Security operations

Microsoft Threat Intelligence

Microsoft Threat Intelligence research, actor tracking and campaign analysis.

Full changelog All Threat Intelligence news RSS

Last 30 days13updates across news and docs

News78posts in 180 days

Product changes0in 12 months

Roadmap0items announced

News

Threat Intelligence news

78 posts in the last 180 days from Microsoft's blogs, Tech Community and Azure Updates.

Filter all news

Threat IntelligenceNov 12
Trained to betray: How post-training supply chain attacks hijack coding agents
Microsoft Defender Research and the AI Red Team discuss how poisoned datasets and poisoned model checkpoints can trigger remote code execution and other malicious…
Microsoft Threat Intelligence
Threat IntelligenceNov 11
The global socket: how threat actors are weaponizing GSocket for stealthy C2
Threat actors are deploying GSocket on compromised Linux servers to keep encrypted remote access after the original vulnerability is patched.
Microsoft Threat Intelligence
Threat IntelligenceNov 10
Detecting sleeper agents hiding in AI model neurons
Microsoft Research has released new threat research detailing how a capable agent model could be turned into a sleeper agent by editing fewer than ten neurons to inject…
Microsoft Threat Intelligence
Threat IntelligenceNov 7
ARTEX abuse expands as cybercriminals target financial sector
In October 2026, the financially motivated threat actor Storm-3358 began targeting organizations in the financial sector using the agentic AI offensive framework ARTEX.
Microsoft Security Blog
Threat IntelligenceNov 5
Email threat landscape: Q3 2026 trends and insights
Microsoft Threat Intelligence observed a sharp rise in email-based phishing activity at the end of Q3 2026 (July – September), even as QR code phishing declined…
Microsoft Threat Intelligence
Threat IntelligenceNov 3
Fake-download campaign uses trojanized installers to deliver monetization payloads
Microsoft Threat Intelligence tracks a fake-download campaign that uses trojanized Inno installers to deliver multiple monetization offers and provides detection and…
Microsoft Threat Intelligence
Threat IntelligenceNov 2
What exploited vulnerabilities have in common: A data-driven analysis of real-world attacks
Real-world exploitation concentrates in a small, high-impact subset of CVEs.
Microsoft Threat Intelligence
Threat IntelligenceOct 31
Inside a malicious Claude Code-branded extension and its persistent SSH backdoor
Microsoft analyzes a malicious Claude Code–branded extension, its persistent SSH backdoor, and guidance to detect and remediate it.
Microsoft Threat Intelligence
Threat IntelligenceOct 30
From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths
Teams support impersonation led to remote access, malicious runtime execution, and Certificate Services abuse through authentication relay and Kerberos.
Microsoft Threat Intelligence

Show 69 older posts

Threat IntelligenceOct 29
Tracking AI adoption in North Korean threat actor tradecraft
As Microsoft Threat Intelligence continues to track how threat actors operationalize AI to increase the speed and efficiency of attacks, we’ve identified North Korean…
Microsoft Threat Intelligence
Threat IntelligenceOct 22
Turn threat intelligence into informed action with Microsoft Defender
Every new threat raises a familiar set of questions. Is it targeting our industry? Are we exposed? What should we investigate first?
Microsoft Defender XDR Blog
Threat IntelligenceOct 21
AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise
Storm-0940 used ARTEX agentic AI to accelerate a ConnectWise supply chain compromise, enabling application credential abuse across Microsoft 365 environments.
Microsoft Security Blog
Threat IntelligenceOct 14
The hidden network: Inside the phishing infrastructure ecosystem powering global cybercrime
Microsoft uncovered a Chinese-language cybercriminal ecosystem, an interconnected network of phishing kit operators (tracked as Storm-2990), and an illicit marketplace…
Microsoft Threat Intelligence
Threat IntelligenceSep 30
Unauthenticated command injection on internet-facing mail servers: tracking CVE-2026-73570
Microsoft Threat Intelligence examines CVE-2026-73570 exploitation in Zimbra, including observed attack paths, detection opportunities, and mitigation guidance.
Microsoft Threat Intelligence
Threat IntelligenceSep 29
Phishing Abuses RMM Tools for Persistent Access
Microsoft observed phishing campaigns that abused MSP360 RMM to deploy ScreenConnect, creating redundant remote-access channels for follow-on activity…
Microsoft Threat Intelligence
Threat IntelligenceSep 29
Star Blizzard refines phishing and malware delivery with the RedFlick technique
Since January 2026, Microsoft has observed Russian state threat actor Star Blizzard evolve their detection evasion capabilities through large-scale phishing campaigns…
Microsoft Threat Intelligence
Threat IntelligenceSep 28
NeedyMantis: Unpacking a post-compromise malware family used in targeted operations
Microsoft Threat Intelligence identified NeedyMantis, a modular post-compromise malware framework used in targeted intrusions that combines custom loaders, encrypted…
Microsoft Threat Intelligence
Threat IntelligenceSep 25
Storm-3168: Agentic-driven cloud attacks using compromised service principals
Microsoft details JADEPUFFER-linked Azure reconnaissance, resource deletion, and credential access using compromised service principals, identifying the activity as…
Microsoft Security Blog
Threat IntelligenceSep 24
Beyond the ransomware: Tracking Storm-2570’s consistent tradecraft across deployments
Storm-2570 is a ransomware affiliate that uses consistent post-compromise tools and techniques across deployments involving Qilin, DragonForce, Anubis, and BERT…
Microsoft Threat Intelligence
Threat IntelligenceSep 22
Unmasking EvilTokens: Getting to the root of device code phishing
EvilTokens has quickly become one of the top PhaaS platforms, enabling device code phishing attacks through AI-assisted lures, automated infrastructure, and token theft.
Microsoft Threat Intelligence
Threat IntelligenceSep 10
Protecting organizations from AI-assisted executive impersonation and invoice fraud
Microsoft examines an AI-assisted business email compromise campaign that used executive impersonation and fake invoices to target finance teams with ACH payment fraud.
Microsoft Threat Intelligence
Threat IntelligenceSep 9
Passkey-themed social engineering leads to identity and cloud compromise
Passkey-themed social engineering is being used to compromise identities and enable broader cloud attacks.
Microsoft Threat Intelligence
Threat IntelligenceSep 3
ASCII smuggling crosses over from AI prompt injection to phishing evasion
Invisible Unicode characters popularized for hiding instructions from AI models are now being used to obfuscate words before email filters parse them.
Microsoft Threat Intelligence
Threat IntelligenceSep 2
Impersonating IT support: how threat actors turn a remote session into enterprise-wide access
Microsoft Threat Intelligence observed a human-operated intrusion campaign that abuses Microsoft Teams external collaboration to impersonate IT support, gain remote…
Microsoft Security Blog
Threat IntelligenceSep 1
Counterfeit installers to system compromise: Tracking a deceptive software download campaign
An active campaign is impersonating legitimate software vendors to deliver malware through look-alike download pages and regenerated installer archives.
Microsoft Threat Intelligence
Threat IntelligenceAug 29
TerminalFix campaign deploys a reverse tunnel through multistage intrusion
Microsoft Threat Intelligence provides analysis of a ClickFix campaign that uses fake CAPTCHA prompts, DLL sideloading, and a reverse tunnel, with detections and hunting…
Microsoft Threat Intelligence
Threat IntelligenceAug 11
What’s New at Ignite: Powerful Enhancements in Unified Threat Intelligence
At Microsoft Ignite 2025, we’re unveiling transformative upgrades in threat intelligence designed to empower security teams.
Microsoft Defender XDR Blog
Threat IntelligenceAug 11
Introducing the Threat Intelligence Briefing Agent
As cyber threats rapidly evolve, security teams are overwhelmed by the sheer volume of threat intelligence, making it challenging to deliver timely, targeted…
Microsoft Defender XDR Blog
Threat IntelligenceAug 11
Introducing the MDTI Home Page Widget and Article Digest
The MDTI team is excited to introduce the MDTI Article Digest, a new way for customers to stay up to speed with the latest analysis of threat activity…
Microsoft Defender XDR Blog
Threat IntelligenceAug 11
Introducing the MDTI Premium Data Connector for Sentinel
The MDTI and Unified Security Operations Platform teams are excited to introduce an MDTI Premium data connector available in the Unified Security Operations…
Microsoft Defender XDR Blog
Threat IntelligenceAug 11
More Threat Intelligence Content In MDTI, TA Enables Better Security Outcomes
Microsoft threat intelligence empowers our customers to keep up with the global threat landscape and understand the threats and vulnerabilities most…
Microsoft Defender XDR Blog
Threat IntelligenceAug 11
MDTI Earns Impactful Trio of ISO Certificates
We are excited to announce that Microsoft Defender Threat Intelligence (MDTI) has achieved ISO 27001, ISO 27017 and ISO 27018 certifications.
Microsoft Defender XDR Blog
Threat IntelligenceAug 11
Unified MDTI APIs in Microsoft Graph Now GA
We’re thrilled to share that the unified APIs that are part of the Microsoft Graph are now generally available!
Microsoft Defender XDR Blog
Threat IntelligenceAug 11
MDTI Adds Microsoft Threat Intelligence to Silobreaker
Microsoft Defender Threat Intelligence (MDTI) adds Microsoft Threat Intelligence reputation enrichment to Silobreaker!
Microsoft Defender XDR Blog
Threat IntelligenceAug 11
How MDTI Helps Power Copilot for Security
This blog post will delve into Copilot for Security, focusing on the strategic utilization of Microsoft Defender Threat Intelligence (MDTI), a comprehensive…
Microsoft Defender XDR Blog
Threat IntelligenceAug 11
Using MDTI with the Diamond Model for Threat Intelligence
Microsoft Defender Threat Intelligence (MDTI) provides robust tools and features that enable security analysts to quickly investigate incidents and respond…
Microsoft Defender XDR Blog
Threat IntelligenceAug 11
Unleash the Power of Threat Intel: Introducing the MDTI GitHub
Are you looking to enhance your organization's security processes?
Microsoft Defender XDR Blog
Threat IntelligenceAug 11
What's New: MDTI Intel Reporting Dashboard and Workbook
We are excited to announce the launch of a new dashboard that we have created to enhance our threat intelligence reporting capabilities.
Microsoft Defender XDR Blog
Threat IntelligenceAug 11
New Threat Actor Intel Profiles Added to MDTI
The Microsoft Defender Threat Intelligence (Defender TI) team has recently launched twenty-six new threat actor Intel Profiles, and more than 50 additional…
Microsoft Defender XDR Blog
Threat IntelligenceAug 11
What's New: MDTI Microsoft Sentinel Playbooks
During Microsoft Secure, we announced new capabilities that help enterprise users power up automation with Defender Threat intelligence, including an…
Microsoft Defender XDR Blog
Threat IntelligenceAug 11
Performing a Successful MDTI Proof of Concept (PoC)
To effectively determine the benefits of adopting Defender Threat Intelligence, you should perform a Proof of Concept (PoC).
Microsoft Defender XDR Blog
Threat IntelligenceAug 11
Infrastructure Chaining with Microsoft Defender Threat Intelligence
Infrastructure Chaining is used to investigate the relationships between connected datasets which allows an analyst to develop an investigation into events…
Microsoft Defender XDR Blog
Threat IntelligenceAug 11
Become a Microsoft Defender Threat Intelligence Ninja: The complete level 400 training
Learn how to become a Microsoft Defender Threat Intelligence (MDTI) Ninja!
Microsoft Defender XDR Blog
Threat IntelligenceAug 11
What's in an MDTI Web Crawl?
Want to learn how data found from the DOM of web pages is so powerful when it comes to investigating threats?
Microsoft Defender XDR Blog
Threat IntelligenceAug 11
Introducing Microsoft Defender Threat Intelligence Community
Come learn about the differences between Microsoft Defender Threat Intelligence's Community vs. Premium level of access.
Microsoft Defender XDR Blog
Threat IntelligenceAug 11
Understanding and Using Finished Threat Intelligence
Raw versus finished cyber threat intelligence? What's the difference and why should I care about both? Check out this blog to learn why!
Microsoft Defender XDR Blog
Threat IntelligenceAug 11
Getting the Most Out of Projects in Defender TI
Want to learn about an easier way to collaborate with peers during investigations? Look no further!
Microsoft Defender XDR Blog
Threat IntelligenceAug 11
Getting Started with Microsoft Defender Threat Intelligence
So you're interested in Microsoft Defender Threat Intelligence, but don't know where to start?
Microsoft Defender XDR Blog
Threat IntelligenceAug 11
Defender TI Detections in Microsoft Sentinel
Did you know that you can benefit from Microsoft Defender Threat Intelligence if you're a Microsoft Sentinel customer?
Microsoft Defender XDR Blog
Threat IntelligenceAug 11
How Microsoft Defender Threat Intelligence Enables Threat Hunting Success
Microsoft Defender Threat Intelligence (MDTI) is powerful in the hands of a threat hunter. In this blog, we’ll show you why.
Microsoft Defender XDR Blog
Threat IntelligenceAug 11
How Internet Telemetry Data Becomes Threat Intelligence
So how does Microsoft Defender Threat Intelligence collect, analyze, and index its raw public internet telemetry data? Check out this blog to learn more.
Microsoft Defender XDR Blog
Threat IntelligenceAug 11
Welcome to the Microsoft Defender Threat Intelligence Tech Community
The Microsoft Defender Threat Intelligence (DTI) Tech Community will offer the latest content on how you and your team can get the most out of DTI's…
Microsoft Defender XDR Blog
Threat IntelligenceAug 11
We Are Pleased To Introduce the Microsoft Defender Threat Intelligence Ninja Training Series!
Microsoft has introduced Microsoft Defender Threat Intelligence (MDTI) Level 400 Ninja Training.
Microsoft Defender XDR Blog
Threat IntelligenceAug 11
New at Ignite: Unified Threat Intelligence Experience in Security Copilot
The Security Copilot team is continuously enhancing threat intelligence (TI) capabilities in Copilot.
Microsoft Defender XDR Blog
Threat IntelligenceAug 11GA
MDTI for Government Now Available
We are thrilled to introduce Microsoft Defender Threat Intelligence (MDTI) with FedRAMP High (DOD IL2) attestation are now available for government sectors…
Microsoft Defender XDR Blog
Threat IntelligenceAug 11
MDTI Achieves PCI DSS Certification: Elevating Security Standards
We are excited to announce that MDTI has successfully obtained the Payment Card Industry Data Security Standard (PCI DSS) certification, representing a…
Microsoft Defender XDR Blog
Threat IntelligenceAug 11
Managing “Defender Threat Intelligence” MDTI Premium licenses in Microsoft Entra Admin Center
Learn how to manage MDTI Premium seat assignments in your Microsoft Entra Admin Center.
Microsoft Defender XDR Blog
Threat IntelligenceAug 11
MDTI empowers defenders to get more done with less
A recent peer-reviewed commentary published by the Sans Institute explores the critical role of cyber threat intelligence in attack surface management…
Microsoft Defender XDR Blog
Threat IntelligenceAug 11
Microsoft Defender Threat Intelligence Overview, Concepts, and Vocabulary
Never heard of Microsoft Defender Threat Intelligence? No matter! This blog walks you through an overview of our product.
Microsoft Defender XDR Blog
Threat IntelligenceAug 10
DeadLock ransomware: Breaking down a Rust-based encryptor with decentralized recovery infrastructure
Microsoft Threat Intelligence examines DeadLock ransomware, an emerging financially motivated operation distinguished by its use of decentralized infrastructure to…
Microsoft Threat Intelligence
Threat IntelligenceAug 5
From open lures to cloaked gates: How a macOS ClickFix campaign learned to hide
A macOS ClickFix campaign shifted tactics from openly serving infostealer lures to hiding them behind a browser-fingerprinting gate.
Microsoft Threat Intelligence
Threat IntelligenceAug 4
ChainDrop supply chain compromise: Anatomy of a self-propagating worm
A credential-stealing worm hidden in more than 400 compromised npm packages automatically spread across software ecosystems by republishing malicious updates.
Microsoft Threat Intelligence
Threat IntelligenceJul 31
CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft
Storm-2945, a sub-cluster of the Russian threat actor Midnight Blizzard, has been observed compromising the sign-in portals of hospitality-related organizations such as…
Microsoft Threat Intelligence
Threat IntelligenceJul 16
ACR Stealer: Two observed intrusion chains amid increased threat activity
From late April 2026 to mid-June 2026, Microsoft Defender Experts observed increased ACR Stealer activity across customer environments.
Microsoft Threat Intelligence
Threat IntelligenceJul 16
Unpacking the AsyncAPI npm supply chain compromise and import-time payload delivery
Threat actors compromised AsyncAPI packages and weaponized trusted CI/CD workflows to distribute malware through npm.
Microsoft Threat Intelligence
Threat IntelligenceJul 15
Turning threat intelligence into decisive action with Defender Experts
Security teams have never had more visibility, yet rarely have they felt more uncertain.
Microsoft Security Blog
Threat IntelligenceJul 13
Defending SaaS-based applications against ShinyHunters OAuth abuse
Microsoft Threat Intelligence identified threat actor activity with overlapping tradecraft commonly associated with ShinyHunters, including voice phishing (vishing)…
Microsoft Security Blog
Threat IntelligenceJul 9
GigaWiper: Anatomy of a destructive backdoor assembled from multiple malware
GigaWiper, also tracked as BLUERABBIT, is a destructive backdoor that combines multiple wiping and ransomware-like capabilities into a single operational platform.
Microsoft Threat Intelligence
Threat IntelligenceJun 25
Photo ZIP campaign targeting hospitality industry delivers Node.js implant for persistent access
Microsoft Threat Intelligence identified an active multi-stage intrusion campaign targeting hospitality organizations in Europe and Asia.
Microsoft Security Blog
Threat IntelligenceJun 24
StealC and Amadey: Breaking down infostealers and the cybercrime services that deliver them
On June 24, 2026, Microsoft’s Digital Crimes Unit (DCU) facilitated the takedown, suspension, and blocking of domains that formed the backbone of the StealC and Amadey…
Microsoft Threat Intelligence
Threat IntelligenceJun 18
From package to postinstall payload: Inside the Mastra npm supply chain compromise by Sapphire Sleet
A poisoned npm package infected 140+ projects with a hidden payload.
Microsoft Threat Intelligence
Threat IntelligenceJun 17
Crypto Clipper uses Tor and worm-like propagation for persistence and control
Microsoft Threat Intelligence analyzed a cryptocurrency clipper campaign that combines clipboard theft, wallet replacement, Tor-based communications, and worm-like…
Microsoft Security Blog
Threat IntelligenceJun 8
AI brands as bait: How threat actors are using the AI hype in social engineering
As threat actors operationalize AI to accelerate attacks, they are also leveraging the wider global interest around AI itself as a social engineering lure.
Microsoft Threat Intelligence
Threat IntelligenceJun 3
Preinstall to persistence: Inside the Red Hat npm Miasma credential-stealing campaign
A large-scale npm supply chain attack compromised over 90 versions of @redhat-cloud-services packages, silently infecting CI/CD environments and developer systems.
Microsoft Security Blog
Threat IntelligenceMay 28
The Gentlemen ransomware: Dissecting a self-propagating Go encryptor
Microsoft Threat Intelligence presents a comprehensive analysis of The Gentlemen, a Go-based ransomware deployed by affiliates of Storm-2697 that combines per-file…
Microsoft Threat Intelligence
Threat IntelligenceMay 26
From poisoned search results to GPU mining: A cryptojacking campaign abusing ScreenConnect and Microsoft .NET utilities
Microsoft exposes a cryptojacking campaign using SEO poisoning and ScreenConnect to target high-performance PCs, with malicious sites also surfaced through AI chatbots.
Microsoft Security Blog
Threat IntelligenceMay 19
Exposing Fox Tempest: A malware-signing service operation
Fox Tempest is a financially motivated threat actor operating a malware‐signing‐as‐a‐service (MSaaS) used by other cybercriminals, including Vanilla Tempest and Storm…
Microsoft Threat Intelligence
Threat IntelligenceMay 18
How Storm-2949 turned a compromised identity into a cloud-wide breach
Storm-2949 turned stolen credentials into a cloud-wide breach, moving from identity compromise to large-scale data theft without using malware.
Microsoft Security Blog