Microsoft Security

Microsoft Security

Sign in

Microsoft security intelligence

Security research and threat intelligence from our global network of security experts.

September 29, 2022 • 12 min read

ZINC weaponizing open-source software

In recent months, Microsoft detected weaponization of legitimate open-source software by an actor the Microsoft Threat Intelligence Center (MSTIC) tracks as ZINC, targeting employees at media, defense and aerospace, and IT service provider organizations in the US, UK, India, and Russia.

Malicious OAuth applications used to compromise email servers and spread spam Preview link: https://www.microsoft.com/security/blog/?p=122401&preview=1&_ppp=261288b93e Permalink: https://www.microsoft.com/security/blog/2022/09/22/malicious-oauth-applications-used-to-compromise-email-servers-and-spread-spam/

September 22, 2022 • 11 min read

Malicious OAuth applications abuse cloud email services to spread spam

Microsoft discovered an attack where attackers installed a malicious OAuth application in compromised tenants and used their Exchange Online service to launch spam runs.

Male business professional standing on subway looking at smart phone mobile device.

September 21, 2022 • 7 min read

Rewards plus: Fake mobile banking rewards apps lure users to install info-stealing RAT on Android devices

A fake mobile banking rewards app delivered through a link in an SMS campaign has been making the rounds, targeting customers of Indian banking institutions. Users who install the mobile app are unknowingly installing an Android malware with remote access trojan (RAT) capabilities.

September 8, 2022 • 20 min read

Microsoft investigates Iranian attacks against the Albanian government

Shortly after the destructive cyberattacks on the Albanian government in mid-July, the Microsoft Detection and Response Team (DART) was engaged to lead an investigation into the attacks.

Security practitioner working in to investigate threats.

September 7, 2022 • 11 min read

Profiling DEV-0270: PHOSPHORUS’ ransomware operations

Microsoft threat intelligence teams have been tracking multiple ransomware campaigns tied to DEV-0270, also known as Nemesis Kitten, a sub-group of Iranian actor PHOSPHORUS.

August 31, 2022 • 11 min read

Vulnerability in TikTok Android app could lead to one-click account hijacking

Microsoft discovered a high-severity vulnerability in the TikTok Android application, now identified as CVE-2022-28799 and fixed by TikTok, which could have allowed attackers to compromise users' accounts with a single click.

August 25, 2022 • 9 min read

MERCURY leveraging Log4j 2 vulnerabilities in unpatched systems to target Israeli organizations

Microsoft detected an Iran-based threat actor the Microsoft Threat Intelligence Center (MSTIC) tracks as MERCURY leveraging exploitation of Log4j 2 vulnerabilities in SysAid applications against organizations located in Israel.

Ground-up view of a city‘s architecture and skyline.

August 24, 2022 • 21 min read

MagicWeb: NOBELIUM’s post-compromise trick to authenticate as anyone

Microsoft security researchers have discovered a post-compromise capability we’re calling MagicWeb, which is used by a threat actor we track as NOBELIUM to maintain persistent access to compromised environments.

Top-down view of a bearded man in a gray/blue shirt seated at a desk working on a Surface laptop connected to three large monitors.

August 24, 2022 • 10 min read

Looking for the ‘Sliver’ lining: Hunting for emerging command-and-control frameworks

Threat actors evade detection by adopting the Sliver command-and-control (C2) framework in intrusion campaigns.

August 19, 2022 • 8 min read

Uncovering a ChromeOS remote memory corruption vulnerability

Microsoft discovered a memory corruption vulnerability in a ChromeOS component that could have been triggered remotely, allowing attackers to perform either a denial-of-service (DoS) or, in extreme cases, remote code execution (RCE).

Two male coworkers sitting next to each other along row of office desks, using their own desktop computers (screens show Excel and PowerPoint). An open HP laptop sits on desk to their left, showing the Windows 10 home screen.

August 18, 2022 • 4 min read

Hardware-based threat defense against increasingly complex cryptojackers

To provide advanced protection against increasingly complex and evasive cryptojackers, Microsoft Defender Antivirus integrates with Intel® Threat Detection Technology (TDT) that applies machine learning to low-level CPU telemetry in detecting cryptojackers, even when the malware is obfuscated and can evade security tools.

Aerial panoramic view of cityscape skyline with metropole financial district modern skyscrapers during sunrise with illuminated buildings and cloudy sky in London, UK.

August 15, 2022 • 12 min read

Disrupting SEABORGIUM’s ongoing phishing operations

The Microsoft Threat Intelligence Center (MSTIC) has observed and taken actions to disrupt campaigns launched by SEABORGIUM in campaigns involve persistent phishing and credential theft campaigns leading to intrusions and data theft.

1
2
3
…
24
Next Page