Microsoft Threat Intelligence is tracking an active supply chain attack in which a threat actor compromised the trusted OAuth App of the backup application ConnectWise Cloud Backup (AppId: 506e08f9-6e9a-4da4-942b-a099a03644ae), formerly SkyKick Backup, to obtain access tokens
- Microsoft uncovered a Chinese-language cybercriminal ecosystem, an interconnected network of phishing kit operators and an illicit marketplace selling tools and infrastructure for large-scale phishing, enabling cybercriminal operations worldwide.
- The October 2026 security updates are available. In addition, starting today, Microsoft is publishing Vulnerability Exploitability eXchange (VEX) statements for all Microsoft-assigned CVEs. Learn more: msft.it/6013aSA6VSecurity updates for October 2026 are now available. Details are here: msrc.microsoft.com/update-guide/ As security update packages address more CVEs, prioritization can become more complex. In a new blog, we explore risk cohorts, an approach to grouping CVEs around shared deployment,
- Post-quantum cryptography readiness goes beyond protecting encrypted data. Authentication systems must evolve, too, and organizations should start preparing now. msft.it/6012aUw5n Organizations can begin inventorying certificate dependencies, assessing vendor roadmaps,
- AI is accelerating familiar threats while giving defenders new ways to respond. This is a central theme of the 2026 Microsoft Digital Defense Report (MDDR), discussed in this episode of the Microsoft Threat Intelligence Podcast. msft.it/6019aoYQR Elliot Volkman speaks00:00




