Back to updates

Security - 3

2026 (12)

March (3)

security: Inside Tycoon2FA: How a leading AiTM phishing kit operated at scale

Microsoft Security Blog

2026-03-04

Microsoft reports that the Tycoon2FA adversary-in-the-middle (AiTM) phishing-as-a-service kit enabled large-scale phishing campaigns and says it coordinated a disruption of the kit’s infrastructure with Europol and industry partners.

security: Signed malware impersonating workplace apps deploys RMM backdoors

Microsoft Security Blog

2026-03-03

Signed malware using a stolen EV code-signing certificate impersonated workplace apps to install legitimate remote monitoring and management (RMM) tools for persistent enterprise access. The post advises tightening certificate controls and monitoring RMM tool usage to reduce risk.

security: OAuth redirection abuse enables phishing and malware delivery

Microsoft Security Blog

2026-03-02

Microsoft reports attackers abusing OAuth redirect behavior to move users from legitimate sign-in pages to attacker-controlled sites, enabling phishing and malware delivery via trusted authentication flows.

February (9)

security: Threat modeling AI applications

Microsoft Security Blog

2026-02-26

Microsoft Security Blog notes that AI threat modeling is used to identify misuse, emergent risks, and failure modes in probabilistic and agentic AI systems.

security: Developer-targeting campaign using malicious Next.js repositories

Microsoft Security Blog

2026-02-24

Microsoft reports a developer-targeting campaign that used malicious Next.js repositories to achieve remote code execution and establish command-and-control via normal build workflows, aiming to blend into routine development activity.

security: Scaling security operations with Microsoft Defender autonomous defense and expert-led services

Microsoft Security Blog

2026-02-24

Guide-style post arguing that manual SOC processes and legacy tools can’t keep up with AI-enabled attacks, and positioning Microsoft Defender’s autonomous capabilities plus expert-led services as the proposed approach.

security: New e-book: Establishing a proactive defense with Microsoft Security Exposure Management

Microsoft Security Blog

2026-02-19

Microsoft published a new e-book positioned as a maturity-based guide for adopting Microsoft Security Exposure Management. It focuses on moving from fragmented, reactive security practices to a unified exposure management approach intended to support proactive defense.

security: Running OpenClaw safely: identity, isolation, and runtime risk

Microsoft Security Blog

2026-02-19

Microsoft Security Blog outlines risks of self-hosted agent runtimes (like OpenClaw) that execute untrusted input while holding long-lived credentials, creating compounded supply-chain exposure. It emphasizes governance plus identity controls and runtime isolation to reduce credential and execution risk in enterprise deployments.

security: Unify now or pay later: New research exposes the operational cost of a fragmented SOC

Microsoft Security Blog

2026-02-17

Microsoft and Omdia report that fragmented security tooling and workflows are increasing SOC operational strain and contributing to overload.

security: Copilot Studio agent security: Top 10 risks you can detect and prevent

Microsoft Security Blog

2026-02-12

Microsoft outlines 10 common security risks in Copilot Studio agents and pairs each with suggested detection and mitigation approaches using Microsoft Defender. The focus is on preventing exposure from configuration, access, and orchestration weaknesses.

security: Your complete guide to Microsoft experiences at RSAC™ 2026 Conference

Microsoft Security Blog

2026-02-12

Microsoft announced its presence at the RSAC 2026 Conference and positioned its show-floor content around “Frontier Firms,” described as human-led and agent-operated organizations.

security: The strategic SIEM buyer’s guide: Choosing an AI-ready platform for the agentic era

Microsoft Security Blog

2026-02-11

Microsoft Security Blog published a post promoting a new buyer’s guide for selecting a unified, AI-ready SIEM platform aimed at supporting “agentic” AI-era security operations.