Latest news and updates about Security.
Microsoft Threat Intelligence has detailed a TerminalFix campaign that tricks users into pasting a fake Cloudflare verification command into Windows Terminal or PowerShell. The attack goes beyond typical ClickFix activity by using DLL sideloading, steganographic payloads, Active Directory reconnaissance, and a reverse tunnel that can give attackers persistent access into internal networks.
Microsoft’s August 2026 security updates add broader managed detection coverage, stronger multi-tenant identity governance, new Intune onboarding and remote support features, and higher-scale Purview auto-labeling. These changes matter because they help IT and security teams secure AI-driven operations, reduce blind spots, and improve protection across Microsoft and third-party environments.
Microsoft Security Research warns that AI gateways, retrieval platforms, and orchestration services are emerging as high-value attack targets. Based on observed compromises involving LiteLLM, RAGFlow, and Kestra, the report highlights how attackers are using these systems to steal secrets, gain persistence, and monetize compute—making stronger controls and monitoring essential for defenders.
Microsoft warns that the time between vulnerability disclosure and active exploitation has shrunk from days or weeks to hours, making traditional patch-first response models increasingly insufficient. The company argues that network-level controls should act as a fast security control plane to reduce exposure while IT teams validate and deploy patches across hybrid and multicloud environments.
Microsoft has been named a Leader in the Frost Radar Cloud Workload Protection Platforms 2026 report, with Frost & Sullivan highlighting Defender for Cloud’s runtime protection depth, SOC integration, and broad security coverage. For IT and security teams, the news reinforces the shift from basic vulnerability scanning to contextual, runtime-first cloud workload protection across multicloud and Kubernetes environments.
Microsoft Defender Experts detailed how defenders can track MacSync Stealer on macOS by focusing on recurring behaviors instead of fast-changing domains. The research links more than 30 related domains and shows how process, command-line, and network telemetry can reveal payload delivery, staging, and chunked data exfiltration.
Microsoft has been named a Leader in the 2026 IDC MarketScape for enterprise MDR/MXDR, highlighting the strength of Microsoft Defender Experts MDR. The recognition matters for security teams evaluating managed detection and response services that combine native Defender integration, large-scale threat intelligence, AI-assisted operations, and 24/7 expert support.
Microsoft Threat Intelligence has published a technical breakdown of DeadLock ransomware, a Rust-based encryptor that uses decentralized infrastructure for victim communications and leak operations. The report highlights geofencing, privilege escalation, service disruption, and recovery workflows, giving security teams practical indicators and mitigation guidance to strengthen ransomware defenses.
Microsoft Threat Intelligence reports that a macOS ClickFix campaign has shifted from openly serving malicious lures to using server-side browser fingerprinting that mainly exposes the payload to likely macOS victims. The change makes the operation harder for crawlers, sandboxes, and defenders to spot, increasing the importance of hunting for shared infrastructure patterns and strengthening endpoint protections.
Microsoft has been named a Leader across all four categories in KuppingerCole’s 2026 CNAPP Leadership Compass, highlighting Defender for Cloud’s unified approach to cloud and AI security. The recognition matters for security teams as CNAPP platforms increasingly focus on exploitability, attack path analysis, AI security posture, and integrated SOC operations across multicloud environments.
Microsoft has detailed ChainDrop, a large-scale npm supply chain attack that compromised more than 400 packages using a self-propagating credential-stealing worm. The campaign matters because it targets developer workstations and CI/CD pipelines, steals cloud and publishing credentials, and can automatically republish infected packages across additional publishers.
Microsoft Defender’s attack disruption now includes automatic device isolation for compromised endpoints, adding a new containment layer beyond user-based response. In a published QNET case study, Defender isolated an endpoint in 128 seconds, stopping a multi-stage ransomware-related attack before persistence, credential theft, or lateral movement could occur.