Buyer's guide ranks 11 SOC-as-a-service providers
Blackpoint Cyber is left off the roster under the publication's standing editorial policy.
18
Product
Microsoft Defender
- Mentions · 7d5
- Mentions · 30d18
- All mentions75
- First seenAug 12, 2026
- Last mentioned16h ago
Timeline
75 articles · newest first2026 ranking places Exabeam first among nine UEBA platforms
The editorial list scores nine vendors, not ten, after the Exabeam–LogRhythm merger, with no lab testing.
18
IDC MarketScape names Microsoft a leader in endpoint security
The September 2026 assessment cites Defender attack disruption, generally available Security Copilot, and cross-platform coverage.
24
North Korean actors use AI to scale social engineering and malware
Microsoft rates Jade Sleet, Coral Sleet, and Jasper Sleet as operationalized; operations remain human-directed, not autonomous.
74
CSO ranks incumbent security vendors adapting to AI threats
Palo Alto’s Prisma AIRS hit $100 million ARR, and the company bought CyberArk for $25 billion.
22
StealC seller relaunches as Stadia RAT for Windows
Version 1.1.2 adds hidden desktop control, a shell, and a loader; Varonis ties its helper to StealC 3.5.
72
Microsoft expands Project Perception to contain anomalous AI agents
New capabilities discover agents, assign identity and permissions, score risk, and can cut off access.
46
Gentlemen ransomware disables Defender, deletes backups and spreads
Acronis describes a Go-based RaaS from 2025 that also targets Linux, NAS and BSD, with more than 800 claimed victims.
74
Microsoft launches Guardian Agents to monitor enterprise AI agents
Hayete Gallot says frontier models cannot be trusted because they are unpredictable, not malicious.
58
Microsoft: October Windows update may break Smart App Control
Microsoft says Windows 11 update KB5127648 can gray out Smart App Control so it cannot be turned on.
48
Zero-Days Lurk in Microsoft's Overgrown October Patch Tuesday
Microsoft's October 2026 Patch Tuesday fixes 1,413 CVEs, including an exploited Windows Shell zero-day.
86
Hackers Registered New Domain with Exact Microsoft Teams Interface to Steal Logins
A four-day-old domain, teams-online.com, clones the Microsoft Teams login page to steal work credentials.
41
Hackers Compromise 100+ Websites With Fake Cloudflare Checks to Spread LUNEXSTEALER
Attackers compromised over 100 sites with fake Cloudflare checks to install Windows infostealer LUNEXSTEALER.
71
CERT-UA: Fake Cloudflare Checks Deliver LunexStealer Malware
CERT-UA says over 100 hacked sites used fake Cloudflare checks to install LunexStealer via ClickFix.
74
LUNEXSTEALER Gives Hackers Remote Control of Browsers Through Malicious Chrome Extension
CERT-UA reports LUNEXSTEALER installs LUNARAXE for remote Chromium control after fake Cloudflare prompts.
72
100+ Compromised Websites Use Fake Cloudflare Checks to Deliver LunexStealer
CERT-UA says UAC-0277 used fake Cloudflare checks on over 100 sites to deliver LunexStealer.
78
'BigDiskBuster' Leaves Microsoft Defender Running While Blocking Updates
BigDiskBuster proof of concept keeps Microsoft Defender running while blocking updates and opening a detection gap.
44
Microsoft Warns ClickFix Attacks Use Fake CAPTCHA Lures to Execute Malicious Commands
Microsoft warns a ClickFix campaign uses fake CAPTCHA prompts so Windows users run cached malware that steals browser credentials.
74
Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix
Attackers used ChatGPT Custom GPTs and ClickFix lures to sideload a RAT through a Canon-signed binary, hitting at least 40 users.
67
Hackers Use NeedyMantis to Maintain Long-Term Access in Breached Networks
Microsoft says NeedyMantis malware maintained long-term access after targeted network breaches.
73
Hackers Used a Samsung Flaw to Build a Cryptominer Inside Victim Systems
Huntress says attackers used Samsung MagicINFO CVE-2025-4632 on one Windows host to compile a Monero miner.
58
Google Ads Campaign Spreads Fake Security Alerts That Lock Browsers and Push Malware
Netskope found Google Ads scareware that fake-locks browsers and pushes victims to call fraudulent support lines.
55
What’s new in Microsoft Security: September 2026
Microsoft Security updates address AI agent governance, Zero Trust, and SOC foundation improvements with new data protection and management tools.
10
Microsoft integrates SOC capabilities with Defender for enterprises
Microsoft is previewing Defender ISOC, bundling SIEM into Microsoft 365 E5 and E7 without an extra license.
62
Microsoft Rebuilds the SOC with AI Agents, SIEM Integration and Machine-Speed Defense
Microsoft previewed an integrated SOC pairing Defender, SIEM, and AI agents for faster response.
36
17,000 URLs Reveal How ClickFix Turns Trusted Websites Into Malware Traps: Report by CTM360
CTM360 says ClickFix, now the top enterprise initial-access method, hides lure hosts on Polygon and delivers info-stealers.
80
Microsoft Rebuilds the SOC With AI Agents to Fight Machine-Speed Cyberattacks
Microsoft previews Defender ISOC, an AI-agent security operations platform for machine-speed attacks.
46
Reimagining the SOC for the agentic era in Microsoft Defender
Microsoft previews an integrated SOC in Defender that unifies SIEM and protection for agentic defense.
46
Researcher Drops BigDiskBuster Zero-Day PoC That Blocks Microsoft Defender Updates
Researcher publishes unpatched BigDiskBuster PoC that can block Microsoft Defender signature and platform updates.
73
Chaotic Eclipse Released BigDiskBuster, A PoC For Windows Defender Update DoS Zero-Day
Researcher Chaotic Eclipse published BigDiskBuster, a PoC that blocks Microsoft Defender signature and platform updates.
68
New Windows Defender zero-day blocks Microsoft antivirus updates
New Windows Defender zero-day exploit BigDiskBuster blocks antivirus updates on all supported Windows versions.
60
BigDiskBuster Windows Defender DoS Vulnerability Blocks Platform and Signature Updates
Unverified GitHub proof-of-concept BigDiskBuster blocks Microsoft Defender platform and signature updates, potentially leaving Windows endpoints with outdated anti-malware protection.
35
Hackers Hide Malware Servers on Blockchain to Steal Bank Logins and 2FA Codes
Malware operators hide C2 in Polygon blockchain contracts via EtherHiding, delivering a browser-based banking trojan that steals bank logins and 2FA codes from 479 sites.
72
PowerShell Malware Abuses Registry and DNS TXT Records to Deploy XMRig Crypto Miner
K7 Security Labs dissected a PowerShell cryptomining chain hiding payloads in registry, DNS TXT records, PNG pixels and WAV files to deploy XMRig.
55
Improving email security outcomes with real-world Microsoft Defender insights
Microsoft's quarterly benchmark claims Defender missed 55.4% fewer high-severity email threats than the next-closest secure email gateway.
25
Iran-Linked Handala Hack Tied to HEAVYGRAM Telegram Backdoor That Can Steal Passwords
Group-IB attributes the Iran-linked hacktivist persona Handala (Void Manticore/MOIS) to the Telegram-based HEAVYGRAM backdoor and CRUDEEXCLUDE staging utility.
58
Handala Hack Uses CRUDEEXCLUDE to Disable Defender Protections and Deploy HEAVYGRAM
Group-IB links new HEAVYGRAM and CRUDEEXCLUDE malware to Iran-aligned Handala Hack (MOIS/Void Manticore), which spies on Iranian dissidents using Defender exclusions and Telegram C2.
68
Iranian hackers use CHOSEN BRICK Windows malware to spy on targets
Iranian state-linked hackers use CHOSEN BRICK Windows malware, spread via Telegram and WhatsApp social engineering, to spy on dissidents and journalists worldwide.
78
US, UK, Dutch Agencies Expose Iranian ‘Chosen Brick’ Surveillance Malware
US, UK, and Dutch agencies warn Iranian state actors deploy Windows surveillance malware 'Chosen Brick' against dissidents, activists, and journalists worldwide.
60
Iranian hackers use CHOSEN BRICK data-stealing malware to spy on dissidents and journalists
UK NCSC, FBI and Dutch AIVD warn Iranian state hackers deploy CHOSEN BRICK spyware via WhatsApp and Telegram lures against dissidents and journalists since 2025.
78
Related CVEs
by mentions- CVE-2026-694141%7.8Local Elevation of Privilege in Microsoft Defender Malware Protection Engine
- CVE-2026-5065611%7.0Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicly referred to as "RoguePlanet "
- CVE-2023-20598<1%7.8An improper privilege management in the AMD Radeon™ Graphics driver may allow an authenticated attacker to craft an IOCTL request to gain I/O control over…
- CVE-2026-5504070%9.1Authentication Bypass in Microsoft SharePoint Server
- CVE-2026-68820<1%7.0Use-After-Free Local Privilege Escalation in Microsoft Windows WinSock AFD Driver
- CVE-2026-635203%8.1Unauthenticated RCE in Microsoft SharePoint Server
- CVE-2026-628323%7.8Local Privilege Escalation via Link Following in Windows User Profile Service
- CVE-2026-72971<1%5.5Local Tampering via Link-Following Flaw in Windows 11 26H1 Container Isolation Driver
- CVE-2026-214131%9.8A heap-based buffer overflow vulnerability exists in the lossless_jpeg_load_raw functionality of LibRaw Commit 0b56545 and Commit d20315b
- CVE-2026-55007<1%8.1Double Free Enables Unauthenticated RCE in Microsoft Exchange Server
Appears with
- Microsoftvendor · 61
- Microsoftorganization · 20
- Windowsproduct · 16
- Kasperskyvendor · 10
- CrowdStrikevendor · 9
- Telegramproduct · 6
- FBIorganization · 6
- Avastvendor · 5
- Windows 11product · 5
- Chosen Brickmalware · 5
- LunexStealermalware · 4
- Project Perceptionproduct · 4
- Googlevendor · 4
- Huntressorganization · 4
- NAIVEMESSmalware · 4
- Nvidiavendor · 4
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.