3 lessons from frontier AI vulnerability research 2026-10-07 15 Taesoo Kim True CISO perspectives on managing vulnerability risks in the age of AI 2026-10-06 25 Freddy Dezeure and Sesha Mani True Unauthenticated command injection on internet-facing mail servers: tracking CVE-2026-73570 2026-09-30 85 Microsoft Security Research, Mahesh Mandava and Rajesh Kumar Natarajan True Phishing Abuses RMM Tools for Persistent Access 2026-09-29 75 Microsoft Security Research, Parasharan Raghavan, Deva Kanna Kannan, Sai Chakri and Microsoft Defender Experts True Beyond source code: A path to the keys to the kingdom 2026-09-29 78 Microsoft Defender Experts Cybersecurity Incident Response True Star Blizzard refines phishing and malware delivery with the RedFlick technique 2026-09-29 90 Microsoft Threat Intelligence True NeedyMantis: Unpacking a post-compromise malware family used in targeted operations 2026-09-28 78 Microsoft Threat Intelligence True Storm-3168: Agentic-driven cloud attacks using compromised service principals 2026-09-25 80 Microsoft Security Research, Yossi Weizman and Tushar Mudi True Beyond the ransomware: Tracking Storm-2570’s consistent tradecraft across deployments 2026-09-24 78 Microsoft Threat Intelligence True Unmasking EvilTokens: Getting to the root of device code phishing 2026-09-22 80 Microsoft Threat Intelligence, Microsoft Defender Experts and Microsoft Security Research True From guidance to action: Security fundamentals that materially reduce risk 2026-09-17 70 Ron Pessner True Protecting organizations from AI-assisted executive impersonation and invoice fraud 2026-09-10 70 Microsoft Security Research True Detect and disrupt AI-themed attacks with Microsoft Defender 2026-09-10 70 Rob Lefferts True Passkey-themed social engineering leads to identity and cloud compromise 2026-09-09 78 Microsoft Security Research, Krithika Ramakrishnan, Bharat Vaghela, Vaibhav Deshmukh, Subhajit Ghosh, Anusha Chakraborty, Akash Chaudhuri, Victor Chingtham and Ivan Macalintal True ASCII smuggling crosses over from AI prompt injection to phishing evasion 2026-09-03 68 Microsoft Security Research, Noam Kochavi and Sarah Wolstencroft True Impersonating IT support: how threat actors turn a remote session into enterprise-wide access 2026-09-02 80 Microsoft Security Research, Sagar Patil, Arlette Umuhire Sangwa, Jesse Birch and Ravikant Tiwari True Counterfeit installers to system compromise: Tracking a deceptive software download campaign 2026-09-01 75 Microsoft Security Research, Microsoft Defender Experts and Parth Jomadkar True TerminalFix campaign deploys a reverse tunnel through multistage intrusion 2026-08-29 78 Microsoft Security Research, Sagar Patil, Suriyaraj Natarajan and Parasharan Raghavan True When AI infrastructure becomes the target: Securing gateways and control points 2026-08-26 76 Microsoft Security Research, Yash Gund and Sumith Maniath True Hunting MacSync Stealer infrastructure through behavioral pivots 2026-08-18 70 Microsoft Defender Experts and Microsoft Security Research True DeadLock ransomware: Breaking down a Rust-based encryptor with decentralized recovery infrastructure 2026-08-10 78 Microsoft Threat Intelligence True From open lures to cloaked gates: How a macOS ClickFix campaign learned to hide 2026-08-05 75 Microsoft Security Research and Srinivasan Govindarajan True ChainDrop supply chain compromise: Anatomy of a self-propagating worm 2026-08-04 90 Microsoft Security Research, Ravikant Tiwari, Sagar Patil and Suriyaraj Natarajan True 128 Seconds to disruption: Microsoft Defender stops ransomware at QNET 2026-08-04 45 Microsoft Security Research, David Shiran and Ayelet Artzi True CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft 2026-07-31 92 Microsoft Threat Intelligence True Email threat landscape: Q2 2026 trends and insights 2026-07-23 75 Microsoft Threat Intelligence and Microsoft Defender Security Research Team True ACR Stealer: Two observed intrusion chains amid increased threat activity 2026-07-16 75 Microsoft Security Research and Balaji Venkatesh S True Unpacking the AsyncAPI npm supply chain compromise and import-time payload delivery 2026-07-16 90 Microsoft Security Research, Ravikant Tiwari, Sagar Patil, Suriyaraj Natarajan and Arvind Gowda True Defending SaaS-based applications against ShinyHunters OAuth abuse 2026-07-13 80 Microsoft Security Research and Microsoft Defender Security Research Team True GigaWiper: Anatomy of a destructive backdoor assembled from multiple malware 2026-07-09 85 Microsoft Threat Intelligence True Securing AI agents: When AI tools move from reading to acting 2026-06-30 70 Microsoft Incident Response True Chromium extension uses AI‑related branding to redirect browser search 2026-06-29 70 Microsoft Defender Security Research Team and Microsoft Defender Experts True Photo ZIP campaign targeting hospitality industry delivers Node.js implant for persistent access 2026-06-25 75 Microsoft Defender Security Research Team True StealC and Amadey: Breaking down infostealers and the cybercrime services that deliver them 2026-06-24 78 Microsoft Threat Intelligence, Microsoft Defender Security Research Team and Microsoft Digital Crimes Unit True One intrusion, two cyberattackers: Uncovering parallel threat activity 2026-06-22 78 Microsoft Incident Response True AutoJack: How a single page can RCE the host running your AI agent 2026-06-19 50 Microsoft Defender Security Research Team True From package to postinstall payload: Inside the Mastra npm supply chain compromise 2026-06-18 90 Microsoft Defender Security Research Team True Crypto Clipper uses Tor and worm-like propagation for persistence and control 2026-06-17 70 Microsoft Defender Security Research Team and Microsoft Defender Experts True Beyond the benchmark: Advancing security at AI speed 2026-06-17 75 Taesoo Kim True AI brands as bait: How threat actors are using the AI hype in social engineering 2026-06-08 78 Microsoft Threat Intelligence and Microsoft Defender Security Research Team True Securing CI/CD in an agentic world: Claude Code Github action case 2026-06-05 70 Microsoft Defender Security Research Team, Dor Edry and Amit Eliahu True Updating the taxonomy of failure modes in agentic AI systems: What a year of red teaming taught us 2026-06-04 78 Microsoft AI Red Team True Preinstall to persistence: Inside the Red Hat npm Miasma credential-stealing campaign 2026-06-03 92 Microsoft Defender Security Research Team True Malicious npm packages abuse dependency confusion to profile developer environments 2026-05-30 85 Microsoft Defender Security Research Team True Typosquatted npm packages used to steal cloud and CI/CD secrets 2026-05-29 90 Microsoft Defender Security Research Team True The Gentlemen ransomware: Dissecting a self-propagating Go encryptor 2026-05-28 80 Microsoft Threat Intelligence True From poisoned search results to GPU mining: A cryptojacking campaign abusing ScreenConnect and Microsoft .NET utilities 2026-05-26 70 Microsoft Defender Experts and Microsoft Defender Security Research Team True From edge appliance to enterprise compromise: Multi-stage Linux intrusion via F5 and Confluence 2026-05-22 78 Microsoft Defender Security Research Team True Mini Shai Hulud: Compromised @antv npm packages enable CI/CD credential theft 2026-05-20 90 Microsoft Defender Security Research Team True Exposing Fox Tempest: A malware-signing service operation 2026-05-19 78 Microsoft Threat Intelligence True 
