Malware - 1

2026 (8)

September (3)

security: NeedyMantis: Unpacking a post-compromise malware family used in targeted operations

Microsoft Security Blog

2026-09-28

Microsoft Threat Intelligence identified NeedyMantis, a modular post-compromise malware framework used in targeted intrusions. It uses custom loaders, encrypted archives, and extensible components to keep access and support follow-on activity.

security: Detect and disrupt AI-themed attacks with Microsoft Defender

Microsoft Security Blog

2026-09-10

Microsoft Defender is described as detecting and disrupting AI-themed phishing, malware, and multi-stage attacks across the attack chain. The post is a Microsoft Security Blog entry dated 2026-09-10.

security: Counterfeit installers to system compromise: Tracking a deceptive software download campaign

Microsoft Security Blog

2026-09-01

Microsoft describes an active malware campaign that uses fake software download pages and repackaged installer archives to impersonate legitimate vendors. The post includes observed tactics, Defender XDR detections, indicators of compromise, and mitigation guidance.

August (1)

security: ChainDrop supply chain compromise: Anatomy of a self-propagating worm

Microsoft Security Blog

2026-08-04

Microsoft describes ChainDrop, a credential-stealing worm embedded in 400+ compromised npm packages that spread by republishing malicious updates across software ecosystems. The post outlines the attack chain, affected environments, and guidance for detection, hunting, and remediation.

July (3)

security: CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft

Microsoft Security Blog

2026-07-31

Microsoft says Storm-2945, a sub-cluster of Midnight Blizzard, has been compromising sign-in portals at hospitality organizations since May 2026 to deliver malware to travelers and steal credentials. The campaign is named CaptiveCrunch and targets travelers worldwide.

security: Unpacking the AsyncAPI npm supply chain compromise and import-time payload delivery

Microsoft Security Blog

2026-07-16

Microsoft reports that attackers compromised AsyncAPI npm packages and used trusted CI/CD workflows to distribute malware via npm. The writeup details the attack chain, import-time payload delivery, and suggested defenses.

security: GigaWiper: Anatomy of a destructive backdoor assembled from multiple malware

Microsoft Security Blog

2026-07-09

Microsoft describes GigaWiper as a destructive backdoor that merges wiping and ransomware-like capabilities into one platform. The analysis focuses on how it reuses code from multiple malware families and offers guidance for detection and defense.

June (1)

security: Chromium extension uses AI‑related branding to redirect browser search

Microsoft Security Blog

2026-06-29

Microsoft reports a malicious Chromium extension that used AI-related branding to impersonate Perplexity AI and redirect browser search traffic. The extension relied on MV3 APIs and intermediary infrastructure to steer searches away from intended destinations.