunnel through multistage intrusion
In this article 1. Attack chain overview 2. Mitigation and protection guidance 3. Learn more Microsoft Threat Intelligence has observed a TerminalFix campaign, a variant of ClickFix, targeting organizations across multiple industries. The campaign uses compromised websites to display a fake...
What’s new in Microsoft Security: August 2026
As organizations incorporate AI agents into more processes across business and operations, security teams can benefit from greater visibility and new purpose-built tools that help manage, secure, and govern AI. This month’s updates provide new capabilities to help organizations gain insights into...
When AI infrastructure becomes the target: Securing gateways and control points
In this article 1. AI workloads are becoming high-value control points 2. Case study 1: LiteLLM gateway compromise 3. Case study 2: RAGFlow compromise 4. Case study 3: Kestra compromise 5. Mitigation and protection guidance 6. MITRE ATT&CK techniques observed 7. References 8. Learn more AI is...
When AI infrastructure becomes the target: Securing gateways and control points
In this article 1. AI workloads are becoming high-value control points 2. Case study 1: LiteLLM gateway compromise 3. Case study 2: RAGFlow compromise 4. Case study 3: Kestra compromise 5. Mitigation and protection guidance 6. MITRE ATT&CK techniques observed 7. References 8. Learn more AI is...
The patch window is collapsing: Why security needs a new control plane
For decades, cybersecurity defenders have relied on a relatively straightforward model: a vulnerability is disclosed, security teams assess exposure, test available fixes, deploy patches into production, and ultimately close the risk before attackers can exploit it at scale. That model increasing...
Microsoft named a Leader in the Frost Radar™: Cloud Workload Protection Platforms, 2026
Security teams are overwhelmed with findings but still struggle to answer a simple question: which risks matter right now? A vulnerability alone is rarely the problem. The same vulnerability running in production, exposed through a misconfiguration or over-permissioned identity, is a real path to...
Microsoft named a Leader in the Frost Radar™: Cloud Workload Protection Platforms, 2026
Security teams are overwhelmed with findings but still struggle to answer a simple question: which risks matter right now? A vulnerability alone is rarely the problem. The same vulnerability running in production, exposed through a misconfiguration or over-permissioned identity, is a real path to...
Hunting MacSync Stealer infrastructure through behavioral pivots
In this article 1. Activity overview 2. Discovery of additional rotating infrastructure 3. Attack chain overview 4. Mitigation and protection guidance 5. References 6. Learn more MacSync Stealer is a macOS-focused information stealer that relies on changing infrastructure to deliver payloads,...
Hunting MacSync Stealer infrastructure through behavioral pivots
In this article 1. Activity overview 2. Discovery of additional rotating infrastructure 3. Attack chain overview 4. Mitigation and protection guidance 5. References 6. Learn more MacSync Stealer is a macOS-focused information stealer that relies on changing infrastructure to deliver payloads,...
Microsoft named a Leader in the 2026 IDC MarketScape for MDR/MXDR for the Enterprise
Security teams are being asked to defend a growing attack surface with fewer people and around the clock, against threat actors who never take a night off. As cyberattackers increasingly use AI to launch and scale campaigns, the volume, speed, and sophistication of threats continue to rise. Closi...
Microsoft named a Leader in the 2026 IDC MarketScape for MDR/MXDR for the Enterprise
Security teams are being asked to defend a growing attack surface with fewer people and around the clock, against threat actors who never take a night off. As cyberattackers increasingly use AI to launch and scale campaigns, the volume, speed, and sophistication of threats continue to rise. Closi...
DeadLock ransomware: Breaking down a Rust-based encryptor with decentralized recovery infrastructure
In this article 1. Pre-encryption 2. Encryption 3. Post-encryption 4. Defending against DeadLock ransomware 5. Indicators of compromise Microsoft Threat Intelligence tracks DeadLock ransomware as an emerging financially motivated operation distinguished by its use of decentralized infrastructure ...
DeadLock ransomware: Breaking down a Rust-based encryptor with decentralized recovery infrastructure
In this article 1. Pre-encryption 2. Encryption 3. Post-encryption 4. Defending against DeadLock ransomware 5. Indicators of compromise Microsoft Threat Intelligence tracks DeadLock ransomware as an emerging financially motivated operation distinguished by its use of decentralized infrastructure ...
Microsoft named a Leader in the KuppingerCole Leadership Compass for Cloud Native Application Protection Platforms (CNAPP)
As organizations adopt AI, they must secure both cloud and AI environments through a unified security control plane as their attack surface expands. Because modern applications and AI workloads are built and run in the cloud, security teams must understand which exposures matter most, prioritize...
Microsoft named a Leader in the KuppingerCole Leadership Compass for Cloud Native Application Protection Platforms (CNAPP)
As organizations adopt AI, they must secure both cloud and AI environments through a unified security control plane as their attack surface expands. Because modern applications and AI workloads are built and run in the cloud, security teams must understand which exposures matter most, prioritize...
From open lures to cloaked gates: How a macOS ClickFix campaign learned to hide
In this article 1. Activity overview 2. How ClickFix works 3. Campaign overview 4. ClickFix moved from open pages to fingerprinting gates 5. The fingerprinting gate 6. Mitigation and protection guidance 7. Indicators of compromise IOC 8. References 9. Learn more Microsoft Threat Intelligence...
From open lures to cloaked gates: How a macOS ClickFix campaign learned to hide
In this article 1. Activity overview 2. How ClickFix works 3. Campaign overview 4. ClickFix moved from open pages to fingerprinting gates 5. The fingerprinting gate 6. Mitigation and protection guidance 7. Indicators of compromise IOC 8. References 9. Learn more Microsoft Threat Intelligence...
ChainDrop supply chain compromise: Anatomy of a self-propagating worm
In this article 1. Attack chain overview 2. Mitigation and protection guidance 3. Indicators of compromise IOC 4. Microsoft Defender XDR detections 5. Advanced hunting queries 6. Learn more Microsoft Threat Intelligence identified a large-scale npm supply chain attack affecting more than 400...
ChainDrop supply chain compromise: Anatomy of a self-propagating worm
In this article 1. Attack chain overview 2. Mitigation and protection guidance 3. Indicators of compromise IOC 4. Microsoft Defender XDR detections 5. Advanced hunting queries 6. Learn more Microsoft Threat Intelligence identified a large-scale npm supply chain attack affecting more than 400...
Advance Zero Trust for AI: New tools and guidance to secure AI agents and DevSecOps
The calculus of cybersecurity has changed. AI is reshaping how organizations build, deploy, operate, and defend digital systems. AI-powered development tools, agents, and autonomous workflows are accelerating innovation but they are also introducing new attack surfaces, new trust boundaries, and...
Advance Zero Trust for AI: New tools and guidance to secure AI agents and DevSecOps
The calculus of cybersecurity has changed. AI is reshaping how organizations build, deploy, operate, and defend digital systems. AI-powered development tools, agents, and autonomous workflows are accelerating innovation but they are also introducing new attack surfaces, new trust boundaries, and...
128 Seconds to disruption: Microsoft Defender stops ransomware at QNET
In this article 1. What is device isolation? 2. Case study: QNET 3. Attack chain overview 4. MITRE ATT&CK techniques observed 5. References 6. Learn more Microsoft Defender's attack disruption now includes device isolation, a new response action that extends autonomous protection directly to...
128 Seconds to disruption: Microsoft Defender stops ransomware at QNET
In this article 1. What is device isolation? 2. Case study: QNET 3. Attack chain overview 4. MITRE ATT&CK techniques observed 5. References 6. Learn more Microsoft Defender's attack disruption now includes device isolation, a new response action that extends autonomous protection directly to...
CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft
In this article 1. The CaptiveCrunch campaign 2. Storm-2945 and Midnight Blizzard 3. CaptiveCrunch tradecraft and tooling 4. How to protect against CaptiveCrunch activity 5. Microsoft Defender detections and hunting guidance 6. Indicators of compromise Since early May 2026, Microsoft Threat...
CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft
In this article 1. The CaptiveCrunch campaign 2. Storm-2945 and Midnight Blizzard 3. CaptiveCrunch tradecraft and tooling 4. How to protect against CaptiveCrunch activity 5. Microsoft Defender detections and hunting guidance 6. Indicators of compromise Since early May 2026, Microsoft Threat...
What’s new in Microsoft Security: July 2026
Every organization needs security that protects end to end with the speed and scale of AI. Microsoft’s vision is simple: security should be ambient and autonomous, just like the AI it protects. As organizations scale AI and expand across environments, security teams need protection that covers...
What’s new in Microsoft Security: July 2026
Every organization needs security that protects end to end with the speed and scale of AI. Microsoft’s vision is simple: security should be ambient and autonomous, just like the AI it protects. As organizations scale AI and expand across environments, security teams need protection that covers...
Better security starts with better questions
As organizations move beyond AI experimentation, success will depend on how effectively they combine intelligence and trust. The same systems that amplify knowledge, accelerate decisions, and unlock new outcomes must also protect data, govern AI, and build resilience. In this next phase of...
Rethinking security for the age of AI
Why security needs a new Cyber Stack — Introducing Project Perception The physics of cybersecurity are changing. Autonomous systems can now reason, adapt and operate continuously. At the same time, the cost of offense is falling, while the volume, velocity and complexity of what must be secured...
Rethinking security for the age of AI
Why security needs a new Cyber Stack — Introducing Project Perception The physics of cybersecurity are changing. Autonomous systems can now reason, adapt and operate continuously. At the same time, the cost of offense is falling, while the volume, velocity and complexity of what must be secured...
Enhancing AI security through global AI red teaming
In this article 1. Building a global alliance 2. What the research focuses on 3. Why this matters Most AI safety testing still happens inside the walls of individual organizations. That has resulted in a fundamental disconnect: many of the highest-risk failure modes in modern AI systems require...
Enhancing AI security through global AI red teaming
In this article 1. Building a global alliance 2. What the research focuses on 3. Why this matters Most AI safety testing still happens inside the walls of individual organizations. That has resulted in a fundamental disconnect: many of the highest-risk failure modes in modern AI systems require...
Email threat landscape: Q2 2026 trends and insights
In this article 1. Tycoon2FA Q2 disruption impact 2. QR code phishing attacks 3. CAPTCHA-gated phishing tactics 4. Malicious payloads 5. Business email compromise 6. Microsoft Teams threats 7. Notable phishing campaigns 8. Mitigation and protection guidance 9. Indicators of compromise IOCs The...
Email threat landscape: Q2 2026 trends and insights
In this article 1. Tycoon2FA Q2 disruption impact 2. QR code phishing attacks 3. CAPTCHA-gated phishing tactics 4. Malicious payloads 5. Business email compromise 6. Microsoft Teams threats 7. Notable phishing campaigns 8. Mitigation and protection guidance 9. Indicators of compromise IOCs The...
Real world incident response: Microsoft and AXA XL strengthen cyber resilience
Cyber incidents don't wait—and effective response can’t either. In the age of AI where cyber incidents unfold at machine speed, having the right partnerships in place becomes paramount. While AI is expanding what's possible, navigating this transformation can be challenging to do alone. That's wh...
Real world incident response: Microsoft and AXA XL strengthen cyber resilience
Cyber incidents don't wait—and effective response can’t either. In the age of AI where cyber incidents unfold at machine speed, having the right partnerships in place becomes paramount. While AI is expanding what's possible, navigating this transformation can be challenging to do alone. That's wh...
Microsoft at Black Hat USA 2026: Defending trust in the age of AI and supply chain attacks
In this article 1. Weston on the future of defense 2. Our latest intelligence and response on npm supply chain attacks 3. Follow the research in the Black Hat Briefings 4. Go deeper in Microsoft sessions 5. Visit booth 2144 for research, community, and hands-on defense 6. Plan your week with...
ACR Stealer: Two observed intrusion chains amid increased threat activity
In this article 1. Campaign 1: WebDAV-based ClickFix with Python loaders and blockchain C2 2. Campaign 2: MSHTA-initiated PowerShell chain with steganographic payload delivery 3. Mitigation and protection guidance 4. References 5. Learn more From late April 2026 to mid-June 2026, Microsoft Defend...
ACR Stealer: Two observed intrusion chains amid increased threat activity
In this article 1. Campaign 1: WebDAV-based ClickFix with Python loaders and blockchain C2 2. Campaign 2: MSHTA-initiated PowerShell chain with steganographic payload delivery 3. Mitigation and protection guidance 4. References 5. Learn more From late April 2026 to mid-June 2026, Microsoft Defend...
Least privilege for AI agents: Identity, access, and tool binding
In this article 1. Real-world scenarios 2. Best Practices: Identity + RBAC + Scope + Safe Tool Binding 3. Looking Ahead AI agents aren't only smarter API callers. They plan, chain actions across systems, and invoke tools in sequences while no single human explicitly approves each step. The...
Least privilege for AI agents: Identity, access, and tool binding
In this article 1. Real-world scenarios 2. Best Practices: Identity + RBAC + Scope + Safe Tool Binding 3. Looking Ahead AI agents aren't only smarter API callers. They plan, chain actions across systems, and invoke tools in sequences while no single human explicitly approves each step. The...
Unpacking the AsyncAPI npm supply chain compromise and import-time payload delivery
In this article 1. Attack chain overview 2. How the attack started: GitHub Actions pwn request 3. Mitigation and protection guidance 4. Learn more On July 14, 2026, Microsoft Threat Intelligence identified a coordinated supply chain compromise of the @asyncapi npm organization, a widely used set ...
Unpacking the AsyncAPI npm supply chain compromise and import-time payload delivery
In this article 1. Attack chain overview 2. How the attack started: GitHub Actions pwn request 3. Mitigation and protection guidance 4. Learn more On July 14, 2026, Microsoft Threat Intelligence identified a coordinated supply chain compromise of the @asyncapi npm organization, a widely used set ...
Turning threat intelligence into decisive action with Defender Experts
In this article 1. Upstream: See the campaign before it reaches you 1. In your environment: Follow the threat everywhere it moves 2. See it live at Black Hat USA Security teams have never had more visibility, yet rarely have they felt more uncertain. Signal pours in from endpoints, identities,...
Turning threat intelligence into decisive action with Defender Experts
In this article 1. Upstream: See the campaign before it reaches you 1. In your environment: Follow the threat everywhere it moves 2. See it live at Black Hat USA Security teams have never had more visibility, yet rarely have they felt more uncertain. Signal pours in from endpoints, identities,...
Defending SaaS-based applications against ShinyHunters OAuth abuse
In this article 1. Attack chain overview 2. Improving visibility into Salesforce OAuth abuse 3. Mitigation and protection guidance 4. Learn more In a series of campaigns observed between mid-2025 and mid-2026, Microsoft identified threat actor activity with overlapping tradecraft commonly...
Defending SaaS-based applications against ShinyHunters OAuth abuse
In this article 1. Attack chain overview 2. Improving visibility into Salesforce OAuth abuse 3. Mitigation and protection guidance 4. Learn more In a series of campaigns observed between mid-2025 and mid-2026, Microsoft identified threat actor activity with overlapping tradecraft commonly...
Microsoft Entra ID security updates: Passkeys are the default authentication method in Entra ID
As identity attacks grow more sophisticated in the AI era, organizations need stronger authentication methods that protect users from phishing, credential theft, and social engineering. To address these evolving threats, Microsoft Entra ID is updating its authentication experience by making...
Securing our future: July 2026 progress report on Microsoft’s Secure Future Initiative
Security is never finished. That conviction is where the Secure Future Initiative SFI started two years ago and continues to guide us today. AI is reshaping cybersecurity. Cyberattackers can discover vulnerabilities, chain attack paths, and scale exploitation faster than manual approaches allow...
GigaWiper: Anatomy of a destructive backdoor assembled from multiple malware
In this article 1. A wiper inside a backdoor 2. Backdoor capabilities 3. How GigaWiper was assembled 4. Conclusion: Multiple destructive capabilities consolidated into a single implant 5. Defending against destructive threats 6. Microsoft Defender detections 7. Indicators of compromise In October...