SecurityMicrosoft Threat Intelligence says Storm-2570 is a cross-ecosystem ransomware affiliate using consistent tools and techniques across Qilin, DragonForce, Anubis, and BERT deployments. The report matters because defenders can improve detection and disruption by tracking recurring tradecraft such as RMM abuse, credential theft, tunneling, and cloud exfiltration instead of focusing only on the final ransomware payload.
2 min read · Sep 24, 2026
SecurityMicrosoft’s September 2026 security updates focus on governing AI agents, blocking sensitive data from reaching risky AI apps, and improving SOC investigation workflows. The release also expands Microsoft Purview compliance capabilities and brings more Intune endpoint management features to GCC High and DoD environments.
3 min read · Sep 24, 2026
SecurityMicrosoft has announced the integrated security operations center (ISOC) in Microsoft Defender, now available in preview. ISOC unifies SIEM and threat protection to help security teams and AI agents detect, investigate, and respond faster using a shared security foundation.
3 min read · Sep 23, 2026
SecurityMicrosoft has detailed how the EvilTokens phishing-as-a-service platform industrialized device code phishing to steal tokens and compromise more than 12,000 inboxes across 10,000 organizations. The report matters for security teams because it includes mitigation guidance, Defender XDR detections, and hunting recommendations to reduce risk from token theft and post-compromise persistence.
3 min read · Sep 22, 2026
SecurityMicrosoft shared new email security benchmarking results showing Defender missed fewer high-severity threats than competing secure email gateway vendors from May through July 2026. The update also highlights stronger post-delivery remediation, AI-driven detection improvements, and new protections that matter as phishing and impersonation attacks become more convincing.
3 min read · Sep 17, 2026
SecurityMicrosoft is urging organizations to move from broad security guidance to concrete exposure-reduction actions as AI accelerates cyberattacks across identities, endpoints, apps, and networks. Through Secure Now in Microsoft Security Exposure Management, security teams can prioritize foundational controls that reduce risk from autonomous attacks, phishing, lateral movement, and weak authentication paths.
3 min read · Sep 17, 2026
SecurityMicrosoft Security Research detailed a large-scale fraud campaign that used AI-assisted email templates, executive impersonation, and fake invoices to pressure accounts payable teams into sending ACH payments. The campaign highlights how generative AI is making business email compromise-style attacks more convincing, increasing the need for stronger email defenses, user awareness, and payment verification controls.
3 min read · Sep 10, 2026
SecurityMicrosoft is warning that attackers are increasingly using trusted AI brands like ChatGPT, Copilot, Claude, and DeepSeek in phishing, malvertising, and malware campaigns. The company says Microsoft Defender can help security teams detect, correlate, and disrupt these multi-stage attacks across email, identities, endpoints, and SaaS apps.
3 min read · Sep 10, 2026
SecurityMicrosoft has introduced a new cloud web applications threat matrix aligned to MITRE ATT&CK to help defenders map, prioritize, and investigate threats across cloud-hosted web apps and serverless platforms. The framework matters because modern attack paths often span application code, identities, deployment pipelines, managed runtimes, and connected cloud resources, making siloed investigations incomplete.
3 min read · Sep 9, 2026
SecurityMicrosoft Security Research is tracking active attacks that use passkey, MFA, and SSO-themed social engineering to compromise cloud identities and access Microsoft 365 data. The campaigns rely on AiTM phishing, device code abuse, and unauthorized authentication method changes, making rapid detection and response critical for security teams.
3 min read · Sep 9, 2026
SecurityMicrosoft outlines how organizations can secure Edge AI deployments running in customer-owned environments, where models, data, credentials, and system authority move outside the provider’s cloud. The guidance focuses on runtime attestation, artifact provenance, and deterministic mediation to reduce risks such as prompt injection, model tampering, and compromised local infrastructure.
3 min read · Sep 4, 2026
SecurityMicrosoft researchers observed a high-volume phishing campaign using invisible Unicode tag characters, known as ASCII smuggling, to evade email filters in finance-themed lures. The technique, previously associated with AI prompt injection, shows how AI-era evasion methods are now crossing into traditional phishing, making layered email security and hunting more important for defenders.
3 min read · Sep 3, 2026