WhisperLeak is a side-channel attack that could enable an attacker with the ability to monitor network traffic to infer conversation topics with remote language models, even when the traffic is fully encrypted with TLS. msft.it/63322tUD9j

Most successful exploitation activity related to the CVE-2025-55182 vulnerability affecting React Server Components, Next.js, and related frameworks originated from red team assessments, but observed exploitation attempts by threat actors deliver various payloads. msft.it/63323tmKIh

New blog post: Shai-Hulud 2.0: Guidance for detecting, investigating, and defending against the supply chain attack. msft.it/63322t90mY

The December 2025 security updates are available:

"Defense is doable… We have to be brilliant at the basics... It’s about doing really good access management, really good principle of least privilege, really good network architecture..." -- Matt Duncan, E-ISAC VP of Security Operations and Intelligence msft.it/63325tdPsv

On Thanksgiving eve, November 26, Microsoft detected and blocked a high-volume phishing campaign from a threat actor we track as Storm-0900. The campaign used parking ticket and medical test result themes and referenced Thanksgiving to lend credibility and lower recipients’ suspicion.

Throughout 2025, Tycoon2FA (tracked by Microsoft as Storm-1747) has consistently been the most prolific phishing-as-a-service (PhaaS) platform observed by Microsoft. In October 2025, Microsoft Defender for Office 365 blocked more than 13 million malicious emails linked to Tycoon2FA.

Attackers are increasingly weaponizing trust in identity and code to achieve financial gain. msft.it/63326tTZxj

The Threat Intelligence Briefing Agent, which delivers daily briefings that combine Microsoft’s global threat intelligence with insights specific to each organization, is now fully integrated into the Microsoft Defender portal, available in public preview. msft.it/63329trKYc

Microsoft is introducing a dozen new and enhanced Microsoft Security Copilot agents in Microsoft Defender, Microsoft Entra, Microsoft Intune, & Microsoft Purview. Our partner community also released more than 30 new Security Copilot agents. msft.it/63323tR70T

The November 2025 security updates are available:

Microsoft has discovered a new type of side-channel attack on remote language models. This type of side-channel attack could allow an attacker in a position to observe network traffic to conclude language model conversation topics, despite end-to-end encryption. msft.it/63328tJAeu

Dive into the heart of threat intelligence as Principal Security Researcher Jonathan Bar Or reveals how proactive security research powers Microsoft’s defenses. msft.it/63325tJxpx

In the latest Microsoft Threat Intelligence Podcast episode, Sherrod DeGrippo and Zack Korman explore the future risks and opportunities that AI introduces in cybersecurity, cutting through hype to discuss where AI is both brilliant and flawed: msft.it/63329tyToL

Microsoft Incident Response – Detection and Response Team (DART) uncovered SesameOp, a new backdoor that uses the OpenAI Assistants API for command and control. DART shared the findings with OpenAI, who identified and disabled an API key and associated account. msft.it/63322tGbej

MapUrlToZone (MUTZ) drives several security decisions across Windows. This @msrc.microsoft.com blog sets out to understand MUTZ and its behavior more deeply, identify issues, and propose solutions to strengthen MUTZ against future bypasses:

Microsoft’s threat hunters are transforming cyber defense by seeking out emerging threats before they strike. Instead of waiting for alerts, these experts combine human intuition with AI-powered analysis to uncover malicious activity that others miss. msft.it/63321tBQRR

"Threats are accelerating, yet our defensive capabilities have never been stronger. The gap is not technology. The gap is in how we think about and operationalize security." -- Microsoft CVP and Deputy CISO @ajohnsocyber.bsky.social on the evolved CISO mandate. msft.it/63328sh6s6

This year’s Microsoft Digital Defense Report spotlights the rise of industrialized cybercrime and the increasing complexity of attacks, as adversaries pivot from traditional email-based threats to platforms like Teams, SMS, and WhatsApp. msft.it/63329sCxgf

Azure Blob Storage is a high-value target for threat actors due to its critical role in storing and managing massive amounts of unstructured data at scale across diverse workloads: msft.it/63324s7pFk

The Microsoft Digital Defense Report 2025 shows how threats are evolving faster than ever, fueled by AI. msft.it/63322sf3y4 Key insights from report include: - More than 50% of cyberattacks with known motives had financial objectives such as extortion or ransom.

In early October 2025, Microsoft disrupted a Vanilla Tempest campaign by revoking over 200 certificates that the threat actor had fraudulently signed and used in fake Teams setup files to deliver the Oyster backdoor and ultimately deploy Rhysida ransomware.

The October 2025 security updates are available: msft.it/6018SZEg0. #PatchTuesday #SecurityUpdateGuide

“Security begins and ends with people.” Learn how Microsoft has made security culture a company-wide imperative, reinforcing vigilance, embedding secure habits into everyday work, and achieving what technology alone cannot, via @ajohnsocyber.bsky.social: msft.it/63325sNpfJ

Microsoft Threat Intelligence has observed a financially motivated threat actor, Storm-2657, compromising employee accounts to gain unauthorized access to profiles and divert salary payments to attacker-controlled accounts. msft.it/63320sFB5j

The highly modular backdoor PipeMagic and the RaaS offering Medusa both exemplify how threats continuously evolve. The latest Microsoft Threat Intelligence Podcast episode features a threat landscape update with a deep dive on these threats: msft.it/63322s0k2o

Threat actors seek to abuse Microsoft Teams features and capabilities at different points along the attack chain. Learn about countermeasures and controls across identity, endpoints, data apps, and network layers to help harden enterprise Teams environments. msft.it/63328sLUZs

Storm-1175, a financially motivated actor known for deploying Medusa ransomware & exploiting public-facing applications, was observed exploiting the CVE-2025-10035 vulnerability in GoAnywhere MFT's License Servlet. Read our analysis & get detection+hunting guidance: msft.it/63325sIfZZ

The nature of incident response is its chaos, and the second chapter of our four-part Inside Microsoft Threat Intelligence miniseries displays how Microsoft’s IR team thrives amid disorder, stepping in when environments are compromised and confidence is shaken: msft.it/63322svfky

You can now build your own Security Copilot agents. The Security Copilot portal features a no-code agent builder that lets you describe what you need in natural language and create, optimize, and publish agents tailored to your workflows in minutes. msft.it/63325svuQL

Microsoft Sentinel is evolving into both the SIEM and the platform for agentic defense with the general availability of Sentinel data lake, and the public preview of Sentinel graph and Sentinel Model Context Protocol (MCP) server: msft.it/63327svJHJ

Microsoft Threat Intelligence has uncovered a new variant of the XCSSET malware, which is designed to infect Xcode projects, typically used by software developers building Apple or macOS-related applications. msft.it/63320sS0R0

Attackers are leveraging AI and bots to create phishing campaigns that are more tailored than ever. Using these tools for domain impersonation, typosquatting, and other tactics, attackers can tailor a phishing attack directly to one individual – and do that at scale. msft.it/63320sSdmM

Microsoft Threat Intelligence recently detected and blocked a credential phishing campaign that likely leveraged AI-generated code to obfuscate its payload and evade traditional defenses. msft.it/63323sSBWN

GitHub is strengthening npm security with stricter authentication, granular tokens, and enhanced trusted publication. This is in response to the surge of account takeovers on package registries like npm. msft.it/63325sqQ71

"Microsoft Threat Intelligence is fully focused on disrupting threat actor activity." The first of a four-part Inside Microsoft Threat Intelligence miniseries gives behind-the-scenes look at how Microsoft's Digital Crimes Unit disrupted Storm-1152: msft.it/63327sWnGF

Microsoft’s Digital Crimes Unit (DCU) has disrupted the phishing-as-a-service (PhaaS) platform RaccoonO365, seizing 338 related websites, disabling infrastructure, and disrupting communications between the criminal network and victims. msft.it/63324smYC2

The threat landscape is evolving, with longer, more complex attack chains and persistent adaptation by cybercriminals. msft.it/63327scEub

The September 2025 security updates are available: msft.it/6018SZEg0

Threat actors like Storm-0501 target Azure Storage accounts to exfiltrate data from compromised environments to external infrastructure under their control. During security breaches, Azure Storage logs provide invaluable insights for digital forensics: msft.it/63320s5Ig4

Microsoft's Quantum Safe Program (QSP) is a significant step in preparing for the quantum computing era with a security-first mindset. Learn about Microsoft QSP from @markrussinovich.bsky.social and Michal Braverman-Blumenstyk: msft.it/63323seseN

Recorded live at Black Hat 2025, this Microsoft Threat Intelligence Podcast dives into ransomware and the threat actor ecosystem, responsible vulnerability disclosure, bug bounties, and Zero Day Quest, and social engineering and AI. msft.it/63329swWwV

The financially motivated threat actor Storm-0501 has continuously evolved to achieve sharpened focus on cloud-based TTPs as their primary objective shifted from deploying on-premises endpoint ransomware to using cloud-based ransomware tactics. msft.it/63326sZC6E

The ClickFix social engineering technique has grown in popularity. This technique exploits users’ tendency to resolve technical issues by tricking them into running malicious commands that deliver payloads ultimately leading to information theft and exfiltration. msft.it/63321snbwF

PipeMagic is a sophisticated malware framework with a modular, stealthy, and highly extensible architecture, giving threat actors granular control over code execution and making detection and analysis challenging. msft.it/63321spbNh

The August 2025 security updates are available: msft.it/6018SZEg0

Real-time collaboration between incident response and threat intelligence teams is critical for mounting an effective defense against today’s cyber threats. The process relies on actionable intel to guide every step, from initial investigation to containment. msft.it/63322sOR1I

Project Ire, an autonomous AI agent, automates what’s considered the gold standard in malware classification: fully reverse engineering a software file without any clues about its origin or purpose: msft.it/63325sMSoc

A new Microsoft report finds that the long-running threat group has gained positions on state-aligned ISPs and Russian telecoms, while tricking foreign embassy staff to download custom malware. via @mattkapko.com cyberscoop.com/russia-secre...