Company
Microsoft's cybersecurity research division that tracks threat actors, malware campaigns, and vulnerabilities, publishing analysis and defensive guidance.
Huntress traced an MSP administrator's October 7 Bing search to watchguard-vpn[.]net, a WatchGuard lookalike that served a genuine signed installer. The domain was offline by October 13, and earlier WatchGuard and Microsoft reports had described fake clients.
Reality
Microsoft documented a ClickFix variant that stages its payload in the browser cache, keeping the command the victim pastes under Windows' 260-character Run limit. Detection moves to script engines reading browser profile folders, not the pasted text.
Reality
Microsoft says attackers are using CVE-2026-73570 to run commands on Zimbra mail servers with one crafted email and no login. Zimbra shipped the fix in 10.1.20 on July 20, 24 days before disclosure, so anyone who waited for the advisory to patch was already late.
Perspective Coverage
4 publishersReality
Microsoft says China-linked operators have used NeedyMantis since at least October 2025 to keep access to telecom, university and government-linked networks. It goes in after the break-in, so defenders have to hunt for it inside networks already breached.
Perspective Coverage
3 publishersReality
Storm-3068 hijacked one account via self-service password reset and ran an Azure DevOps pipeline authorized for 50-plus resources, Microsoft says. No exploit was involved, so the fix sits in the reset flow and in what one account's pipelines can reach.
Reality
Microsoft says China-aligned NeedyMantis malware, active since at least October 2025, is installed after attackers already have access, to keep it long term. Because entry routes vary, organisations in the five sectors it targets need to look for copies already installed.
Reality
Microsoft's TerminalFix writeup shows the same fake CAPTCHA lure now feeding multi-line PowerShell into Windows Terminal, where it sideloads a signed binary, pulls payloads out of PNG files and leaves a reverse tunnel behind.
Perspective Coverage
4 publishersReality
According to Microsoft Threat Intelligence, every stage after the consent prompt runs on software the environment already trusts, which puts the choke point on Teams federation policy and remote-support install rights.
Reality
Microsoft says affiliate Storm-2570 has run the same remote access and exfiltration tools whether it deploys Qilin, DragonForce, Anubis or BERT ransomware. Detections built on those tools can catch the operator before any payload runs.
Reality
Microsoft says the phishing-as-a-service platform reached more than 12,000 inboxes at over 10,000 organizations in seven months by abusing a legitimate OAuth flow, and its Digital Crimes Unit has now disrupted the infrastructure behind the service.
Reality
Microsoft Threat Intelligence documents ChatGPT, Copilot, DeepSeek and Claude lures spanning phishing kits, adversary-in-the-middle credential theft, malvertising and fake GitHub installers. A broker it tracks as Storm-3075 resells the access it wins.
Reality
Microsoft has tracked this since May 2026. First contact lands on an unmanaged personal phone, and the attacker's own authenticator outlives the stolen session, so tenant telemetry only starts after the account is already lost.
Reality
Microsoft Threat Intelligence says this ClickFix variant ends in Active Directory reconnaissance and a reverse-tunnel implant, giving a single tricked employee a route into the network.
Reality
Microsoft says the technique now reaches thousands of enterprise and end-user devices every day. Because the employee is the one who runs the code, the control that binds is a rule about pasting into shells rather than another agent.
Reality