Microsoft Threat Intelligence

Microsoft tracks Storm-3350, a Brazil-focused activity cluster observed since October, primarily affecting organizations in financial services, payments, banking, and digital assets. Microsoft-observed activity has also affected healthcare, transportation, and logistics. Storm-3350 uses an identity-first cloud intrusion pattern that can begin with voice phishing (vishing) or identity-focused impersonation. In confirmed activity, the actor reset an account password through Microsoft’s legitimate self-service password-reset flow, signed in within minutes, completed the account’s existing SMS or voice multifactor authentication (MFA) challenge, and registered an actor-controlled Microsoft Authenticator method. This suggests an ability to intercept or receive codes sent to the registered phone number, potentially through social engineering involving employees’ personal phones. The new method provides persistent access without continued dependence on the victim or their phone. After account takeover, Storm-3350 conducts reconnaissance and high-volume cloud-data collection across Microsoft Graph, Microsoft 365, and Azure, identifying high-value identities, applications, sites, drives, mailboxes, and sensitive content. This activity combines browser access with Python- and Node-style automation, OAuth-authenticated curl activity, and Azure CLI enumeration. Storm-3350’s observed activity also included searching SharePoint for “AKIA” and accessing .key, .pem, and .ppk files. In Azure, the actor requested storage-account keys and application publishing profiles, which could enable access to additional cloud resources. Together, these actions point to possible routes beyond the compromised account. Defenders should investigate the full sequence rather than isolated events: password reset; immediate sign-in using existing MFA; authentication-method registration; anomalous token acquisition; Microsoft Graph and Azure control-plane reconnaissance; SharePoint, OneDrive, and mailbox discovery; sensitive-content searches; credential requests; and high-volume retrieval or download. Relevant detections include: - Suspicious Azure List Keys activities related to the List Keys operation - Anomalous token acquisition followed by high-volume SharePoint file activity - Graph API activity from a Microsoft threat intelligence IP address - Mass SharePoint or OneDrive file access after an MFA method change - Automated mass SharePoint/OneDrive file access via python-httpx - Suspicious mass download from risky or unusual session Microsoft tracks Storm-3350 separately within a broader financially motivated identity-compromise and cloud-data-theft ecosystem. Because related clusters share tactics, infrastructure patterns, and operational dependencies, no single IP, domain, or lure theme should be treated as conclusive actor attribution.

The November 2026 security updates are available:

Microsoft’s FORGE Lab identified several memory-safety issues in Rust's core and std libraries, including cases where code written entirely in safe Rust can trigger undefined behavior. msft.it/6017aCZh7 The research examines three recurring patterns of misplaced trust in unsafe code: trusting code not to panic, trusting user-provided implementations to be correct, and trusting the underlying system. Findings include issues affecting iterator cloning, string replacement, and interactions with the operating system. Using Hyenas, FORGE's research version of codename MDASH, researchers combined AI-assisted vulnerability discovery with technical investigation and validation. They investigated the underlying code, reproduced the bugs, assessed potential security impact, and worked with Rust maintainers to report and fix them. While Rust's ownership model and type system prevent entire classes of memory-safety vulnerabilities, unsafe implementations underneath safe APIs must still uphold those guarantees. The findings illustrate how subtle mistakes in foundational libraries can lead to undefined behavior, and why Rust's safety model remains important even when bugs are discovered. Read the analysis for details on the findings, root causes, upstream fixes, and lessons for developers working with unsafe Rust.

Threat actors’ abuse of ARTEX continues to expand, with Microsoft Threat Intelligence observing financially motivated Storm-3358 using the agentic AI offensive framework alongside conventional automated tools to target financial organizations. msft.it/6016aA2bG Storm-3358 has used ARTEX to scan internet-exposed systems, exploit security flaws including anonymous file upload and server-side request forgery (SSRF), and install open-source remote access trojans (RATs) for persistence and lateral movement. This activity illustrates a continuing trend of threat actors using agentic AI penetration testing frameworks to accelerate attack chains. Read our latest blog to get indicators of compromise (IOCs), along with mitigation, detection, and hunting guidance.

Microsoft Threat Intelligence has observed threat actors using agentic AI tools to search public GitHub repositories for exposed secrets and then using stolen secrets for further malicious activity against the compromised organization. msft.it/6017aA1bS Searching open code repositories for exposed credentials, secrets, keys, and other authentication material is a well-documented technique, but agentic tooling like ARTEX allows threat actors to scale and accelerate scanning for secrets, analyzing the output, and conducting follow-on attacks. Microsoft has also investigated follow-on activity related to successful service principal sign-ins involving multiple application IDs, including cases where a single multitenant application credential was used across multiple tenants. The threat actor used the compromised credentials for cloud resource discovery, and credential and data exfiltration. Microsoft encourages organizations to scan their code for secrets. In addition to removing the secrets from the code base, affected organizations should immediately rotate any exposed keys or credentials. Read our blog for more details, detections, and guidance for public monitoring and reducing exposure.

Amid conflicting reports about PHP2Shell, understanding exposure and conditions for exploitation helps defenders prioritize patching. This Microsoft Threat Intelligence Podcast episode brings together exploit research & IR perspectives on PHP2Shell. msft.it/6014aABdn Elliot Volkman speaks with Carly Sherrod, Director of Security Research at Microsoft Incident Response, and Spencer McIntyre, Director of Exploit Development at VulnCheck, about the research and response behind PHP2Shell. At the time of recording, Carly described seeing numerous malformed HTTP requests but limited evidence of successful remote code execution within her team’s incident response work, even as exploitation had been reported in the wild. Spencer explains why many early proofs of concept did not work in realistic production environments, and why an exploit that works against one application does not necessarily work against another. The discussion connects understanding PHP exposure with identifying critical business systems, reviewing telemetry for signs of compromise, and prioritizing patching. Hear more about assessing PHP2Shell risk and making evidence-based response decisions.

Q3 (July – September) 2026 showed how familiar business workflows can undermine technical signals: attackers spoofed trusted service domains, exploited security overrides, and disguised phishing and malware as routine workplace requests. msft.it/6017aftFJ Microsoft detected approximately 129 million malicious messages spoofing familiar business-service sender domains. Many were associated with organization- or user-configured exception overrides, even after being flagged as malicious, highlighting how overly broad exceptions can also expose workflows to impersonation. Two campaigns show how familiar work requests supported account compromise and malware delivery: personalized salary review documents led to device code phishing, while purchase order and payroll lures delivered Agent Tesla malware. Learn more about email-based phishing threat trends from Q3 and get detections, mitigations, and hunting guidance from this Microsoft Threat Intelligence blog post.

Microsoft Security Research has identified a fake-download campaign targeting users searching for cracked software, free games, plugins, and other utilities to distribute trojanized installers that can monetize compromised devices in three different ways: msft.it/6012a4u2w - Routing third-party internet traffic through the compromised devices - Enrolling devices in a distributed-computing platform - Installing additional utility software The trojanized Inno Setup-style installers launch executable payloads staged in temporary directories and track each component’s installation outcome separately. A failed or blocked installation does not necessarily stop the rest of the bundle. Organizations can reduce exposure to this activity by blocking the use of untrusted software sources, enabling potentially unwanted application (PUA) protection, and monitoring for unexpected software installations and persistence mechanisms. Read the blog for technical details, indicators of compromise (IOCs), mitigation guidance, Microsoft Defender detection info, advanced hunting queries.

Real-world exploitation concentrates in a small, high-impact subset of vulnerabilities. Fewer than 1 in 200 published CVEs are typically used in real-world attacks, even as the vulnerability landscape continues to expand. msft.it/6017aNmUv Threat actors disproportionately target flaws that enable system takeover, including remote code execution, privilege escalation, and authentication bypass, to establish footholds and support subsequent stages of an attack. AI-assisted vulnerability discovery and exploit development could further shorten defenders’ response window. Defenders should prioritize both exploitation likelihood and potential blast radius, focusing protection on critical, highly exposed systems where compromise could have the greatest downstream impact. Read the full analysis from Microsoft Security Research team to learn more.

On October 29, 2026, Cursor reported that a tampered copy of Claude Code extension (anthropic.claude-code, version 2.1.313 and 2.1.312) was available and served on the Cursor extension marketplace for a few hours. msft.it/6019aF20x Microsoft has confirmed that the malicious packages found on Cursor marketplace were never published nor distributed from the Microsoft Visual Studio Marketplace extension and the npm anthropic-ai/claude-code, which were not affected by this incident. Anthropic confirmed to Microsoft that their systems were not compromised and they did not develop the malicious package posted in Cursor marketplace. At this time, all evidence suggests that the incident is limited to the Cursor marketplace. Microsoft Threat Intelligence analyzed the JavaScript embedded into the malicious extension package. The injected loader runs when the extension module loads and attempts to add an attacker-controlled Secure Shell (SSH) key, enable the local SSH service, establish reverse SSH forwarding, configure persistence, and report host details. Successful remote access depends on host privileges, SSH configuration, and the attacker’s server configuration; however, the loader may still write keys and persistence artifacts even when tunnel access fails. Read the blog for technical analysis and guidance on identifying affected systems, investigating endpoint and network activity, and removing confirmed malicious SSH keys and persistence artifacts.

Patch now: PHP2Shell, Brotli, and eMudhra guidance for customers msft.it/6010aFLKw

Recorded live at Black Hat, part two of this episode examines how defenders respond to identity compromise, from credential theft and MFA bypasses to containment, recovery, and the emerging security challenges posed by AI. msft.it/6010aFiCs Microsoft incident response experts Adrian Hill and Terry Mee share lessons from investigating real-world attacks, offering practical insights into the visibility and controls needed to limit attacker access and reduce risk. Microsoft’s Defender Purple Team discusses recreating complete attack chains to identify detection gaps and strengthen defenses, while also exploring how AI is changing both security research and the threat landscape. Learn more on this episode of the Microsoft Threat Intelligence Podcast, hosted by Elliot Volkman.

Microsoft Threat Intelligence investigated two human-operated intrusions in which threat actors impersonated IT or help desk personnel via Teams messages and calls, tricking users into granting interactive remote access, primarily through Quick Assist. msft.it/6010aFi3j Once connected, the threat actors staged portable Python, Bun, or Java runtimes, performed host and network discovery, and assessed Active Directory Certificate Services (AD CS) for certificate-based authentication paths through ESC1 template abuse or ESC8 authentication relay. These paths show how a user-approved remote session can lead to certificate-backed access to privileged identities and domain infrastructure, and why comprehensive containment matters. Read the blog for technical analysis, investigation guidance, mitigations, detections, and hunting queries.

AI adoption by North Korean threat actors largely supports existing goals and targeting priorities, including generating revenue for the regime, collecting strategic intelligence, and, in some cases, pursuing politically motivated disruptive or destructive objectives, rather than representing a shift in actor motivations. msft.it/6010a0LAm Recent activity by these threat actors illustrates AI-enabled acceleration and scaling: - Jade Sleet launched campaigns through three front companies in a single week - Onyx Sleet generated dozens of tailored lures in minutes - Coral Sleet rapidly built a new capability to trojanize private source code repositories - Diamond Sleet used AI to enhance tailored targeting workflows, including persona development and front company creation - Pearl Sleet and Onyx Sleet have been leveraging the open-source agentic AI penetration testing framework ARTEX to conduct operations Our latest blog breaks down how North Korean threat actors are utilizing AI across their operations, and provides mitigation guidance and Microsoft Defender detections to help organizations defend against these threats.

Microsoft Senior Security Program Manager Karina Sirota Goodley joins the Microsoft Threat Intelligence Podcast to examine the ecosystem-wide challenges of preparing certificates and trust systems for post-quantum cryptography. msft.it/6011a0zbh Karina discusses how Microsoft’s post-quantum certificate pilot brings certificate authorities together to test issuance, compatibility, performance, and lifecycle assumptions. The work shows how minor constraints or one unsupported component can disrupt an end-to-end trust chain. Organizations can begin by inventorying certificates, keys, libraries, algorithms, hard-to-update systems, and vendor dependencies. Hear why industry testing and collaboration are critical to understanding cryptographic risk and preparing for what comes next.

A compromised LiteLLM 1.107.0 release added files that Python could execute during normal interpreter initialization. Applications did not need to import LiteLLM for the payload to run; starting Python in an affected environment could be enough. msft.it/6012axjt8 Microsoft analyzed two execution paths: a credential collector targeting authentication material across developer tools, cloud environments, browsers, and infrastructure, and a Unix-oriented loader capable of retrieving and executing additional Python code. Endpoint observations on Windows and macOS matched the collector’s discovery, encryption, and outbound connection behavior. Starting Python in an affected environment could activate the payload, so investigators should avoid using Python or pip during evidence collection. Read the Microsoft Security research for analysis of the startup mechanisms, credential exposure, Defender detections, hunting queries, indicators of compromise, and recovery guidance.

The China state-aligned threat actor Storm-0940 used the agentic AI penetration testing framework ARTEX to automate attacks targeting hundreds of organizations globally across a broad range of industries. Microsoft Threat Intelligence assesses that Storm-0940 was responsible for the recently disclosed ConnectWise supply chain compromise of a multitenant application. msft.it/6018aakEE Our investigation found that Storm-0940's use of ARTEX accelerated the speed of compromised application abuse to authenticate to target environments through applications that had already been granted access, allowing the threat actor to operate without requiring an interactive user sign-in. AI-accelerated follow-on activity included reconnaissance, application credential changes, and attempts to modify privileges that could enable expanded or persistent access. Read our blog for a detailed analysis and indicators of compromise (IOCs), along with Microsoft Defender detections, protection recommendations, and guidance on investigating service principal sign-ins and unexpected application credential or privilege changes.