Latest news and updates about Security.
Microsoft detailed how Defender’s predictive shielding can contain Active Directory domain compromise by restricting exposed high-privilege accounts before attackers can reuse stolen credentials. The capability helps security teams reduce lateral movement and close the response gap during fast-moving identity attacks.
Microsoft Threat Intelligence detailed a macOS-focused campaign by Sapphire Sleet that uses social engineering and fake software updates instead of exploiting vulnerabilities. The attack chain relies on user-initiated AppleScript and Terminal execution to bypass native macOS protections, making layered defenses, user awareness, and endpoint detection especially important.
Microsoft is urging organizations to treat cryptographic inventory as the first practical step toward post-quantum readiness. The company outlines a continuous cryptography posture management lifecycle to help security teams discover, assess, prioritize, and remediate cryptographic risks across code, networks, runtime, and storage.
Microsoft says traditional incident response principles still apply to AI systems, but teams must adapt to non-deterministic behavior, faster harm at scale, and new categories of risk. The company highlights the need for better AI telemetry, cross-functional response plans, and staged remediation to contain issues quickly while longer-term fixes are developed.
Microsoft is outlining an "agentic SOC" model that combines autonomous threat disruption with AI agents to accelerate investigations and reduce alert fatigue. The approach aims to shift security operations from reactive incident response to faster, more adaptive defense, giving SOC teams more time for strategic risk reduction and governance.
Microsoft has detailed a financially motivated Storm-2755 campaign targeting Canadian employees with payroll diversion attacks. The threat actor used SEO poisoning, malvertising, and adversary-in-the-middle techniques to steal sessions, bypass legacy MFA, and alter direct deposit details, making phishing-resistant MFA and session monitoring critical defenses.
Microsoft disclosed a severe intent redirection flaw in the third-party EngageSDK for Android, putting millions of crypto wallet users at potential risk of data exposure and privilege escalation. The issue was fixed in EngageSDK version 5.2.1, and the case highlights the growing security risk of opaque mobile app supply-chain dependencies.
Microsoft Threat Intelligence says Forest Blizzard has been compromising vulnerable home and small-office routers to hijack DNS traffic and, in some cases, enable adversary-in-the-middle attacks against targeted connections. The campaign matters to IT teams because unmanaged SOHO devices used by remote and hybrid workers can expose cloud access and sensitive data even when corporate environments remain secure.
Microsoft Threat Intelligence warns that Storm-1175 is rapidly exploiting vulnerable internet-facing systems to deploy Medusa ransomware, sometimes within 24 hours of initial access. The group’s focus on newly disclosed flaws, web shells, RMM tools, and fast lateral movement makes patch speed, exposure management, and post-compromise detection critical for defenders.
Microsoft Defender Security Research detailed a large-scale phishing campaign that abuses the OAuth device code flow using AI-generated lures, dynamic code generation, and automated backend infrastructure. The campaign raises the risk for organizations because it improves attacker success rates, bypasses traditional detection patterns, and enables token theft, inbox rule persistence, and Microsoft Graph reconnaissance.
Microsoft warns that threat actors are now embedding AI across the full cyberattack lifecycle, from reconnaissance and phishing to malware development and post-compromise operations. For defenders, this means faster, more precise attacks, higher phishing success rates, and a growing need to strengthen identity, MFA protections, and visibility into AI-driven attack surfaces.
Microsoft warns that threat actors are using HTTP cookies to control PHP webshells on Linux hosting environments, helping malicious code stay dormant unless specific cookie values are present. The technique reduces visibility in routine logs, supports persistence through cron jobs, and highlights the need for stronger monitoring, web protection, and endpoint detection on hosted Linux workloads.