Back to updates

Microsoft Security Blog - 1

2026 (12)

November (4)

security: The global socket: how threat actors are weaponizing GSocket for stealthy C2

Microsoft Security Blog

2026-11-11

Microsoft reports that threat actors are using GSocket on compromised Linux servers to maintain encrypted remote access and command-and-control after the initial vulnerability has been patched. The post focuses on detection, investigation, and remediation guidance for this activity.

security: Lessons from 59 Linux Kernel Bug Reports

Microsoft Security Blog

2026-11-11

Microsoft FORGE Lab researchers used codenamed MDASH to study Linux kernel vulnerabilities and reported 59 upstream bugs, with 33 CVEs assigned and 38 fixes merged. The post also notes eight local root privilege-escalation exploits and discusses the difficulty of validating AI-generated findings and getting fixes upstream.

security: ARTEX abuse expands as cybercriminals target financial sector

Microsoft Security Blog

2026-11-07

Microsoft reports that in October 2026 the financially motivated threat actor Storm-3358 started targeting financial-sector organizations using the agentic AI offensive framework ARTEX.

security: What exploited vulnerabilities have in common: A data-driven analysis of real-world attacks

Microsoft Security Blog

2026-11-02

Microsoft Security Blog says real-world exploitation is concentrated in a small subset of CVEs, and defenders should prioritize vulnerabilities by exploitation likelihood, exposure, and potential blast radius. The post presents a data-driven analysis of exploited vulnerabilities.

October (3)

security: From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths

Microsoft Security Blog

2026-10-30

Microsoft describes an intrusion path that began with help desk impersonation and progressed to remote access, malicious runtime execution, and abuse of Active Directory Certificate Services (AD CS). The post focuses on ESC1 and ESC8 techniques involving authentication relay and Kerberos.

security: The CISO’s evolving role: Protecting and defending in the agentic era

Microsoft Security Blog

2026-10-28

Microsoft says CISOs now need to balance enabling AI/agent adoption with identity and data guardrails while also updating defenses against AI-powered threats. The post outlines how security leaders can approach both priorities in the agentic era.

security: Agents are your newest insiders. Security must move at their speed.

Microsoft Security Blog

2026-10-19

Microsoft announced new capabilities in Microsoft 365 E7 and Project Perception aimed at helping organizations contain AI agent risk and continuously adapt protection. The post frames agents as insider-like risks and focuses on security controls that keep pace with their behavior.

September (4)

security: ​​Beyond source code: A path to the keys to the kingdom

Microsoft Security Blog

2026-09-29

Microsoft describes how Storm-3068 used a compromised identity to expand access into cloud environments, moving beyond source code exposure to broader infrastructure compromise. The post focuses on defensive steps for protecting identities, CI/CD pipelines, and cloud infrastructure.

security: From guidance to action: Security fundamentals that materially reduce risk

Microsoft Security Blog

2026-09-17

Microsoft says AI has changed the cybersecurity operating environment and points readers to exposure management guidance with recommended controls. The post emphasizes taking action on security fundamentals to reduce risk.

security: How to secure edge AI in customer-owned environments

Microsoft Security Blog

2026-09-04

Microsoft says edge AI deployments in customer-owned environments require stronger verification of systems, software, and AI assets before sharing sensitive data, credentials, or models. The post frames secure edge AI as a trust and validation problem for third-party environments.

security: Impersonating IT support: how threat actors turn a remote session into enterprise-wide access

Microsoft Security Blog

2026-09-02

Microsoft Threat Intelligence reported a human-operated intrusion campaign that abuses Microsoft Teams external collaboration to impersonate IT support, gain remote access, and deploy a Node.js-based implant. The campaign uses social engineering and legitimate tools to move from initial access to lateral movement, with Microsoft Defender used for detection and disruption.

August (1)

security: Hunting MacSync Stealer infrastructure through behavioral pivots

Microsoft Security Blog

2026-08-18

Microsoft describes how it tracked MacSync Stealer infrastructure despite rapid domain rotation by using stable behavioral pivots. The investigation identified more than 30 related domains.