Microsoft Threat Intelligence

@threatintel.microsoft.com

2270 Followers 57 Following

We are Microsoft's global network of security experts. Follow for security research and threat intelligence. https://aka.ms/threatintelblog

npm

Graphic showing chains

Image of supply chain attack

Visual for credential theft

Image for supply chain attacks

Attack chain of Mini Shai-Hulud npm supply chain compromise targeting antv packages

Screenshot of mistralai PyPI package v2.4.6 compromise

A colorful graphic showing a radar scanning icon representing new detection and hunting guidance.

Diagram showing the Storm-1175 attack chain

Timeline of Storm-1175's exploitation of various vulnerabilities over the last few years, including date of disclosure and date of exploitation

Photo of medical professional working with a computer, with the exploitation icon in overlay

Screenshot of decoded ClickFix command

Screenshot of decoded ClickFix command

Screenshot of ClickFix lure using Windows Terminal

Screenshot of startup script

A colorful graphic showing a radar scanning icon representing new detection and hunting guidance.

Percentage of OpenClaw installations from Cline

PowerShell script running discovery commands

Screenshot of DNS call

ClickFix command that executes a custom DNS lookup and parses the `Name:` response to receive the next-stage payload for execution.

Graphic reading "Microsoft supports the Winter Shield."

Screenshot of instructions to run a command, a technique called ClickFix

Screenshot of landing page showing a slider CAPTCHA

Screenshot of emails used by Storm-0900 in phishing campaign

Tycoon2FA Storm-1747

Screenshot of the Microsoft Defender portal showing the Threat Intelligence Briefing agent

The text "Vanilla Tempest" and the icon for financially motivated threat actors in white against a blue background.

Image with "October 2025 Patch Tuesday" in white text on a blue background.

Image with text September 2024 Patch Tuesday in whie font and blue background

Diagram of an hybrid attack