42
Protecting organizations from AI-assisted executive impersonation and invoice fraud
Microsoft tracked a campaign of over one million AI-crafted CEO-impersonation emails seeking ~$50,000 ACH payments with fabricated ServiceNow invoices.
Between August 3 and 5, Microsoft detected a campaign of more than one million fraud emails, 87.7% of them targeting US enterprise users, sent through multiple third-party email delivery service accounts. The actor impersonated CEOs, CFOs, and presidents of targeted companies, urging accounts payable staff to process an ACH payment of nearly $50,000. Lures layered executive impersonation, lookalike domains, a fabricated ServiceNow 'Annual Subscription' invoice personalized to the recipient, and forged forwarded email threads; Microsoft found no evidence ServiceNow or the referenced executives were compromised. Microsoft observed indicators consistent with generative AI-assisted template creation, while leftover inconsistencies such as missing forwarding headers and mismatched display names gave defenders detection cues.
55
Impersonating IT support: how threat actors turn a remote session into enterprise-wide access
Microsoft details Teams IT-support impersonation campaigns deploying Node.js implants, AD reconnaissance, and WinRM lateral movement toward domain controllers.
Microsoft Threat Intelligence describes a human-operated campaign where attackers impersonate IT/helpdesk staff via Microsoft Teams external collaboration, talk users into granting remote sessions, and use RMM tools for interactive access. During the session they run PowerShell to silently install a malicious MSI that stages a portable Node.js runtime and obfuscated JavaScript implant for C2, executing follow-on payloads via rundll32. Operators then perform host and Active Directory reconnaissance, capture desktop screenshots, and pivot via WinRM on port 5985 to domain controllers and certificate authorities. The hands-on-keyboard chain, which can precede data theft and ransomware, blends into normal operations by relying on Teams, Quick Assist, msiexec, and Node.js; Microsoft shares hunting and mitigation guidance.
82
Chaotic Eclipse Released ShieldCrash, A PoC For Microsoft Defender Zero-Day
Researcher Chaotic Eclipse released ShieldCrash, a PoC showing Microsoft Defender's CVE-2026-69414 patch is incomplete, enabling arbitrary file reads as SYSTEM.
Security researcher Chaotic Eclipse published ShieldCrash, a proof-of-concept exploit for the Microsoft Malware Protection Engine privilege escalation vulnerability CVE-2026-69414 (ShieldBreak). The PoC performs arbitrary file reads with SYSTEM privileges on all supported Windows versions, including systems running the September 2026 security updates and Malware Protection Engine version 1.1.26080.3. The researcher claims Microsoft's patch fixed several exploit paths but missed a specific condition that still enables the attack. His recent releases also include zero-day PoCs targeting Nvidia, Kaspersky, Avast, and CrowdStrike Falcon.
72
57
57
Detect and disrupt AI-themed attacks with Microsoft Defender
Microsoft Threat Intelligence reports criminal campaigns impersonating ChatGPT, Copilot, Claude, and DeepSeek in phishing, AiTM, and malvertising attacks reaching 100,000 emails daily.
Microsoft Threat Intelligence observed a growing set of campaigns that abuse trust in popular AI brands: a ChatGPT-themed phishing campaign sent up to 100,000 emails in one day to steal payment card data, and a Claude-themed campaign used adversary-in-the-middle techniques to harvest credentials and access tokens. Other campaigns included malvertising for a fake AI Windows plugin delivering the Vidar stealer and fraudulent DeepSeek installers distributed via GitHub. Initial access broker Storm-3075 used AI-themed malvertising to distribute payloads for multiple downstream actors, and Microsoft notes the AI services themselves were not compromised. Microsoft also details Defender protections such as Safe Links, Safe Attachments, and attack disruption against these multi-stage lures.
65
57
Counterfeit installers to system compromise: Tracking a deceptive software download campaign
Microsoft tracks a counterfeit software-installer campaign compromising multinationals' China operations, moderately linked to the Silver Fox (Yinhu) actor.
Microsoft Defender Experts is tracking an active campaign using spoofed software download sites for brands such as Razer, Kaspersky, Microsoft Edge, Calibre, and Baidu Netdisk on .com.cn and .hl.cn domains, delivering installer archives whose hashes change per download, indicating server-side payload generation. The implants establish persistence, weaken security protections, and communicate with attacker-controlled infrastructure, with confirmed compromises across healthcare, manufacturing, gaming, technology, logistics, government, and education. Microsoft assesses with moderate confidence that the activity matches the publicly reported Silver Fox (Yinhu) fake software campaign; it has not attributed it to a nation-state actor.
63
57
57
57
New Microsoft Defender 'ShieldCrash' zero-day grants SYSTEM access
Researcher Nightmare Eclipse released 'ShieldCrash', a zero-day exploit for Microsoft Defender that grants attackers SYSTEM-level access.
An anonymous researcher known as Nightmare Eclipse published a zero-day exploit for Microsoft Defender, dubbed 'ShieldCrash', that yields SYSTEM-level access. The release came immediately after Microsoft rolled out its September 2026 Patch Tuesday security updates. No CVE identifier has been assigned publicly and no in-the-wild exploitation has been reported yet. Microsoft Defender ships by default on Windows, so potential exposure is broad until Microsoft patches the flaw.
60
57
57
57
57
57
57
57
57
57
57
57
57
57
57
57
57
Fake Software Installers Disable Windows Update and Weaken Microsoft Defender
Fake software-download sites distribute installers that disable Windows Update and weaken Defender, attributed to China-linked cluster Silver Fox.
Microsoft says an active campaign uses counterfeit vendor websites on .com.cn and .hl.cn infrastructure with Chinese-language lures to deliver server-side generated installers that establish scheduled-task persistence, add Defender exclusions, delete shadow copies, and stop services including wuauserv, UsoSvc, uhssvc and WaaSMedicSvc. Victims span healthcare, manufacturing, gaming, technology, logistics, government and education, primarily China-based operations of multinationals and Chinese-speaking users. Microsoft assesses with moderate confidence the activity matches the Silver Fox (Yinhu) cluster, historically tied to Gh0st RAT and ValleyRAT, with C2 over non-standard ports like 5090 and 7088-7090 via domains iualef[.]net and oijfwe[.]net. Kaspersky separately detailed a QN Wallpaper DLL-sideloading chain delivering ValleyRAT.
68
42
57
57
57
47
57
57
57
57
57