WHATS Inside a malicious Claude Code-branded extension and its persistent SSH backdoor
Microsoft Security Blog ·
WHATS
THE HAX?
Security blogs
Top story
Also in coverage
Friday Squid Blogging: Bigfin Squid Off California Coast
Schneier on Security ·
Hackers leak personnel data of 41,000+ Homeland Security staff, including ICE and border agents
GRAHAM CLULEY ·
The best due diligence on a vendor is who they’ve worked with
Heimdal Security Blog ·
Article feed
7 sources ↓Inside a malicious Claude Code-branded extension and its persistent SSH backdoor
From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths
IDC MarketScape names Microsoft a Leader in the 2026 Worldwide Modern Endpoint Security for Enterprises Vendor Assessment
Tracking AI adoption in North Korean threat actor tradecraft
The CISO’s evolving role: Protecting and defending in the agentic era
Inside the LiteLLM 1.107.0 supply chain compromise: Credential theft through Python startup hooks
AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise
Agents are your newest insiders. Security must move at their speed.
Managing open-weight model risk in enterprise deployments
The hidden network: Inside the phishing infrastructure ecosystem powering global cybercrime
Post-quantum authentication: Why organizations should start testing certificate ecosystems now
3 lessons from frontier AI vulnerability research
CISO perspectives on managing vulnerability risks in the age of AI
Preparing governments for an era of interconnected cyber risk
Insights from the 2026 Microsoft Digital Defense Report
Secure what’s next: Your guide to Microsoft Security at Microsoft Ignite 2026
Unauthenticated command injection on internet-facing mail servers: tracking CVE-2026-73570
Phishing Abuses RMM Tools for Persistent Access
Beyond source code: A path to the keys to the kingdom
Star Blizzard refines phishing and malware delivery with the RedFlick technique
Friday Squid Blogging: Bigfin Squid Off California Coast
Bloatware in Aftermarket Auto Parts
Studying Fraudulent North Korean IT Workers
Hiding Capabilities in AI Models
Bias in Qwen3-Coder Model
Friday Squid Blogging: Increasing Squid Populations
Compromised TLS Certificates
New Serious PHP Vulnerabilities Released and Patched
Workshop on Economics and Information Security (WEIS) Archive
Possible new Cellebrite iPhone Radio Zero-Day
Training AIs to Solve CAPTCHAs
Friday Squid Blogging: Squid Before the Chicxulub Meteor Impact
Backdooring Open-Weight AI Models
Measuring Human Cryptanalysis Effort
Upcoming Speaking Engagements
The Future of AI Cryptanalysis
Cyberattack on Connected Fridges in France
FBI Arrests Suspect in FBI-Hacking Case
Friday Squid Blogging: I Caught a Squid
How Technology Empowers—and Imperils—Dictators
Hackers leak personnel data of 41,000+ Homeland Security staff, including ICE and border agents
BYOD cyberattack diverts ambulances and cancels classes at University of New Mexico health center
Smashing Security podcast #490: How Jared Kushner’s iPhone was allegedly hacked twice
Hive ransomware affiliate jailed, years after FBI infiltrated the gang’s systems
Hacker leaks 281 GB of data from Germany’s far-right AfD party
Smashing Security podcast #489: How a brand new crypto wallet came with a spy inside
Police arrest Qilin ransomware suspect on holiday, as links made to Synnovis hack that contributed to patient’s death
Irish police force has its Twitter hacked in cryptocurrency scam
Krybit ransomware: what you need to know
Smashing Security podcast #488: How a ransomware negotiator ended up arrested at his own conference
GTA 6 leaker threatens to release full playable version of game ahead of official launch
$10 million bounty offered for Chinese Hafnium hacker accused of Microsoft Exchange Server mega-attack
Smashing Security podcast #487: Clippy’s crypto comeback
N0n ransomware: what you need to know
FBI tells ShinyHunters members to turn themselves in, after arrest of alleged leader
ShinyHunters suspect arrested, and is now investigated over alleged murder plots
Pentagon personnel database breach exposes personal data of millions
Ukrainian ransomware developer jailed for nearly 13 years
Smashing Security podcast #486: Vibe-coded shops, and hackable Flock cameras
US Coast Guard and FBI board oil tanker to investigate cyber attack
The best due diligence on a vendor is who they’ve worked with
Heimdal named Advanced Persistent Threat Solution of the Year at the Computing Security Awards
Data Breach Statistics That Matter in 2026
6 alternatives to TrendAI Vision One
Why people don’t report scams, and it’s not embarrassment
6 alternatives to Blackpoint for your shortlist
Cybercrime Detective Explains Cybersecurity Jargon in 60-Second Videos for Cybersecurity Awareness Month
Innovation wins. Why smaller beats bigger
Heimdal partners with Elovade to bring unified cybersecurity platform to the DACH region
Slow is a design principle, not a delay
AI adoption that pays off is built around keeping humans in the driver’s seat
Phishing in 2026. Latest statistics and analysis
Shift Browser is signed adware that fingerprints your endpoint before it drops payload
6 ThreatLocker alternatives that should make your shortlist
50+ insider threat statistics for 2026
SHARED INTEL Q&A: 82% of campaign domains expose donors to email fraud before midterms
SHARED INTEL Q&A: PHP2Shell is no Log4Shell — open-source flaw is more warning than wildfire
MY TAKE: OktoberTech reveals a hardening AI foundation — but no one yet governing the agents
News alert: Gcore extends free web protection to government agencies after widespread PHP exploits
Industrial Defender Unifies Endpoint Intelligence and Network Monitoring for CIP-015, Adds Risk Signal
News alert: Bright Security launches AI-powered tool to uncover hidden software vulnerabilities
NEWS ALERT: G2A reports 35% jump in security software orders as consumers broaden protection
FIRESIDE CHAT: Firms once wanted AI callers stopped – now they want to sort good from bad
NEWS ALERT: Insignary launches Clarity AIR to expose hidden open-source and AI-generated code
News alert: Aembit gives enterprises new controls over personal AI agents accessing sensitive systems
SHARED INTEL Q&A: AI finds flaws faster — defenders still need to fix what attackers exploit
News alert: Archipelo launches Salmon to create verifiable audit trails for AI agent activity
Guest Essay: Before AI agents takes hold, define who can challenge them and who owns the outcome
News alert: SCOUTz gives MSPs security evidence to help turn prospects into customers
Black Hat Fireside Chat: As AI agents spread, the network shifts from traffic mover to policy enforcer
BLACK HAT FIRESIDE CHAT: Nobody picked the web browser to run work — now pick a boundary
MY TAKE: AI agents show uncanny initiative nobody designed — and carry no values at all
News alert: Axoflow introduces AxoDetect to identify threats and reduce security data costs
MY TAKE: OpenAI, Anthropic admit they can’t control AI — for now, the machines are running free
News Alert: SpyCloud survey finds machine identity risks outpace defenses, exposing gaps in oversight
The AI advantage your company can keep
Bringing CRM into the flow of work and agents into business process for sales and service teams
Introducing the new Copilot with Home, Code and Autopilot
Building the system for AI at work
Introducing Microsoft 365 G7: Intelligence + Trust for the mission ahead
Introducing Microsoft 365 G7: Intelligence + Trust for the mission ahead
ESPC 2026 is coming to Amsterdam: Bringing Microsoft and the community together
Build apps in Copilot Cowork and Copilot Studio
PPCC 2026: Bringing AI and your business processes together
PPCC 2026: Bringing AI and your business processes together
The next measure of AI momentum is work transformed
The next measure of AI momentum is work transformed
Copilot in Excel: Built for the era of Frontier Finance
Copilot in Excel: Built for the era of Frontier Finance
Copilot Cowork is now generally available
Copilot Cowork is now generally available
Introducing Microsoft Scout: Your always-on personal agent
Introducing Microsoft Scout: Your always-on personal agent
Announcing the new Work IQ APIs
Announcing the new Work IQ APIs
Microsoft Build 2026: Building agentic apps with Microsoft Fabric and Microsoft Databases
Azure IaaS: Defense in depth built on secure-by-design principles
Enforcing trust and transparency: Open-sourcing the Azure Integrated HSM
Try another search or clear the filters.