Threat Intelligence - 1

2026 (8)

November (2)

security: Email threat landscape: Q3 2026 trends and insights

Microsoft Security Blog

2026-11-05

Microsoft Threat Intelligence reported a sharp rise in email-based phishing activity in Q3 2026, while QR code phishing declined. The post also noted a rebound in CAPTCHA-gated phishing and highlighted risks from malicious messages spoofing familiar business-service sender domains and security override behavior.

security: Fake-download campaign uses trojanized installers to deliver monetization payloads

Microsoft Security Blog

2026-11-03

Microsoft Threat Intelligence describes a fake-download campaign that uses trojanized Inno installers to deliver monetization payloads. The post includes detection and investigation guidance covering the full installer session.

October (1)

security: Tracking AI adoption in North Korean threat actor tradecraft

Microsoft Security Blog

2026-10-29

Microsoft Threat Intelligence reports that North Korean threat actors are increasingly using AI in their operations, with different levels of adoption across groups. The post describes how AI is being incorporated into attack chains to improve speed and efficiency.

September (4)

security: Unauthenticated command injection on internet-facing mail servers: tracking CVE-2026-73570

Microsoft Security Blog

2026-09-30

Microsoft Threat Intelligence reports active exploitation of CVE-2026-73570 in Zimbra mail servers. The post covers observed attack paths, ways to detect the activity, and mitigation guidance.

security: Beyond the ransomware: Tracking Storm-2570’s consistent tradecraft across deployments

Microsoft Security Blog

2026-09-24

Microsoft says Storm-2570 reuses the same post-compromise tools and techniques across multiple ransomware deployments, including Qilin, DragonForce, Anubis, and BERT. The post outlines guidance for defenders to detect and disrupt the activity before ransomware is deployed.

security: Impersonating IT support: how threat actors turn a remote session into enterprise-wide access

Microsoft Security Blog

2026-09-02

Microsoft Threat Intelligence reported a human-operated intrusion campaign that abuses Microsoft Teams external collaboration to impersonate IT support, gain remote access, and deploy a Node.js-based implant. The campaign uses social engineering and legitimate tools to move from initial access to lateral movement, with Microsoft Defender used for detection and disruption.

security: Counterfeit installers to system compromise: Tracking a deceptive software download campaign

Microsoft Security Blog

2026-09-01

Microsoft describes an active malware campaign that uses fake software download pages and repackaged installer archives to impersonate legitimate vendors. The post includes observed tactics, Defender XDR detections, indicators of compromise, and mitigation guidance.

August (1)

security: When AI infrastructure becomes the target: Securing gateways and control points

Microsoft Security Blog

2026-08-26

Microsoft Threat Intelligence reports on attacks against exposed AI infrastructure, focusing on LiteLLM gateway exploitation and related credential theft, persistence, and cryptomining activity. The post highlights gateways and other control points as targets that need protection.