Microsoft Threat Intelligence engagement report

Best tweets

• Aug 4, 202610x their median

  Microsoft Threat Intelligence is tracking active Mini Shai-Hulud npm supply chain attacks in which a threat actor compromised trusted maintainer accounts to distribute credential-stealing malware. Compromised packages (confirmed malicious) include: - [email protected] - [email protected] - [email protected] - [email protected] - qlik/[email protected] - cacheable/memory, /utils, /net - 17+ servicetitan/* packages (eslint-config, anvil-themes, table, form, log-service, etc.) In this attack, a malicious preinstall hook launches an obfuscated dropper (setup.mjs) that downloads a Bun binary from GitHub and executes a credential-stealing payload, either Math_Symbol.js or Math_Init.js. The payload is a Mini Shai-Hulud variant, a self-propagating npm supply-chain malware family. It harvests npm, GitHub, cloud and continuous integration (CI) credentials, exfiltrates collected secrets, and uses stolen publishing access to inject itself into package tarballs, increment their versions and republish the compromised releases. Microsoft observed the same pattern across all affected packages, suggesting a single actor using multiple stolen tokens. Microsoft Defender for Endpoint customers should act on these alerts: “Trojan:npm/MalBun.A”

  1.1K23943461.3M viewsView on X
• Oct 3, 20266.0x their median

  Microsoft Threat Intelligence has identified a cluster of compromised websites leading to ClickFix attacks. Instead of downloading and executing remote payloads like the typical attack pattern, in this attack, the websites pre-fetch a script payload into the browser cache disguised as a PNG file. When a user is later tricked into executing the malicious command, the cached website content is already on the device, loaded, and ready to be executed. This helps to hide the payload script and helps bypass the character limit of the Run dialog. ClickFix attacks persuade users to execute attacker-supplied commands under the guise of verification or repair. In this specific campaign, a fake lure instructs users to open Windows Run, paste clipboard content and press Enter. The injected page uses browser caching to stage the larger VBScript payload separately from the Run command. The command invokes cmd.exe to recursively enumerate files whose names start with "f_” in the browser’s profile folder such as %LOCALAPPDATA%\Mozilla\Firefox\Profiles. It compares each file’s byte length with an expected value. Rather than searching for a marker within the contents like previous attacks, it copies a size-matching cache entry to %LOCALAPPDATA%\Temp\t.vbs, giving the cached payload a VBScript extension, then executes it with wscript.exe. Copy output and errors are suppressed. The expected size varies across variants. The VBScript collects host information through WMI, retrieves v.ps1 from cocojambo[.]us[.]com/alfa, and launches PowerShell without a profile and with execution-policy bypass. A later PowerShell stage downloads the next-stage payload as cab.dat, then reads and executes its contents in a hidden window. The PowerShell stage triggers .NET compilation using csc.exe and cvtres.exe, then launches timeout.exe. Subsequent payloads load .NET assemblies into memory and inject code into timeout.exe to target browser and device credentials. The injected process launches PowerShell to retrieve another in-memory stage from capsysnet[.]vg and makes outbound connections to ciliabula[.]cc. The payload modifies the per-user PowerShell registry configuration to use the Bypass execution policy, then unpacks Python with tar.exe and creates a scheduled task that launches a Python payload through pythonw.exe for persistence. Microsoft Defender provides layered protection across the ClickFix attack chain. Defender SmartScreen and Defender for Office 365 help block malicious sites, links, attachments, and fake CAPTCHA lures, while Defender for Endpoint detects suspicious command execution and outbound connections through alerts like “Possible ClickFix activity”. Defender Antivirus blocks malicious command execution as Trojan:Win32/ClickFix and Trojan:Win32/TermFix. Microsoft recommends cloud-delivered, web, and network protection, application control, and PowerShell script-block logging. Hunt across browser activity, RunMRU registry key, WScript/PowerShell child processes and scheduled tasks, not download events alone. A CAPTCHA should not ask users to run code. Users shouln not paste commands from verification prompts into Run, Terminal or PowerShell and should treats such requests as potential initial access attempts.

  6711562015118K viewsView on X
• Aug 7, 20262.5x their median

  On August 2, 2026, the financially motivated cybercriminal actor tracked by Microsoft Threat Intelligence as Storm-1175 began deploying a new ransomware strain called StormEncryptor. Storm-1175’s deployment of StormEncryptor marks the threat actor’s first activity observed by Microsoft Threat Intelligence since April 2026, and a shift away from Medusa ransomware, which the threat actor had previously been known to use. StormEncryptor is written in C++ and appends the file name extension .encrypted to files it encrypts. It then drops a ransom note named !!!README_FIRST!!!.txt to every scanned directory. While Microsoft has not confirmed the vulnerability targeted by Storm-1175 in this campaign, the threat actor is likely exploiting the CVE-2026-18577 authentication bypass vulnerability in N-able, which was disclosed on August 2, 2026 and added to the Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities (KEV) catalog on August 3, 2026. Storm-1175 is known to operate high-velocity ransomware campaigns that weaponize N-days, taking advantage of the window between vulnerability disclosure and patch adoption. https://t.co/9M5JmnGWWL In this new activity, Storm-1175’s post-compromise behavior includes abuse of remote monitoring and management tools AnyDesk or SimpleHelp, Advanced IP Scanner for discovery, and LSASS dumping using Mimikatz. This threat actor is known to rapidly move from initial access to data exfiltration and ransomware deployment, often within a few days. Organizations are urged to monitor for Storm-1175 activity and apply security patches as soon as possible. Microsoft Defender Antivirus detects StormEncryptor (SHA-256: c19ded65e822bb43ad0381c58abf33b7c8890f7bcc7125058a0c849c7e1a6054) as Ransom:Win64/StormEncryptor. Microsoft Defender for Endpoint detects this activity through multiple alerts, including “Hands-on-keyboard attack involving multiple devices” and “Potential human-operated malicious activity”.

  278606728K viewsView on X
• Aug 19, 20261.8x their median

  Microsoft Defender is monitoring the active exploitation of the CVE-2026-65400 improper authentication vulnerability on a limited number of macOS devices, with telemetry showing successful root account network sign-ins through Screen Sharing. Microsoft urges customers to immediately apply security updates and to investigate related Microsoft Defender alerts and detections. After gaining access, the attackers transferred files (scripts and a Secure Shell (SSH) public key) to the devices through Screen Sharing, established SSH persistence, removed histories and logs, modified Packet Filter settings, and deployed the cryptocurrency miner XMRig 6.26.0. They copied and ad-hoc signed XMRig as a hidden .config/sysmond binary, masqueraded it as com[.]apple[.]airportd, and persisted it with a KeepAlive LaunchDaemon. Indicators of compromise (IOCs): - SHA-256: 84006055916e267f7c2f9324f1848563e589e4526a296d4e9e9ce8e2112d357c (customized XMRig binary produced on multiple affected devices after the stock miner binary was copied, renamed to sysmond, and ad-hoc signed) - /private/var/root/.config/sysmond (hidden path used for the customized miner) - /Library/LaunchDaemons/com.xmr.miner.plist (malicious RunAtLoad and KeepAlive persistence) - exec -a com[.]apple[.]airportd (command-line masquerading used to present the miner as an Apple process) - 4AUZ9XNsffcPn13Yjk5yWAaZg8x5Fgu9cL9kWwDCnmACUFLuwrLg41WU31qiKfmo9ee62mVbwG9F5G82Ko8vck8nCtxdicj (Monero wallet reused across the observed deployments) - auto[.]c3pool[.]org:443 (mining-pool endpoint used by the miner; treat as contextual because mining pools may also receive legitimate traffic) The stock XMRig binary and its legitimate GitHub release URL should not be treated as malicious without the surrounding adversary technique context. Microsoft Defender alerts and detections: - 'CoinMiner' malware was prevented (Investigate retained SSH access, hidden miner copies, and com.xmr.miner.plist, even when quarantine succeeds) - Suspicious file or content ingress (Inspect the responsible process, destination, signing state, and nearby persistence) - Suspicious connection to remote service (Investigate unexpected root SSH sessions and sshd-session -i -R) When hunting, higher-confidence signals combine root-level Screen Sharing file transfer activity through SSFileCopyReceiver with writes to privileged .ssh, /private/etc, hidden /private/var/tmp, or LaunchDaemon paths. Microsoft recommends updating macOS to at least Tahoe 26.6.1, Sequoia 15.7.9, or Sonoma 14.8.9; disabling unnecessary Screen Sharing; blocking untrusted TCP/5900 access; inspecting SSH keys and LaunchDaemons; removing unauthorized persistence; and rotating affected credentials.

  184626544K viewsView on X
• Jun 17, 20261.5x their median

  Microsoft has identified a supply chain attack on the Mastra-AI npm ecosystem, with 80+ packages compromised through npm account takeover. The attacker introduced a phantom dependency into the compromised packages. The malicious dependency was published by a single anonymous maintainer less than 24 hours ago. The compromised [email protected] adds the dependency easy-day-js@^1.11.21 (typosquat of "dayjs"), which resolves to v1.11.22. The post-install script runs node setup.cjs, which downloads and executes a remote payload. The post-install script in [email protected]: 1. Bypasses TLS: Disables SSL verification (NODE_TLS_REJECT_UNAUTHORIZED=0) to communicate with attacker C2 without certificate errors 2. Writes tracking files: Creates ~/.pkg_history (infected machine path) and ~/.pkg_logs (XOR-encoded marker) to prevent re-infection 3. Downloads hidden payload: Fetches second-stage .js from 23[.]254[.]164[.]92:8000/update/49890878 4. Executes as invisible process: Spawns downloaded payload with C2 endpoint 23[.]254[.]164[.]123:443 passed as argument, runs detached and hidden (windowsHide=true) 5. Covers tracks: Deletes setup.cjs to remove all evidence of initial infection This attack affects [email protected], mastra/pg, mastra/mcp, mastra/schema-compat, mastra/ai-sdk, mastra/rag, and 80+ other packages. Microsoft Defender for Endpoint customers should monitor and act on alerts with Trojan:JS/ObfusNpmJs in the title. Customers can also check for the following IOCs: - ls ~/.pkg_history ~/.pkg_logs - random .js files in home/temp directory Users are advised to downgrade to previous versions immediately, use [email protected] explicitly, and use lockfiles.

  165451312115K viewsView on X
• Jul 28, 20261.6x their median

  Microsoft released security updates on July 14, 2026, to address CVE-2026-54121 (Certighost), an elevation-of-privilege vulnerability in Active Directory Certificate Services (AD CS). An authenticated, low-privileged attacker with network access could manipulate certificate enrollment to impersonate a Domain Controller, potentially enabling privileged operations and full domain compromise. Exploitation requires no administrative privileges or user interaction, but does require network access and a valid domain account. The publication of proof-of-concept code increases the likelihood of exploitation attempts, so we recommend customers prioritize installing the July 2026 security update as soon as possible. Microsoft has observed researcher testing activity but has not confirmed active exploitation by threat actors. In response to these early signs of activity, we are sharing detection and hunting guidance to help defenders identify potential exploitation attempts, particularly in environments where the security update has not yet been applied. Microsoft Defender detects malicious certificate requests associated with this vulnerability and generates the alert: - “Potential Certighost (CVE-2026-54121) AD CS abuse.” - "Active Directory Certificate Services attack tool activity " Other alerts, including the following, may also appear during the attack chain. These signals support investigation but are not independently specific to Certighost. - Security principal reconnaissance (LDAP) - Suspicious Active Directory Certificate Services abuse tool activity - Suspected suspicious Kerberos ticket request - DCSync attack (replication of directory services) Customers should apply the July 14, 2026 security update to every server running an Enterprise Certification Authority (CA). The security update provides the primary protection by validating the enrollment chase target before the CA contacts it, preventing invalid or attacker-controlled systems from influencing certificate issuance. Customers who can't apply the July 14, 2026 security update immediately for all affected servers, should consider configuring the following audit logs to enable the mentioned detections and forensic: - Enable Certification Services auditing for both successful and failed operations. - Configure the CA audit filter to capture certificate lifecycle activity. - Monitor Security events 4886 and 4887 for anomalous certificate requests and issuance. - Investigate certificates requested through machine templates that contain unexpected Domain Controller identity information.

  185442227K viewsView on X
• Sep 9, 20261.6x their median

  Microsoft Security Research is tracking active cloud-based intrusions spanning multiple accounts in which unusual sign-ins are followed by threat actor-added authentication methods, high-volume Microsoft Graph activity, and cloud data access. https://t.co/TdVviAPxQH The activity begins with identity-focused social engineering, progresses through authentication persistence and cloud reconnaissance, and is followed by targeted data access consistent with data collection and potential exfiltration. Microsoft Threat Intelligence assesses that the initial access activity observed in this campaign is used by multiple threat actors, including Storm-3121, Storm-3032, and others. Defenders should focus on the behavioral sequence rather than individual indicators. Monitor for unusual sign-ins, authentication method changes, Microsoft Graph reconnaissance, and abnormal cloud data access. Read the research for detections and hunting guidance.

  176482218K viewsView on X
• Sep 2, 20261.6x their median

  Microsoft Threat Intelligence is tracking a human-operated intrusion campaign in which attackers are impersonating IT personnel & abusing external Teams collaboration to gain remote access and deploy a Node.js implant for persistent command execution & C2. https://t.co/DXLX2CVukP After establishing access, the attackers use trusted tooling to perform reconnaissance, capture screenshots, execute follow-on payloads, and move laterally toward domain controllers, certificate authorities, and other high-value systems. Organizations should restrict Teams external access to trusted domains, reinforce user education, and harden systems against social engineering. Read the blog for analysis, Microsoft Defender coverage, indicators, hunting queries, and mitigation guidance.

  160573622K viewsView on X
• Aug 28, 20261.5x their median

  Microsoft Security Research is investigating a TerminalFix campaign, a variant of the ClickFix technique, that leads to a reverse-tunnel implant capable of providing network-level proxy access through a compromised host. This TerminalFix campaign uses fake CAPTCHA verification prompts to facilitate user-executed PowerShell commands. Beyond the initial lure, this campaign uses DLL sideloading through LockScreenContentServer.exe, steganographic payload delivery, and persistence mechanisms. It then performs extensive reconnaissance to identify reachable systems and key infrastructure. Organizations should investigate devices where users interacted with suspicious CAPTCHA verification prompts and look for unusual execution of LockScreenContentServer.exe, hidden ProgramData folders, and outbound connections associated with the activity. Additional guidance and technical analysis will be published soon by Microsoft Security Research.

  162523319K viewsView on X
• Sep 3, 2026

  Microsoft Security Researchers observed a high-volume phishing campaign using invisible Unicode tag characters, a technique popularized by AI prompt injection research as ASCII smuggling, to obscure financial lure words before email filters parsed them. https://t.co/RWGnm8a50r Microsoft telemetry linked the technique to a large-scale finance-themed phishing operation that persisted for months, using hundreds of rotating sender domains and consistent infrastructure patterns. The research shows how techniques popularized in AI security research can quickly cross into traditional phishing campaigns as threat actors adapt tradecraft across domains. Learn how to identify this activity and strengthen detection against similar tradecraft.

  160369620K viewsView on X

Ranked by total interactions across everything we have tracked for this account, which is a longer history than the 30-day window the rates above use. The multiple compares each post to this account's own median.

Keep going