Project

Microsoft Defender XDR

Microsoft's XDR platform that unifies endpoint, identity, email, and cloud signals to detect and respond to cyber threats.

Known aliases

Defender XDR
Defender XDR portal

Current stories

securityConfirmed3 publishers

Microsoft says China-linked operators hand-install NeedyMantis to keep hold of breached networks

Microsoft says China-linked operators have used NeedyMantis since at least October 2025 to keep access to telecom, university and government-linked networks. It goes in after the break-in, so defenders have to hunt for it inside networks already breached.

Publishers:infosecurity-magazine.com securityweek.com thehackernews.com

Perspective Coverage

3 publishers

Builder: Builder 22%
Operator: Operator 67%
Investor: Investor 11%

Reality

Evidence62
Adoption: Insufficient
Hype gap+18
Incentives40
Confidence60

securityConfirmed2 publishers

Defender broke on a signature update, and the fix Microsoft offered was to roll forward

Admins reinstalled Windows after Defender scans began crashing with 0xc0000005 errors. The remedy was a newer signature build, which is not the same thing as a rollback.

Publishers:bleepingcomputer.com scworld.com

Reality

Evidence55
Adoption: Insufficient
Hype gap+5
Incentives: Insufficient
Confidence60

securityConfirmed2 publishers

Spoofed vendor download pages hand out a fresh payload hash on every click

Microsoft Defender Experts says fake Kaspersky, Razer and Calibre download sites all funnel to one delivery host that rebuilds the installer per request, which leaves hash blocking almost nothing durable to match.

Publishers:microsoft.com thehackernews.com

Reality

Evidence68
Adoption: Insufficient
Hype gap+12
Incentives40
Confidence70

leadershipOne report1 publisher

ClickFix scales by asking employees to paste the command themselves

Microsoft says the technique now reaches thousands of enterprise and end-user devices every day. Because the employee is the one who runs the code, the control that binds is a rule about pasting into shells rather than another agent.

Publishers:microsoft.com

Reality

Evidence61
Adoption71
Hype gap+14
Incentives70
Confidence58

leadershipOne report1 publisher

Attackers reached a domain controller through one exposed SolarWinds helpdesk

Microsoft's Defender team cannot say which of three SolarWinds flaws opened the door, because the December hosts were vulnerable to all of them, which makes the exposure list more useful than the patch list.

Publishers:microsoft.com

Reality

Evidence62
Adoption45
Hype gap−8
Incentives68
Confidence55