other
Microsoft's built-in security suite for Windows and enterprise networks, covering antivirus, endpoint detection and response, and threat hunting.
No evidence-backed relationships are recorded.
ShieldCrash, a public proof of concept, reaches SYSTEM-level file reads on fully patched Windows hosts, defeating Microsoft's fix for CVE-2026-69414. Only arbitrary read has been shown, not code execution, and there is no confirmed exploitation in the wild.
Reality
Huntress traced a RAT campaign that hides its first-stage lure in a ChatGPT Custom GPT on the real chatgpt.com, across at least 40 incidents. Because the page sits on a trusted domain, blocking the ClickFix PowerShell paste is the control that works.
Perspective Coverage
8 publishersReality
Roblox Account Manager's developer traced a Defender trojan verdict, from 1 of 75 VirusTotal engines, to the commit that added libsodium. Build-and-scan bisection found the dependency, though the developer can only hypothesise why the model objects to it.
Reality
Microsoft says China-aligned NeedyMantis malware, active since at least October 2025, is installed after attackers already have access, to keep it long term. Because entry routes vary, organisations in the five sectors it targets need to look for copies already installed.
Reality
Graz University of Technology researchers used file-change alerts to catch 95.7% of another Windows user's Firefox site visits from an unprivileged account. On shared hosts and on servers that run services under their own accounts, separation between users is weaker than the account model suggests.
Reality
NCSC, FBI and AIVD say two Iranian spyware families report to per-victim Telegram bots and exfiltrate through Vultr, Storj and Backblaze B2. Networks already allow those services, so detection has to rely on host behaviour such as new Defender exclusions.
Reality
Securelist says the newest CoolClient deploys a signed kernel-mode driver as a Windows service to hide its process, files and registry keys. It was seen in Pakistan, Mongolia and Myanmar.
Reality
An affiliate entered through an MFA-less SonicWall VPN, then used Safe Mode with Networking to kill endpoint controls. The encryptor ran out of virtual memory instead of running.
Perspective Coverage
3 publishersReality
Microsoft has removed the legacy WMIC binary rather than deprecating it again. WMI itself stays, so admin scripts and detection content keyed to wmic.exe both need rework this cycle.
Perspective Coverage
3 publishersReality
Check Point's BTR Reforged turns a required Defender component into Ring 0 file and registry deletion on Windows 7 through 11 25H2. It cannot be blocklisted, so detection is the only lever left.
Reality
Acronis says the operator borrowed a security vendor's own uninstall driver to shut down Defender on Cambodian machines, and the loader keeps three further ways to blind an agent if the kernel route fails.
Reality
Chaotic Eclipse published working code that abuses Falcon's Office macro removal on fully patched Windows 11 25H2 and Server 2025. It is the fourth endpoint product the researcher has dropped exploit code for, and no CrowdStrike response is on record.
Perspective Coverage
5 publishersReality
Group-IB says the Iran-linked leak-and-brag front Handala Hack runs HEAVYGRAM, a Python implant that takes orders from a Telegram bot, opens the microphone and lifts saved passwords after a loader writes Defender exclusions for it.
Perspective Coverage
9 publishersReality
Abdelhamid Naceri published the tool over the weekend as the latest move in his dispute with Microsoft over his March 2025 termination, and said it needs only a standard user account on any supported Windows version.
Perspective Coverage
4 publishersReality
Microsoft's Purview and Entra Global Secure Access can now block sensitive uploads to unsanctioned AI tools at the network layer, for users and agents. Licensing is not in the announcement, so tenants cannot yet tell whether it is a setting or a purchase.
Reality
Huntress traced a September 2026 intrusion in which the actor compiled a Monero miner on the endpoint, using a MagicINFO flaw Samsung fixed 16 months earlier. The build step is loud in telemetry, but it ran only after Defender had been disabled.
Reality
The Integrated Security Operations Center preview puts case management and workbooks in the Defender portal with no setup, while behavior analytics and third-party feeds wait on a new Azure-linked workspace. Microsoft has not disclosed pricing.
Reality
Microsoft is building one foundation inside Defender for security operations and native protection, and the reason it gives is that a single operator with an agent framework now does what once took whole teams.
Reality
Microsoft's public preview flags jailbreaks, prompt injection and credential leakage from agent telemetry, and agents built outside Copilot Studio, Foundry and Agent Builder need the Agent 365 SDK first.
Reality
Microsoft says the phishing-as-a-service platform reached more than 12,000 inboxes at over 10,000 organizations in seven months by abusing a legitimate OAuth flow, and its Digital Crimes Unit has now disrupted the infrastructure behind the service.
Reality
Security · September 17, 2026 · 1 publisher
Build · September 17, 2026 · 1 publisher
Build · September 15, 2026 · 2 publishers
Leadership · September 13, 2026 · 1 publisher
Security · September 7, 2026 · 1 publisher
Build · September 10, 2026 · 1 publisher
Security · September 10, 2026 · 1 publisher
Build · September 9, 2026 · 1 publisher
Build · September 9, 2026 · 1 publisher
Build · September 8, 2026 · 1 publisher
Security · September 4, 2026 · 1 publisher
Security · September 4, 2026 · 1 publisher
Security · September 1, 2026 · 2 publishers
Product · August 25, 2026 · 1 publisher
Build · August 21, 2026 · 1 publisher
Security · August 20, 2026 · 1 publisher
Leadership · August 20, 2026 · 1 publisher
Product · August 18, 2026 · 1 publisher
Build · August 17, 2026 · 1 publisher
Security · August 15, 2026 · 6 publishers
Security · August 15, 2026 · 1 publisher