SCKit abuses ScreenConnect to deploy remote access and target technician sessions
SCKit abuses ScreenConnect to deploy unauthorized remote access and target technicians.
Actionable threat insights
Get timely insights into emerging vulnerabilities, first‑finder discoveries, and evolving cyberattacker behaviors. Explore deep research and real‑world Microsoft Defender scenarios that show how proactive detection and quick action help organizations prevent compromise.
Filtered by
Actionable threat insights
Refine results
Sort By
Content Type
Topic
Threat intelligence
Products and services
Publish date
-
-
Trained to betray: How post-training supply chain attacks hijack coding agents
Microsoft Defender Research and the AI Red Team discuss how poisoned datasets and poisoned model checkpoints can trigger remote code execution and other malicious activities. -
The global socket: how threat actors are weaponizing GSocket for stealthy C2
Threat actors are deploying GSocket on compromised Linux servers to keep encrypted remote access after the original vulnerability is patched. -
Lessons from 59 Linux Kernel Bug Reports
Microsoft FORGE Lab researchers used codename MDASH to investigate Linux kernel vulnerabilities, resulting in 59 upstream bug reports, 33 assigned CVEs, and 38 merged fixes. Retain Microsoft Defender Experts
Microsoft Defender Experts are available to strengthen your teams with expertise when and where you need it. Learn how to elevate your security with expert-led services.
-
FORGE Lab uses agentic tools to identify memory safety issues in Rust
Microsoft FORGE Lab researchers found memory-safety bugs in Rust’s core and std libraries, including cases where safe Rust code can trigger undefined behavior. -
Threat actors use agentic AI tooling to find and abuse exposed secrets
Microsoft Threat Intelligence has observed threat actors using the agentic offensive security framework ARTEX to search GitHub for OAuth application secrets, which can be used to compromise the associated OAuth application and perform authenticated actions in the application’s tenant. -
Email threat landscape: Q3 2026 trends and insights
Microsoft Threat Intelligence observed a sharp rise in email-based phishing activity at the end of Q3 2026 (July – September), even as QR code phishing declined, CAPTCHA-gated phishing recovered, and malicious messages spoofing familiar business-service sender domains exposed risks associated with security overrides. -
Fake-download campaign uses trojanized installers to deliver monetization payloads
Microsoft Threat Intelligence tracks a fake-download campaign that uses trojanized Inno installers to deliver multiple monetization offers and provides detection and investigation guidance across the complete installer session. Modernize your Security Operations Center with Microsoft Sentinel
Microsoft Sentinel is a cloud-native SIEM solution powered by AI and automation that delivers intelligent security analytics across your entire enterprise.
-
What exploited vulnerabilities have in common: A data-driven analysis of real-world attacks
Real-world exploitation concentrates in a small, high-impact subset of CVEs. -
Inside a malicious Claude Code-branded extension and its persistent SSH backdoor
Microsoft analyzes a malicious Claude Code–branded extension, its persistent SSH backdoor, and guidance to detect and remediate it. -
From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths
Teams support impersonation led to remote access, malicious runtime execution, and Certificate Services abuse through authentication relay and Kerberos. -
Inside the LiteLLM 1.107.0 supply chain compromise: Credential theft through Python startup hooks
Microsoft Threat Intelligence analyzes the LiteLLM 1.
