The Curious Engineer

All blogs / Security

Microsoft Security Blog

microsoft.com/en-us/security/blog

Read the latest news and posts and get helpful insights about Home Page from Microsoft’s team of experts at Microsoft Security Blog.

SecurityMicrosoft blogs

’10’15’20’25
Posts
1,736 from 5 May 2006 to 7 Nov 2026
Posting
about daily (235 in the last year)
Kind
company blog
Feed
https://www.microsoft.com/en-us/security/blog/feed/

Latest

November 2026

  1. ARTEX abuse expands as cybercriminals target financial sector
  2. Threat actors use agentic AI tooling to find and abuse exposed secrets
  3. ​​​​What’s new in Microsoft Security: November 2026
  4. Email threat landscape: Q3 2026 trends and insights
  5. Fake-download campaign uses trojanized installers to deliver monetization payloads
  6. Microsoft named a Leader in the 2026 Gartner® Magic Quadrant™ for AI Agent Management Platforms
  7. What exploited vulnerabilities have in common: A data-driven analysis of real-world attacks

October 2026

  1. Inside a malicious Claude Code-branded extension and its persistent SSH backdoor
  2. From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths
  3. Tracking AI adoption in North Korean threat actor tradecraft
  4. IDC MarketScape names Microsoft a Leader in the 2026 Worldwide Modern Endpoint Security for Enterprises Vendor Assessment
  5. The CISO’s evolving role: Protecting and defending in the agentic era
  6. Inside the LiteLLM 1.107.0 supply chain compromise: Credential theft through Python startup hooks
  7. AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise
  8. Agents are your newest insiders. Security must move at their speed.
  9. Managing open-weight model risk in enterprise deployments
  10. The hidden network: Inside the phishing infrastructure ecosystem powering global cybercrime
  11. Post-quantum authentication: Why organizations should start testing certificate ecosystems now
  12. 3 lessons from frontier AI vulnerability research
  13. CISO perspectives on managing vulnerability risks in the age of AI
  14. Preparing governments for an era of interconnected cyber risk
  15. Insights from the 2026 Microsoft Digital Defense Report

September 2026

  1. ​​Secure what’s next: Your guide to Microsoft Security at Microsoft Ignite 2026
  2. Unauthenticated command injection on internet-facing mail servers: tracking CVE-2026-73570
  3. Phishing Abuses RMM Tools for Persistent Access
  4. ​​Beyond source code: A path to the keys to the kingdom
  5. Star Blizzard refines phishing and malware delivery with the RedFlick technique
  6. NeedyMantis: Unpacking a post-compromise malware family used in targeted operations
  7. Storm-3168: Agentic-driven cloud attacks using compromised service principals
  8. Beyond the ransomware: Tracking Storm-2570’s consistent tradecraft across deployments
  9. ​​​​​​​​What’s new in Microsoft Security: September 2026​​
  10. Reimagining the SOC for the agentic era in Microsoft Defender
  11. Unmasking EvilTokens: Getting to the root of device code phishing
  12. From guidance to action: Security fundamentals that materially reduce risk
  13. Improving email security outcomes with real-world Microsoft Defender insights
  14. Protecting organizations from AI-assisted executive impersonation and invoice fraud
  15. Detect and disrupt AI-themed attacks with Microsoft Defender
  16. Threat matrix: Mapping threats across cloud web applications
  17. Passkey-themed social engineering leads to identity and cloud compromise
  18. How to secure edge AI in customer-owned environments
  19. ASCII smuggling crosses over from AI prompt injection to phishing evasion
  20. Impersonating IT support: how threat actors turn a remote session into enterprise-wide access
  21. Counterfeit installers to system compromise: Tracking a deceptive software download campaign
  22. Cybersecurity IR Workshop: The workshop you shouldn’t miss

August 2026

  1. TerminalFix campaign deploys a reverse tunnel through multistage intrusion
  2. ​​​​​​What’s new in Microsoft Security: August 2026
  3. When AI infrastructure becomes the target: Securing gateways and control points
  4. The patch window is collapsing: Why security needs a new control plane
  5. Microsoft named a Leader in the Frost Radar™: Cloud Workload Protection Platforms, 2026
  6. Hunting MacSync Stealer infrastructure through behavioral pivots
  7. Microsoft named a Leader in the 2026 IDC MarketScape for MDR/MXDR for the Enterprise
  8. DeadLock ransomware: Breaking down a Rust-based encryptor with decentralized recovery infrastructure
  9. ​​Microsoft named a Leader in the KuppingerCole Leadership Compass for Cloud Native Application Protection Platforms (CNAPP)
  10. From open lures to cloaked gates: How a macOS ClickFix campaign learned to hide
  11. ChainDrop supply chain compromise: Anatomy of a self-propagating worm
  12. Advance Zero Trust for AI: New tools and guidance to secure AI agents and DevSecOps
  13. 128 Seconds to disruption: Microsoft Defender stops ransomware at QNET

July 2026

  1. CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft
  2. ​​​​What’s new in Microsoft Security: July 2026
  3. ​​Better security starts with better questions
  4. Rethinking security for the age of AI
  5. Enhancing AI security through global AI red teaming
  6. Email threat landscape: Q2 2026 trends and insights
  7. Real world incident response: Microsoft and AXA XL strengthen cyber resilience
  8. Microsoft at Black Hat USA 2026: Defending trust in the age of AI and supply chain attacks
  9. ACR Stealer: Two observed intrusion chains amid increased threat activity
  10. Least privilege for AI agents: Identity, access, and tool binding
  11. Unpacking the AsyncAPI npm supply chain compromise and import-time payload delivery
  12. Turning threat intelligence into decisive action with Defender Experts
  13. Defending SaaS-based applications against ShinyHunters OAuth abuse
  14. Microsoft Entra ID security updates: Passkeys are the default authentication method in Entra ID
  15. Securing our future: July 2026 progress report on Microsoft’s Secure Future Initiative
  16. GigaWiper: Anatomy of a destructive backdoor assembled from multiple malware
  17. Protecting Microsoft at AI speed: How SFI proactively hardens our cloud
  18. 5 insights from Frost & Sullivan’s 2025 Frost Radar™ for Cloud Security Posture Management
  19. Improving security posture across the Microsoft partner ecosystem
  20. Microsoft named a leader in the Frost Radar for cloud and application runtime security

June 2026

  1. Accelerating the quantum-safe timeline
  2. ​​What’s new in Microsoft Security: June 2026
  3. Securing AI agents: When AI tools move from reading to acting
  4. Chromium extension uses AI‑related branding to redirect browser search
  5. Photo ZIP campaign targeting hospitality industry delivers Node.js implant for persistent access
  6. Microsoft a Leader in The Forrester Wave™ for Endpoint Management Platforms
  7. CNAPP evolution: How Microsoft aligns with leading cloud risk management platforms
  8. StealC and Amadey: Breaking down infostealers and the cybercrime services that deliver them
  9. Guarding AI memory
  10. One intrusion, two cyberattackers: Uncovering parallel threat activity
  11. AutoJack: How a single page can RCE the host running your AI agent
  12. New Forrester Total Economic Impact™ study projects a 124% ROI from unifying with Microsoft Security
  13. From package to postinstall payload: Inside the Mastra npm supply chain compromise by Sapphire Sleet
  14. Crypto Clipper uses Tor and worm-like propagation for persistence and control
  15. Beyond the benchmark: Advancing security at AI speed
  16. ​​Forrester names Microsoft a Leader in the 2026 Extended Detection and Response Platforms Wave™ report
  17. AI is accelerating cyberattacks—here’s how to stay ahead
  18. Microsoft Defender email security benchmarking: Key insights from one year of data
  19. Turn specs into evals for any agent with ASSERT
  20. Reconstructing AI activity in investigations
  21. AI brands as bait: How threat actors are using the AI hype in social engineering
  22. Securing CI/CD in an agentic world: Claude Code Github action case
  23. Updating the taxonomy of failure modes in agentic AI systems: What a year of red teaming taught us
  24. Preinstall to persistence: Inside the Red Hat npm Miasma credential-stealing campaign
  25. Microsoft Build 2026: Securing code, agents, and models across the development lifecycle

May 2026

  1. Malicious npm packages abuse dependency confusion to profile developer environments
  2. Microsoft is named a Leader in the 2026 Gartner® Magic Quadrant™ for Endpoint Protection
  3. Typosquatted npm packages used to steal cloud and CI/CD secrets
  4. The Gentlemen ransomware: Dissecting a self-propagating Go encryptor
  5. From poisoned search results to GPU mining: A cryptojacking campaign abusing ScreenConnect and Microsoft .NET utilities
  6. Microsoft recognized as a Leader in The Forrester Wave™ for Workforce Identity Security Platforms
  7. From edge appliance to enterprise compromise: Multi-stage Linux intrusion via F5 and Confluence
  8. Microsoft Security success stories: How St. Luke’s and ManpowerGroup are securing AI foundations
  9. What’s new in Microsoft Security: May 2026
  10. Mini Shai Hulud: Compromised @antv npm packages enable CI/CD credential theft
  11. Securing the gaming culture of cultures
  12. Introducing RAMPART and Clarity: Open source tools to bring safety into Agent development workflow
  13. Exposing Fox Tempest: A malware-signing service operation
  14. How Storm-2949 turned a compromised identity into a cloud-wide breach
  15. How to better protect your growing business in an AI-powered world
  16. Defense in depth for autonomous AI agents
  17. Kazuar: Anatomy of a nation-state botnet
  18. When configuration becomes a vulnerability: Exploitable misconfigurations in AI apps
  19. Accelerating detection engineering using AI-assisted synthetic attack logs generation
  20. Defense at AI speed: Microsoft’s new multi-model agentic security system tops leading industry benchmark
  21. Defending consumer web properties against modern DDoS attacks
  22. Undermining the trust boundary: Investigating a stealthy intrusion through third-party compromise
  23. Active attack: Dirty Frag Linux vulnerability expands post-compromise risk
  24. When prompts become shells: RCE vulnerabilities in AI agent frameworks
  25. World Passkey Day: Advancing passwordless authentication
  26. ​​Microsoft named an overall leader in KuppingerCole Analyst’s 2026 Emerging AI Security Operations Center (SOC) report ​​
  27. ClickFix campaign uses fake macOS utilities lures to deliver infostealers
  28. Breaking the code: Multi-stage ‘code of conduct’ phishing campaign leads to AiTM token compromise
  29. CVE-2026-31431: Copy Fail vulnerability enables Linux root privilege escalation across cloud environments
  30. Microsoft Agent 365, now generally available, expands capabilities and integrations

April 2026

  1. What’s new, updated, or recently released in Microsoft Security
  2. Email threat landscape: Q1 2026 trends and insights
  3. 8 best practices for CISOs conducting risk reviews
  4. Simplifying AWS defense with Microsoft Sentinel UEBA
  5. AI-powered defense for an AI-accelerated threat landscape
  6. Detection strategies across cloud and identities against infiltrating IT workers
  7. Making opportunistic cyberattacks harder by design
  8. Cross‑tenant helpdesk impersonation to data exfiltration: A human-operated intrusion playbook
  9. Containing a domain compromise: How predictive shielding shut down lateral movement
  10. Building your cryptographic inventory: A customer strategy for cryptographic posture management
  11. Dissecting Sapphire Sleet’s macOS intrusion from lure to compromise
  12. Incident response for AI: Same fire, different fuel
  13. The agentic SOC—Rethinking SecOps for the next decade
  14. Investigating Storm-2755: “Payroll pirate” attacks targeting Canadian employees
  15. Intent redirection vulnerability in third-party SDK exposed millions of Android wallets to potential risk
  16. SOHO router compromise leads to DNS hijacking and adversary-in-the-middle attacks
  17. Inside an AI‑enabled device code phishing campaign
  18. Storm-1175 focuses gaze on vulnerable web-facing assets in high-tempo Medusa ransomware operations

Every year

2026 2122025 1422024 1252023 1512022 1842021 2332020 2242019 1532018 1162017 682016 312015 152014 242013 142012 182011 22010 72009 42008 42007 62006 3