Back to updates

Security - 6

2026 (10)

March (4)

security: Malicious AI Assistant Extensions Harvest LLM Chat Histories

Microsoft Security Blog

2026-03-05

Microsoft reports a campaign of malicious AI browser extensions that exfiltrated LLM chat histories and browsing data from services including ChatGPT and DeepSeek, affecting large numbers of users and enterprises.

security: Inside Tycoon2FA: How a leading AiTM phishing kit operated at scale

Microsoft Security Blog

2026-03-04

Microsoft reports that the Tycoon2FA adversary-in-the-middle (AiTM) phishing-as-a-service kit enabled large-scale phishing campaigns and says it coordinated a disruption of the kit’s infrastructure with Europol and industry partners.

security: Signed malware impersonating workplace apps deploys RMM backdoors

Microsoft Security Blog

2026-03-03

Signed malware using a stolen EV code-signing certificate impersonated workplace apps to install legitimate remote monitoring and management (RMM) tools for persistent enterprise access. The post advises tightening certificate controls and monitoring RMM tool usage to reduce risk.

security: OAuth redirection abuse enables phishing and malware delivery

Microsoft Security Blog

2026-03-02

Microsoft reports attackers abusing OAuth redirect behavior to move users from legitimate sign-in pages to attacker-controlled sites, enabling phishing and malware delivery via trusted authentication flows.

February (6)

security: Threat modeling AI applications

Microsoft Security Blog

2026-02-26

Microsoft Security Blog notes that AI threat modeling is used to identify misuse, emergent risks, and failure modes in probabilistic and agentic AI systems.

security: Developer-targeting campaign using malicious Next.js repositories

Microsoft Security Blog

2026-02-24

Microsoft reports a developer-targeting campaign that used malicious Next.js repositories to achieve remote code execution and establish command-and-control via normal build workflows, aiming to blend into routine development activity.

security: Scaling security operations with Microsoft Defender autonomous defense and expert-led services

Microsoft Security Blog

2026-02-24

Guide-style post arguing that manual SOC processes and legacy tools can’t keep up with AI-enabled attacks, and positioning Microsoft Defender’s autonomous capabilities plus expert-led services as the proposed approach.

security: New e-book: Establishing a proactive defense with Microsoft Security Exposure Management

Microsoft Security Blog

2026-02-19

Microsoft published a new e-book positioned as a maturity-based guide for adopting Microsoft Security Exposure Management. It focuses on moving from fragmented, reactive security practices to a unified exposure management approach intended to support proactive defense.

security: Running OpenClaw safely: identity, isolation, and runtime risk

Microsoft Security Blog

2026-02-19

Microsoft Security Blog outlines risks of self-hosted agent runtimes (like OpenClaw) that execute untrusted input while holding long-lived credentials, creating compounded supply-chain exposure. It emphasizes governance plus identity controls and runtime isolation to reduce credential and execution risk in enterprise deployments.

security: Unify now or pay later: New research exposes the operational cost of a fragmented SOC

Microsoft Security Blog

2026-02-17

Microsoft and Omdia report that fragmented security tooling and workflows are increasing SOC operational strain and contributing to overload.