Threat Intelligence Center

Microsoft's security portfolio changes on a monthly cadence, and keeping track of what shipped, what moved to general availability, and what is still in preview is part of maintaining an accurate picture of your own environment.

Law enforcement has secured an indictment against a Scattered Spider member, coinciding with Microsoft's GDID case moving to trial. Scattered Spider, known for targeting luxury jewelry retailers, has leveraged infrastructure including Tor, Tzulo, and ngrok to conduct reconnaissance and maintain persistent access.

Amazon's threat intelligence team disclosed this week that the group behind the recent compromise of the axios JavaScript library also planted malicious code in a small package called typo-crypto in March 2025 — a full year earlier — and in the widely used debug and chalk packages in September 2025.

Banner Health and LifeStance Health Group have reached settlements in lawsuits challenging their use of employee tracking technology. These cases highlight growing scrutiny of workforce monitoring practices in healthcare settings, where patient care and employee privacy intersect with operational oversight.

Security researchers have identified an AutoIT payload injector actively distributing VIPKeylogger malware to financial services organizations. The attack chain leverages AutoIT scripting to inject malicious payloads, with the executable vijewyufveonabghulluonouceyasi.exe serving as a delivery mechanism. VIPKeylogger captures sensitive financial data, credentials, and transaction details.

Health-ISAC has issued a warning regarding escalating data theft attacks from ShinyHunters, a threat actor group actively targeting healthcare providers and medical technology organizations. The campaign leverages custom phishing kits designed to bypass email security controls and harvest credentials from healthcare staff.