Credential Theft - 1

2026 (4)

March (3)

security: Guidance for detecting, investigating, and defending against the Trivy supply chain compromise

Microsoft Security Blog

2026-03-25

Microsoft describes a Trivy supply-chain compromise in which attackers abused trusted distribution channels to deliver credential-stealing malware into CI/CD pipelines. The post outlines attacker techniques plus detection, investigation, and defense steps for security teams.

security: Storm-2561 uses SEO poisoning to distribute fake VPN clients for credential theft

Microsoft Security Blog

2026-03-12

Microsoft reports that Storm-2561 has been using SEO poisoning to promote fake VPN client downloads that install signed trojans and steal VPN credentials. The activity has been observed since 2025 and relies on impersonating trusted brands and abusing legitimate services.

security: Contagious Interview: Malware delivered through fake developer job interviews

Microsoft Security Blog

2026-03-11

Microsoft describes the Contagious Interview campaign, where attackers impersonate recruiters from crypto and AI firms to target developers with fake coding assessments. The delivered malware installs backdoors and steals API tokens, cloud credentials, crypto wallets, and source code.

February (1)

security: Infostealers without borders: macOS, Python stealers, and platform abuse

Microsoft Security Blog

2026-02-02

Microsoft describes recent infostealer activity targeting macOS, highlighting Python-based stealers and distribution techniques that abuse trusted platforms and common utilities.

2025 (1)

September (1)

security: AI vs. AI: Detecting an AI-obfuscated phishing campaign

Microsoft Security Blog

2025-09-24

Microsoft Threat Intelligence detected and blocked a credential-phishing campaign that likely used AI-generated code to obfuscate its payload and evade traditional defenses, highlighting a trend of attackers leveraging AI and the need for defenders to anticipate and adapt to AI-driven threats.