Back to updates

Credential-Theft - 1

2026 (6)

May (1)

security: Breaking the code: Multi-stage ‘code of conduct’ phishing campaign leads to AiTM token compromise

Microsoft Security Blog

2026-05-04

Microsoft Defender Research documented a large-scale credential theft campaign using code-of-conduct-themed lures, a multi-step phishing chain, and legitimate email services to send authenticated messages from attacker-controlled domains. The campaign led to adversary-in-the-middle (AiTM) token compromise.

April (2)

security: Email threat landscape: Q1 2026 trends and insights

Microsoft Security Blog

2026-04-30

Microsoft reported that email threats rose in early 2026, driven by credential phishing, QR code phishing, and CAPTCHA-gated campaigns. It also said disruption of the Tycoon2FA phishing platform reduced observed volume by 15% and prompted changes in attacker tactics.

security: Dissecting Sapphire Sleet’s macOS intrusion from lure to compromise

Microsoft Security Blog

2026-04-16

Microsoft reports a macOS intrusion campaign attributed to Sapphire Sleet that uses social engineering and user-driven execution to bypass macOS protections. The campaign is described as stealing credentials, cryptocurrency assets, and other sensitive data.

March (3)

security: Guidance for detecting, investigating, and defending against the Trivy supply chain compromise

Microsoft Security Blog

2026-03-25

Microsoft describes a Trivy supply-chain compromise in which attackers abused trusted distribution channels to deliver credential-stealing malware into CI/CD pipelines. The post outlines attacker techniques plus detection, investigation, and defense steps for security teams.

security: Storm-2561 uses SEO poisoning to distribute fake VPN clients for credential theft

Microsoft Security Blog

2026-03-12

Microsoft reports that Storm-2561 has been using SEO poisoning to promote fake VPN client downloads that install signed trojans and steal VPN credentials. The activity has been observed since 2025 and relies on impersonating trusted brands and abusing legitimate services.

security: Contagious Interview: Malware delivered through fake developer job interviews

Microsoft Security Blog

2026-03-11

Microsoft describes the Contagious Interview campaign, where attackers impersonate recruiters from crypto and AI firms to target developers with fake coding assessments. The delivered malware installs backdoors and steals API tokens, cloud credentials, crypto wallets, and source code.