Microsoft Threat Intelligence

Real-world exploitation concentrates in a small, high-impact subset of vulnerabilities. Fewer than 1 in 200 published CVEs are typically used in real-world attacks, even as the vulnerability landscape continues to expand. msft.it/6017aNmUv Threat actors disproportionately target flaws that enable system takeover, including remote code execution, privilege escalation, and authentication bypass, to establish footholds and support subsequent stages of an attack. AI-assisted vulnerability discovery and exploit development could further shorten defenders’ response window. Defenders should prioritize both exploitation likelihood and potential blast radius, focusing protection on critical, highly exposed systems where compromise could have the greatest downstream impact. Read the full analysis from Microsoft Security Research team to learn more.

On October 29, 2026, Cursor reported that a tampered copy of Claude Code extension (anthropic.claude-code, version 2.1.313 and 2.1.312) was available and served on the Cursor extension marketplace for a few hours. msft.it/6019aF20x Microsoft has confirmed that the malicious packages found on Cursor marketplace were never published nor distributed from the Microsoft Visual Studio Marketplace extension and the npm anthropic-ai/claude-code, which were not affected by this incident. Anthropic confirmed to Microsoft that their systems were not compromised and they did not develop the malicious package posted in Cursor marketplace. At this time, all evidence suggests that the incident is limited to the Cursor marketplace. Microsoft Threat Intelligence analyzed the JavaScript embedded into the malicious extension package. The injected loader runs when the extension module loads and attempts to add an attacker-controlled Secure Shell (SSH) key, enable the local SSH service, establish reverse SSH forwarding, configure persistence, and report host details. Successful remote access depends on host privileges, SSH configuration, and the attacker’s server configuration; however, the loader may still write keys and persistence artifacts even when tunnel access fails. Read the blog for technical analysis and guidance on identifying affected systems, investigating endpoint and network activity, and removing confirmed malicious SSH keys and persistence artifacts.

Patch now: PHP2Shell, Brotli, and eMudhra guidance for customers msft.it/6010aFLKw

Recorded live at Black Hat, part two of this episode examines how defenders respond to identity compromise, from credential theft and MFA bypasses to containment, recovery, and the emerging security challenges posed by AI. msft.it/6010aFiCs Microsoft incident response experts Adrian Hill and Terry Mee share lessons from investigating real-world attacks, offering practical insights into the visibility and controls needed to limit attacker access and reduce risk. Microsoft’s Defender Purple Team discusses recreating complete attack chains to identify detection gaps and strengthen defenses, while also exploring how AI is changing both security research and the threat landscape. Learn more on this episode of the Microsoft Threat Intelligence Podcast, hosted by Elliot Volkman.

Microsoft Threat Intelligence investigated two human-operated intrusions in which threat actors impersonated IT or help desk personnel via Teams messages and calls, tricking users into granting interactive remote access, primarily through Quick Assist. msft.it/6010aFi3j Once connected, the threat actors staged portable Python, Bun, or Java runtimes, performed host and network discovery, and assessed Active Directory Certificate Services (AD CS) for certificate-based authentication paths through ESC1 template abuse or ESC8 authentication relay. These paths show how a user-approved remote session can lead to certificate-backed access to privileged identities and domain infrastructure, and why comprehensive containment matters. Read the blog for technical analysis, investigation guidance, mitigations, detections, and hunting queries.

AI adoption by North Korean threat actors largely supports existing goals and targeting priorities, including generating revenue for the regime, collecting strategic intelligence, and, in some cases, pursuing politically motivated disruptive or destructive objectives, rather than representing a shift in actor motivations. msft.it/6010a0LAm Recent activity by these threat actors illustrates AI-enabled acceleration and scaling: - Jade Sleet launched campaigns through three front companies in a single week - Onyx Sleet generated dozens of tailored lures in minutes - Coral Sleet rapidly built a new capability to trojanize private source code repositories - Diamond Sleet used AI to enhance tailored targeting workflows, including persona development and front company creation - Pearl Sleet and Onyx Sleet have been leveraging the open-source agentic AI penetration testing framework ARTEX to conduct operations Our latest blog breaks down how North Korean threat actors are utilizing AI across their operations, and provides mitigation guidance and Microsoft Defender detections to help organizations defend against these threats.

Microsoft Senior Security Program Manager Karina Sirota Goodley joins the Microsoft Threat Intelligence Podcast to examine the ecosystem-wide challenges of preparing certificates and trust systems for post-quantum cryptography. msft.it/6011a0zbh Karina discusses how Microsoft’s post-quantum certificate pilot brings certificate authorities together to test issuance, compatibility, performance, and lifecycle assumptions. The work shows how minor constraints or one unsupported component can disrupt an end-to-end trust chain. Organizations can begin by inventorying certificates, keys, libraries, algorithms, hard-to-update systems, and vendor dependencies. Hear why industry testing and collaboration are critical to understanding cryptographic risk and preparing for what comes next.

A compromised LiteLLM 1.107.0 release added files that Python could execute during normal interpreter initialization. Applications did not need to import LiteLLM for the payload to run; starting Python in an affected environment could be enough. msft.it/6012axjt8 Microsoft analyzed two execution paths: a credential collector targeting authentication material across developer tools, cloud environments, browsers, and infrastructure, and a Unix-oriented loader capable of retrieving and executing additional Python code. Endpoint observations on Windows and macOS matched the collector’s discovery, encryption, and outbound connection behavior. Starting Python in an affected environment could activate the payload, so investigators should avoid using Python or pip during evidence collection. Read the Microsoft Security research for analysis of the startup mechanisms, credential exposure, Defender detections, hunting queries, indicators of compromise, and recovery guidance.

The China state-aligned threat actor Storm-0940 used the agentic AI penetration testing framework ARTEX to automate attacks targeting hundreds of organizations globally across a broad range of industries. Microsoft Threat Intelligence assesses that Storm-0940 was responsible for the recently disclosed ConnectWise supply chain compromise of a multitenant application. msft.it/6018aakEE Our investigation found that Storm-0940's use of ARTEX accelerated the speed of compromised application abuse to authenticate to target environments through applications that had already been granted access, allowing the threat actor to operate without requiring an interactive user sign-in. AI-accelerated follow-on activity included reconnaissance, application credential changes, and attempts to modify privileges that could enable expanded or persistent access. Read our blog for a detailed analysis and indicators of compromise (IOCs), along with Microsoft Defender detections, protection recommendations, and guidance on investigating service principal sign-ins and unexpected application credential or privilege changes.

The October 2026 security updates are available. In addition, starting today, Microsoft is publishing Vulnerability Exploitability eXchange (VEX) statements for all Microsoft-assigned CVEs. Learn more: msft.it/6013aSA6V

Post-quantum cryptography readiness goes beyond protecting encrypted data. Authentication systems must evolve, too, and organizations should start preparing now. msft.it/6012aUw5n Organizations can begin inventorying certificate dependencies, assessing vendor roadmaps, identifying long-lived infrastructure, and creating non-production test environments. Early testing can surface compatibility and process gaps before post-quantum authentication is required at scale. Read the blog for practical guidance and learn how Microsoft’s PQC TLS Pilot Program supports eligible certificate authorities in controlled, non-production testing.

AI is accelerating familiar threats while giving defenders new ways to respond. This is a central theme of the 2026 Microsoft Digital Defense Report (MDDR), discussed in this episode of the Microsoft Threat Intelligence Podcast. msft.it/6019aoYQR Elliot Volkman speaks with Chloé Messdaghi, MDDR lead, and Karen Frost, Principal Security Researcher, about the intelligence behind the report’s findings and what they mean for security leaders. The conversation examines how AI is changing the speed, scale, and sophistication of threat actor activity, while noting that human direction still plays a meaningful role in attacks. For defenders, the discussion emphasizes the importance of connecting signals rather than simply collecting more of them. Correlating activity across identities, systems, and infrastructure can provide a fuller picture of an intrusion, while AI can help teams process threat information and detect, analyze, and respond at greater scale. For security leaders, the episode connects these findings to practical priorities, including phishing-resistant multifactor authentication, incident response plans, and governance and data access controls for AI. Listen to the podcast episode to hear more about understanding dependencies across an organization’s ecosystem and measuring security progress through risk reduction, not just the volume of security activity. Read the full 2026 Microsoft Digital Defense Report: msft.it/6010aoYQr

Storm-2945, a sub-cluster of the Russian state actor Midnight Blizzard, has resumed their CaptiveCrunch campaign. msft.it/6019aWMDf First reported by Microsoft Threat Intelligence in July 2026, the campaign uses manipulated network traffic and captive portals in the hospitality sector to gain access to targets. The renewed activity is consistent with reporting from Black Lotus Labs suggesting that multiple managed service providers are implicated; Storm-2945’s continued access to these upstream providers has likely enabled this rapid re-deployment. We have updated our blog to provide more recent network infrastructure indicators, detections, and hunting guidance. We want to thank Google Threat Intelligence Group (GTIG) for their collaboration on tracking the reemergence of this activity.

Microsoft Threat Intelligence has identified a cluster of compromised websites leading to ClickFix attacks. Instead of downloading and executing remote payloads like the typical attack pattern, in this attack, the websites pre-fetch a script payload into the browser cache disguised as a PNG file. When a user is later tricked into executing the malicious command, the cached website content is already on the device, loaded, and ready to be executed. This helps to hide the payload script and helps bypass the character limit of the Run dialog. ClickFix attacks persuade users to execute attacker-supplied commands under the guise of verification or repair. In this specific campaign, a fake lure instructs users to open Windows Run, paste clipboard content and press Enter. The injected page uses browser caching to stage the larger VBScript payload separately from the Run command. The command invokes cmd.exe to recursively enumerate files whose names start with "f_” in the browser’s profile folder such as %LOCALAPPDATA%\Mozilla\Firefox\Profiles. It compares each file’s byte length with an expected value. Rather than searching for a marker within the contents like previous attacks, it copies a size-matching cache entry to %LOCALAPPDATA%\Temp\t.vbs, giving the cached payload a VBScript extension, then executes it with wscript.exe. Copy output and errors are suppressed. The expected size varies across variants. The VBScript collects host information through WMI, retrieves v.ps1 from cocojambo[.]us[.]com/alfa, and launches PowerShell without a profile and with execution-policy bypass. A later PowerShell stage downloads the next-stage payload as cab.dat, then reads and executes its contents in a hidden window. The PowerShell stage triggers .NET compilation using csc.exe and cvtres.exe, then launches timeout.exe. Subsequent payloads load .NET assemblies into memory and inject code into timeout.exe to target browser and device credentials. The injected process launches PowerShell to retrieve another in-memory stage from capsysnet[.]vg and makes outbound connections to ciliabula[.]cc. The payload modifies the per-user PowerShell registry configuration to use the Bypass execution policy, then unpacks Python with tar.exe and creates a scheduled task that launches a Python payload through pythonw.exe for persistence. Microsoft Defender provides layered protection across the ClickFix attack chain. Defender SmartScreen and Defender for Office 365 help block malicious sites, links, attachments, and fake CAPTCHA lures, while Defender for Endpoint detects suspicious command execution and outbound connections through alerts like “Possible ClickFix activity”. Defender Antivirus blocks malicious command execution as Trojan:Win32/ClickFix and Trojan:Win32/TermFix. Microsoft recommends cloud-delivered, web, and network protection, application control, and PowerShell script-block logging. Hunt across browser activity, RunMRU registry key, WScript/PowerShell child processes and scheduled tasks, not download events alone. A CAPTCHA should not ask users to run code. Users shouln not paste commands from verification prompts into Run, Terminal or PowerShell and should treats such requests as potential initial access attempts.