On October 29, 2026, Cursor reported that a tampered copy of Claude Code extension (anthropic.claude-code, version 2.1.313 and 2.1.312) was available and served on the Cursor extension marketplace for a few hours. https://msft.it/6046aF2tC Microsoft has confirmed that the malicious packages found on Cursor marketplace were never published nor distributed from the Microsoft Visual Studio Marketplace extension and the npm @anthropic-ai/claude-code, which were not affected by this incident. Anthropic confirmed to Microsoft that their systems were not compromised and they did not develop the malicious package posted in Cursor marketplace. At this time, all evidence suggests that the incident is limited to the Cursor marketplace. Microsoft Threat Intelligence analyzed the JavaScript embedded into the malicious extension package. The injected loader runs when the extension module loads and attempts to add an attacker-controlled Secure Shell (SSH) key, enable the local SSH service, establish reverse SSH forwarding, configure persistence, and report host details. Successful remote access depends on host privileges, SSH configuration, and the attacker’s server configuration; however, the loader may still write keys and persistence artifacts even when tunnel access fails. Read the blog for technical analysis and guidance on identifying affected systems, investigating endpoint and network activity, and removing confirmed malicious SSH keys and persistence artifacts.
Microsoft Threat Intelligence
Computer and Network Security
Redmond, Washington 147,169 followers
We are Microsoft's global network of security experts. Follow for security research and threat intelligence.
About us
The Microsoft Threat Intelligence community is made up of more than 10,000 world-class experts, security researchers, analysts, and threat hunters analyzing 78 trillion signals daily to discover threats and deliver timely and hyper-relevant insight to protect customers. Our research covers a broad spectrum of threats, including threat actors and the infrastructure that enables them, as well as the tools and techniques they use in their attacks.
- Website
-
https://aka.ms/threatintelblog
External link for Microsoft Threat Intelligence
- Industry
- Computer and Network Security
- Company size
- 10,001+ employees
- Headquarters
- Redmond, Washington
- Specialties
- Computer & network security, Information technology & services, Cybersecurity, Threat intelligence, Threat protection, and Security
Updates
-
Patch now: PHP2Shell, Brotli, and eMudhra guidance for customers https://msft.it/6041aFLHX
PHP2Shell, a Brotli decoder vulnerability, and the eMudhra certificate authority key issue each require attention. Microsoft is updating the services it operates and releasing fixes for affected products. Customers should review the issue-by-issue guidance for updates and actions in environments they manage: https://lnkd.in/eqG2RKhT
-
Recorded live at Black Hat, part two of this episode examines how defenders respond to identity compromise, from credential theft and MFA bypasses to containment, recovery, and the emerging security challenges posed by AI. https://msft.it/6043aFifD Microsoft incident response experts Adrian Hill and Terry Mee share lessons from investigating real-world attacks, offering practical insights into the visibility and controls needed to limit attacker access and reduce risk. Microsoft’s Defender Purple Team discusses recreating complete attack chains to identify detection gaps and strengthen defenses, while also exploring how AI is changing both security research and the threat landscape. Learn more on this episode of the Microsoft Threat Intelligence Podcast, hosted by Elliot V..
-
Microsoft Threat Intelligence investigated two human-operated intrusions in which threat actors impersonated IT or help desk personnel through Teams messages and calls, and tricked users into granting interactive remote access, primarily through Quick Assist. https://msft.it/6044aF9A4 Once connected, the threat actors staged portable Python, Bun, or Java runtimes, performed host and network discovery, and assessed Active Directory Certificate Services (AD CS) for certificate-based authentication paths through ESC1 template abuse or ESC8 authentication relay. These paths show how a user-approved remote session can lead to certificate-backed access to privileged identities and domain infrastructure, and why comprehensive containment matters. Read the blog for technical analysis, investigation guidance, mitigations, detections, and hunting queries.
-
AI adoption by North Korean threat actors largely supports existing goals and targeting priorities, including generating revenue for the regime, collecting strategic intelligence, and, in some cases, pursuing politically motivated disruptive or destructive objectives, rather than representing a shift in actor motivations. https://msft.it/6048a0L0j Recent activity by these threat actors illustrates AI-enabled acceleration and scaling: - Jade Sleet launched campaigns through three front companies in a single week - Onyx Sleet generated dozens of tailored lures in minutes - Coral Sleet rapidly built a new capability to trojanize private source code repositories - Diamond Sleet used AI to enhance tailored targeting workflows, including persona development and front company creation - Pearl Sleet and Onyx Sleet have been leveraging the open-source agentic AI penetration testing framework ARTEX to conduct operations Our latest blog breaks down how North Korean threat actors are utilizing AI across their operations, and provides mitigation guidance and Microsoft Defender detections to help organizations defend against these threats.
-
Microsoft Senior Security Program Manager Karina Sirota Goodley, MBA, MSSM Sirota Goodley joins the Microsoft Threat Intelligence Podcast to examine the ecosystem-wide challenges of preparing certificates and trust systems for post-quantum cryptography. https://msft.it/6043a0zwt Karina discusses how Microsoft’s post-quantum certificate pilot brings certificate authorities together to test issuance, compatibility, performance, and lifecycle assumptions. The work shows how minor constraints or one unsupported component can disrupt an end-to-end trust chain. Organizations can begin by inventorying certificates, keys, libraries, algorithms, hard-to-update systems, and vendor dependencies. Hear why industry testing and collaboration are critical to understanding cryptographic risk and preparing for what comes next.
-
Threat actors target trusted access to provide a path into an environment. In the 2026 Microsoft Digital Defense Report, 73.3% of observed initial access attempts involved user execution, valid accounts, social engineering, or phishing. These attempts increasingly rely on techniques designed to obtain or misuse legitimate access, including OAuth abuse, adversary-in-the-middle (AiTM) phishing, valid account abuse, password spraying, and increasingly credible social engineering. These techniques can make the boundary between malicious and legitimate activity harder to distinguish. A successful sign-in or authorized application does not, on its own, establish that the activity behind it can be trusted. Protecting authentication flows and monitoring what happens after access is established are both critical to limiting the impact of identity-based attacks. Phishing-resistant authentication, tighter privilege and application controls, session and token protection, and identity governance can help reduce the paths threat actors can use to turn trusted access into broader compromise. Read the full report: https://lnkd.in/eF3jhTxq
All too many of the most damaging intrusions begin with a trusted identity. The 2026 Microsoft Digital Defense Report found that user execution, valid accounts, social engineering, and phishing represented 73% of observed initial-access attempts. For CISOs, that datapoint underlines why identity remains such a critical control plane. Of course, we need to know whether an identity is valid. We also need to understand what it can access, whether that access is still necessary, and how quickly we can remove it when risk emerges. The fundamentals of identity security aren't new, but getting them right remains one of the most important ways we can reduce risk. Read more in the 2026 Microsoft Digital Defense Report: https://aka.ms/mddr #MicrosoftSecurity #MDDR #IdentitySecurity #ZeroTrust
-
A compromised LiteLLM 1.107.0 release added files that Python could execute during normal interpreter initialization. Applications did not need to import LiteLLM for the payload to run; starting Python in an affected environment could be enough. https://msft.it/6041axjUd Microsoft analyzed two execution paths: a credential collector targeting authentication material across developer tools, cloud environments, browsers, and infrastructure, and a Unix-oriented loader capable of retrieving and executing additional Python code. Endpoint observations on Windows and macOS matched the collector’s discovery, encryption, and outbound connection behavior. Starting Python in an affected environment could activate the payload, so investigators should avoid using Python or pip during evidence collection. Read the Microsoft Security research for analysis of the startup mechanisms, credential exposure, Defender detections, hunting queries, indicators of compromise, and recovery guidance.
-
The China state-aligned threat actor Storm-0940 used the agentic AI penetration testing framework ARTEX to automate attacks targeting hundreds of organizations globally across a broad range of industries. Microsoft Threat Intelligence assesses that Storm-0940 was responsible for the recently disclosed ConnectWise supply chain compromise of a multitenant application. https://msft.it/6045aak67 Our investigation found that Storm-0940's use of ARTEX accelerated the speed of compromised application abuse to authenticate to target environments through applications that had already been granted access, allowing the threat actor to operate without requiring an interactive user sign-in. AI-accelerated follow-on activity included reconnaissance, application credential changes, and attempts to modify privileges that could enable expanded or persistent access. Read our blog for a detailed analysis and indicators of compromise (IOCs), along with Microsoft Defender detections, protection recommendations, and guidance on investigating service principal sign-ins and unexpected application credential or privilege changes.
-
Cyber risk increasingly extends beyond the original point of compromise. As identities, cloud services, software dependencies, AI systems, and business operations become more interconnected, threat actors are able to exploit those relationships to expand access and amplify impact. A single compromised identity can enable follow-on credential theft and access to additional resources. Trusted relationships, shared infrastructure, and reused attacker capabilities can also create pathways between environments, allowing seemingly isolated activity to be connected to a broader intrusion set or campaign. These dynamics mean that a single compromise can create cascading effects far beyond the initial target. Understanding those connections requires visibility across identities, endpoints, cloud services, applications, data, AI systems, and external relationships, supported by threat intelligence that provides context, helps correlate activity across domains, and connects individual observations to broader patterns of attacker behavior. Learn more by reading the full report: https://lnkd.in/eF3jhTxq
The boundaries of the enterprise have become much harder to define. Identity, cloud infrastructure, applications, software dependencies, suppliers, data, and AI systems are increasingly interconnected and dependent on one another. That means risk can move across the environment in ways that may not be obvious when we look at each part independently. A compromised identity can create access to cloud resources and sensitive data. Risk introduced through a trusted software dependency can extend well beyond one organization. And as AI agents gain access to more data and tools, understanding those connections becomes even more important. For CISOs, this requires a broader view of risk. We need to understand where an exposure exists, but also what it connects to and where an attacker could potentially go from there. That requires visibility across the environment and the ability to connect signals across traditional security domains. It also means being deliberate about where access, dependencies, and trust can create broader exposure. Threat actors will look for opportunities to move across these connections. Security teams need the context to see that movement and respond. This theme on the growing interconnectivity of risk was something that I am still reflecting on after reading the Microsoft Digital Defense Report: https://aka.ms/mddr. #MicrosoftSecurity #MDDR #CISO #CyberResilience