Malware - 1

2026 (9)

May (1)

security: Kazuar: Anatomy of a nation-state botnet

Microsoft Security Blog

2026-05-14

Microsoft says Kazuar, attributed to Russian state actor Secret Blizzard, has evolved from a backdoor into a modular peer-to-peer botnet used for espionage-focused operations. The malware has been under continuous development for years and is designed for persistent, covert access.

April (1)

security: Dissecting Sapphire Sleet’s macOS intrusion from lure to compromise

Microsoft Security Blog

2026-04-16

Microsoft reports a macOS intrusion campaign attributed to Sapphire Sleet that uses social engineering and user-driven execution to bypass macOS protections. The campaign is described as stealing credentials, cryptocurrency assets, and other sensitive data.

March (6)

security: WhatsApp malware campaign delivers VBScript and MSI backdoors

Microsoft Security Blog

2026-03-31

Microsoft describes a malware campaign delivered through WhatsApp messages that uses VBS scripts to start a multi-stage infection chain. The attackers rely on renamed Windows utilities and cloud-hosted payloads to install MSI backdoors and keep persistent access on compromised systems.

security: WhatsApp malware campaign delivers VBS payloads and MSI backdoors

Microsoft Security Blog

2026-03-31

Microsoft describes a malware campaign distributed through WhatsApp messages that uses VBS scripts to start a multi-stage infection chain. The attackers use renamed Windows tools and cloud-hosted payloads to deploy MSI backdoors and keep persistent access on infected systems.

security: When tax season becomes cyberattack season: Phishing and malware campaigns using tax-related lures

Microsoft Security Blog

2026-03-19

Microsoft says threat actors are using tax-season urgency to deliver phishing and malware via refund notices, payroll forms, filing reminders, and fake tax-professional requests. The lures can include malicious attachments, links, and QR codes.

security: Contagious Interview: Malware delivered through fake developer job interviews

Microsoft Security Blog

2026-03-11

Microsoft describes the Contagious Interview campaign, where attackers impersonate recruiters from crypto and AI firms to target developers with fake coding assessments. The delivered malware installs backdoors and steals API tokens, cloud credentials, crypto wallets, and source code.

security: Signed malware impersonating workplace apps deploys RMM backdoors

Microsoft Security Blog

2026-03-03

Signed malware using a stolen EV code-signing certificate impersonated workplace apps to install legitimate remote monitoring and management (RMM) tools for persistent enterprise access. The post advises tightening certificate controls and monitoring RMM tool usage to reduce risk.

security: OAuth redirection abuse enables phishing and malware delivery

Microsoft Security Blog

2026-03-02

Microsoft reports attackers abusing OAuth redirect behavior to move users from legitimate sign-in pages to attacker-controlled sites, enabling phishing and malware delivery via trusted authentication flows.

February (1)

security: Developer-targeting campaign using malicious Next.js repositories

Microsoft Security Blog

2026-02-24

Microsoft reports a developer-targeting campaign that used malicious Next.js repositories to achieve remote code execution and establish command-and-control via normal build workflows, aiming to blend into routine development activity.