Latest news and updates about Security.
Microsoft has uncovered an active npm supply chain attack in which 14 typosquatted packages stole AWS credentials, HashiCorp Vault tokens, GitHub Actions data, and npm publish tokens during installation. The campaign matters because it targets developer and build environments, creating risk of cloud lateral movement, CI/CD compromise, and downstream software supply chain attacks.
Microsoft Threat Intelligence has published a deep technical analysis of The Gentlemen ransomware, a Go-based ransomware-as-a-service threat that combines strong file encryption with aggressive self-propagation. The research matters for defenders because the malware can rapidly spread across local systems and network shares, increasing the blast radius of a single compromise.
Microsoft has detailed an active cryptojacking campaign that uses poisoned search results and AI chatbot recommendations to lure users to fake software download sites. The attack abuses DLL sideloading, ScreenConnect, and Microsoft .NET utilities to gain persistent access and mine cryptocurrency on high-GPU systems, raising the risk of follow-on activity such as data theft or ransomware.
Microsoft highlighted how St. Luke’s and ManpowerGroup are building AI-ready security foundations with Microsoft Security, Microsoft Sentinel, Microsoft Defender, and Security Copilot. The stories show why unified visibility, automation, and Zero Trust controls are becoming essential for organizations that want to scale AI without increasing risk.
Microsoft has been named a Leader in The Forrester Wave for Workforce Identity Security Platforms, Q2 2026, earning the highest scores in both current offering and strategy. The recognition highlights growing demand for unified identity, access, and response capabilities as organizations manage more human, machine, and AI-driven identities.
Microsoft detailed a multi-stage intrusion where attackers compromised an internet-facing F5 BIG-IP appliance, pivoted to an internal Linux host, then exploited Confluence to steal credentials and target Active Directory. The incident highlights how edge devices, Linux systems, and SaaS apps can become linked attack paths in hybrid environments, making broader monitoring and patching essential.
Microsoft Security’s May 2026 updates focus on improving visibility and control across data, identities, and AI-driven environments. Highlights include the general availability of the new Purview Data Security Posture Management experience, deeper investigations with OCR and custom examinations, Entra ID Account recovery, and expanded preview for Windows 365 for Agents.
Microsoft has disclosed an active supply chain attack involving compromised @antv npm packages that used malicious preinstall scripts to steal credentials from GitHub Actions and other CI/CD environments. The campaign matters because it spread through popular downstream dependencies, putting developer pipelines, cloud secrets, and software supply chains at risk.
Microsoft’s latest Deputy CISO post explains why securing gaming requires a different approach than traditional enterprise IT. The company outlines the distinct risks across gaming platforms, studios, and shared central teams, and highlights how Entra ID, Purview, Defender for Cloud, and Sentinel help balance security with player experience and developer agility.
Microsoft has open-sourced RAMPART and Clarity, two tools aimed at improving safety in agentic AI development. RAMPART brings repeatable adversarial and regression testing into CI pipelines, while Clarity helps teams challenge design assumptions early before code is written.
Microsoft has disrupted Fox Tempest, a malware-signing-as-a-service operation that helped cybercriminals make ransomware and other malware appear legitimately signed. The takedown matters because the group abused Microsoft Artifact Signing, created more than 1,000 fraudulent certificates, and enabled attacks that could bypass security controls more easily.
Microsoft detailed how Storm-2949 turned a socially engineered Microsoft Entra ID compromise into broad data theft across Microsoft 365 and Azure. The case highlights how identity attacks can escalate quickly through legitimate cloud management features, making stronger MFA controls, monitoring, and cross-platform detections critical for defenders.