Microsoft Defender Archives | Microsoft Security Blog

November 12 11 min read

Trained to betray: How post-training supply chain attacks hijack coding agents

Microsoft Defender Research and the AI Red Team discuss how poisoned datasets and poisoned model checkpoints can trigger remote code execution and other malicious activities.
November 11 12 min read

The global socket: how threat actors are weaponizing GSocket for stealthy C2

Threat actors are deploying GSocket on compromised Linux servers to keep encrypted remote access after the original vulnerability is patched.
November 11 7 min read

Lessons from 59 Linux Kernel Bug Reports

Microsoft FORGE Lab researchers used codename MDASH to investigate Linux kernel vulnerabilities, resulting in 59 upstream bug reports, 33 assigned CVEs, and 38 merged fixes.
November 9 16 min read

FORGE Lab uses agentic tools to identify memory safety issues in Rust

Microsoft FORGE Lab researchers found memory-safety bugs in Rust’s core and std libraries, including cases where safe Rust code can trigger undefined behavior.
Prevent threats with Microsoft Defender

The Microsoft Defender family offers comprehensive threat prevention, detection, and response capabilities for everyone—from individuals looking to protect their family to the world’s largest enterprises.

Explore products
$Photo of trading team \analyzing computer data$

November 6 8 min read

ARTEX abuse expands as cybercriminals target financial sector

In October 2026, the financially motivated threat actor Storm-3358 began targeting organizations in the financial sector using the agentic AI offensive framework ARTEX.
November 5 14 min read

Threat actors use agentic AI tooling to find and abuse exposed secrets

Microsoft Threat Intelligence has observed threat actors using the agentic offensive security framework ARTEX to search GitHub for OAuth application secrets, which can be used to compromise the associated OAuth application and perform authenticated actions in the application’s tenant.
November 5 4 min read

What’s new in Microsoft Security: November 2026

Microsoft Security’s November 2026 updates strengthen AI agent security, least privilege, threat protection, and exposure management.
November 5 17 min read

Email threat landscape: Q3 2026 trends and insights

Microsoft Threat Intelligence observed a sharp rise in email-based phishing activity at the end of Q3 2026 (July – September), even as QR code phishing declined, CAPTCHA-gated phishing recovered, and malicious messages spoofing familiar business-service sender domains exposed risks associated with security overrides.
Retain Microsoft Defender Experts

Microsoft Defender Experts are available to strengthen your teams with expertise when and where you need it. Learn how to elevate your security with expert-led services.

Get started
November 3 14 min read

Fake-download campaign uses trojanized installers to deliver monetization payloads

Microsoft Threat Intelligence tracks a fake-download campaign that uses trojanized Inno installers to deliver multiple monetization offers and provides detection and investigation guidance across the complete installer session.
November 3 3 min read

Microsoft named a Leader in the 2026 Gartner® Magic Quadrant™ for AI Agent Management Platforms 

Read why Gartner named Microsoft a Leader in the inaugural 2026 Magic Quadrant for AI Agent Management Platforms.
November 2 8 min read

What exploited vulnerabilities have in common: A data-driven analysis of real-world attacks

Real-world exploitation concentrates in a small, high-impact subset of CVEs.
October 30 11 min read

Inside a malicious Claude Code-branded extension and its persistent SSH backdoor

Microsoft analyzes a malicious Claude Code–branded extension, its persistent SSH backdoor, and guidance to detect and remediate it.