Hunting Infostealers - Trusted Platform Abuse
In this part of the “Hunting Infostealers” series, we explore the growing abuse of trusted communication services and software ecosystems—including messaging platforms like WhatsApp and seemingly benign PDF converter tools—to propagate malware and deploy credential stealers such as Eternidade Stealer, lowering user suspicion and complicating detection. Throughout the blog, we map observed activity to Microsoft Defender XDR coverage and provide actionable guidance to help organizations detect, mitigate, and respond to infostealers. Platform Abuse (WhatsApp, PDF Converters) Since late 2025, Platform abuse has become an increasingly prevalent tactic in the modern threat landscape, wherein adversaries deliberately exploit the legitimacy, scale, and user trust associated with widely used applications and services. By weaponizing platforms such as WhatsApp and seemingly benign PDF conversion tools, threat actors are able to disguise malicious activity within normal user behavior, enabling efficient malware delivery, lateral propagation, and evasion of traditional security controls. WhatsApp Abused to Deliver Eternidade Stealer During the third week of November 2025, Microsoft Defender Experts (DEX) identified a WhatsApp platform abuse campaign that leverages a multi-stage infection chain and worm-like propagation techniques to distribute malware. The activity begins with the execution of an obfuscated Visual Basic script, which drops a malicious batch file that launches multiple PowerShell instances to download additional payloads from adversary-controlled command-and-control domains. These payloads include a Python script responsible for WhatsApp Web–based dissemination of the malware in a worm-like manner, as well as a malicious MSI installer that ultimately delivers the Eternidade Stealer. To ensure successful execution, the batch script also installs the required Python dependencies on the compromised system. The Python script establishes communication with a remote server and leverages the open-source project WPPConnect to automate message sending from hijacked WhatsApp accounts. As part of this process, it harvests the victim’s entire contact list while filtering out groups, business contacts, and broadcast lists. The malware then collects, for each contact, the associated WhatsApp phone number, name, and an indicator showing whether the contact is saved. This information is exfiltrated to an attacker-controlled server via an HTTP POST request. In the final stage of this propagation mechanism, the malware sends a malicious attachment to all harvested contacts, using a predefined messaging template populated with time-based greetings and contact names to increase the likelihood of interaction. The malicious MSI installer drops several components, including encrypted payload files with .dmp and .tda extensions, an AutoIt executable, and a script loader disguised as a .log file. Despite its benign appearance, the .log file functions as an AutoIt-based malicious script that conducts environment reconnaissance, performs anti-detection checks, and loads payloads in memory using large hex-encoded binary blobs to initialize native components. The encrypted .tda file acts as an injector and employs a process hollowing technique to execute the final payload. Specifically, the injector reads the .dmp file, decrypts the embedded payload, and injects the Eternidade Stealer into svchost.exe, allowing the malware to run stealthily under the guise of a trusted system process. Eternidade Stealer, a Delphi-based credential stealer, continuously monitors active windows and running processes for strings associated with banking portals, payment services, and cryptocurrency exchanges and wallets. These include, but are not limited to, Bradesco, BTG Pactual, MercadoPago, Stripe, Binance, Coinbase, MetaMask, and Trust Wallet, highlighting its focus on harvesting sensitive financial and cryptocurrency-related information Malicious Crystal PDF installer campaign In late September 2025, Microsoft Defender Experts (DEX) discovered a malicious campaign conducted by an unknown threat actor centered on an application masquerading as a PDF editor named Crystal PDF. The campaign leveraged malvertising and search engine optimization (SEO) poisoning techniques, using misleading advertisements to lure users into downloading a malicious payload. The attack chain begins when a user clicks the download button for the PDF editor on crystalpdf[.]com. The request is redirected to one of two actor-controlled domains, from which the CrystalPDF.exe payload is downloaded. Users most likely arrived at this website through deceptive advertisements distributed via Google Ads, which served as the primary lure for the campaign. Microsoft suspects that Google Ads were used based on the URL format observed in telemetry: hxxps://smartdwn[.]com/download?v=<GUID>&campaign_id=<ID#>&utm_source=google_b2b&subid=<domainSource>&kw=true&gad_source=5&gad_campaignid=<ID#>&gclid=<>. When CrystalPDF.exe is downloaded and executed on the device, it performs several actions to establish persistence and enable further activity. A copy of the CrystalPDF.exe payload is created in the AppData\Local\Temp\crys directory, and a malicious scheduled task is created to ensure continued execution on the compromised device. In addition, a second binary named Crystal PDF.exe (note the space in the filename) is dropped in the user’s Desktop folder. The attacker configures the payload to run daily at 7:15 AM local system time using a scheduled task named Crystal_updater. When triggered, this scheduled task launches the malicious CrystalPDF.exe, which initiates network connections to three command-and-control domains: negmari[.]com, ramiort[.]com, and strongdwn[.]com. The secondary executable, Crystal PDF.exe, stored in the Desktop directory, establishes network connections to multiple cloudconvert[.]com-related domains. CloudConvert is a legitimate service used to convert files into different formats, including converting various document types into PDF files. Analysis of this file indicates that it is a clean file and is designed to appear as a legitimate application that leverages CloudConvert to provide document-to-PDF conversion functionality. Despite presenting itself as a legitimate PDF conversion and merging tool, CrystalPDF.exe ultimately functions as an information stealer. It covertly hijacks Firefox and Chrome browsers and attempts to access sensitive files located in the AppData\Roaming directory, which stores user-specific configuration and profile data that must persist across sessions. This includes cookies and session data, sign-in and credential caches, and profile settings. By harvesting credentials, tokens, and session cookies stored in the browser, the attacker can bypass standard authentication mechanisms and impersonate the user to gain unauthorized access to accounts and services that the user is authorized to use. Mitigation and protection guidance Microsoft recommends the following mitigations to reduce the impact of trusted platform abuse used to deliver infostealers as discussed in this report. These recommendations draw from established Defender blog guidance patterns and align with protections offered across Microsoft Defender XDR. Organizations can follow these recommendations to mitigate threats associated with this threat: Strengthen user awareness & execution safeguards Educate users on social‑engineering lures, including malvertising redirect chains, fake installers, and ClickFix‑style copy‑paste prompts. Control outbound traffic & staging behavior Block direct access to known C2 infrastructure where possible, informed by your organization’s threat‑intelligence sources. Protect against cross‑platform payloads Harden endpoint defenses around LOLBIN abuse, such as wscript.exe executing Visual Basic scripts. Evaluate activity involving AutoIt and process hollowing, common in platform‑abuse campaigns. Microsoft also recommends the following mitigations to reduce the impact of this threat. Turn on cloud-delivered protection in Microsoft Defender Antivirus or the equivalent for your antivirus product to cover rapidly evolving attacker tools and techniques. Cloud-based machine learning protections block a majority of new and unknown threats. Run EDR in block mode so that Microsoft Defender for Endpoint can block malicious artifacts, even when your non-Microsoft antivirus does not detect the threat or when Microsoft Defender Antivirus is running in passive mode. EDR in block mode works behind the scenes to remediate malicious artifacts that are detected post-breach. Enable network protection and web protection in Microsoft Defender for Endpoint to safeguard against malicious sites and internet-based threats. Encourage users to use Microsoft Edge and other web browsers that support Microsoft Defender SmartScreen, which identifies and blocks malicious websites, including phishing sites, scam sites, and sites that host malware. Allow investigation and remediation in full automated mode to allow Microsoft Defender for Endpoint to take immediate action on alerts to resolve breaches, significantly reducing alert volume. Turn on tamper protection features to prevent attackers from stopping security services. Combine tamper protection with the DisableLocalAdminMerge setting to prevent attackers from using local administrator privileges to set antivirus exclusions. Microsoft Defender XDR customers can also implement the following attack surface reduction rules to harden an environment against LOLBAS techniques used by threat actors: o Block execution of potentially obfuscated scripts o Block executable files from running unless they meet a prevalence, age, or trusted list criterion o Block JavaScript or VBScript from launching downloaded executable content Microsoft Defender XDR detections Microsoft Defender XDR customers can refer to the list of applicable detections below. Microsoft Defender XDR coordinates detection, prevention, investigation, and response across endpoints, identities, email, and apps to provide integrated protection against attacks like the threat discussed in this blog. Customers with provisioned access can also use Microsoft Security Copilot in Microsoft Defender to investigate and respond to incidents, hunt for threats, and protect their organization with relevant threat intelligence. Tactic Observed activity Microsoft Defender coverage Execution - Payloads downloaded using PowerShell Microsoft Defender for Endpoint - Suspicious Powershell download or encoded command execution Persistence - Registry Run key created - Scheduled task created for recurring execution Microsoft Defender for Endpoint - Anomaly detected in ASEP registry - Suspicious Scheduled Task Launched Defense Evasion - Unauthorized code execution facilitated by DLL sideloading and process injection - Python script execution - Renamed AutoIT interpreter binary and AutoIT script Microsoft Defender for Endpoint - An executable file loaded an unexpected DLL file - A process was injected with potentially malicious code - Suspicious Python binary execution - Rename AutoIT tool Discovery - System information queried using WMI and Python Microsoft Defender for Endpoint - Suspicious System Hardware Discovery - Suspicious Process Discovery - Suspicious Security Software Discovery Threat intelligence reports Microsoft customers can use the following reports in Microsoft products to get the most up-to-date information about the threat actor, malicious activity, and techniques discussed in this blog. These reports provide the intelligence, protection information, and recommended actions to prevent, mitigate, or respond to associated threats found in customer environments. Microsoft Defender XDR Threat analytics Malicious Crystal PDF installer campaign Hunting queries Microsoft Defender XDR Microsoft Defender XDR customers can run the following queries to find related activity in their networks: Use the following queries to identify activity related to WhatsApp Abused to Deliver Eternidade Stealer // Identify the files dropped from the malicious VBS execution DeviceFileEvents | where InitiatingProcessCommandLine has_all ("Downloads",".vbs") | where FileName has_any (".zip",".lnk",".bat") and FolderPath has_all ("\\Temp\\") // Identify batch script launching powershell instances to drop payloads DeviceProcessEvents | where InitiatingProcessParentFileName == "wscript.exe" and InitiatingProcessCommandLine has_any ("instalar.bat","python_install.bat") | where ProcessCommandLine !has "conhost.exe" // Identify AutoIT executable invoking malicious AutoIT script DeviceProcessEvents | where InitiatingProcessCommandLine has ".log" and InitiatingProcessVersionInfoOriginalFileName == "Autoit3.exe" Use the following queries to identify activity related to Malicious CrystalPDF Installer Campaign // Identify network connections to C2 domains DeviceNetworkEvents | where InitiatingProcessVersionInfoOriginalFileName == "CrystalPDF.exe" // Identify scheduled task persistence DeviceEvents | where InitiatingProcessVersionInfoProductName == "CrystalPDF" | where ActionType == "ScheduledTaskCreated Indicators of compromise Indicator Type Description 2c885d1709e2ebfcaa81e998d199b29e982a7559b9d72e5db0e70bf31b183a5f 6168d63fad22a4e5e45547ca6116ef68bb5173e17e25fd1714f7cc1e4f7b41e1 3bd6a6b24b41ba7f58938e6eb48345119bbaf38cd89123906869fab179f27433 5d929876190a0bab69aea3f87988b9d73713960969b193386ff50c1b5ffeadd6 bdd2b7236a110b04c288380ad56e8d7909411da93eed2921301206de0cb0dda1 495697717be4a80c9db9fe2dbb40c57d4811ffe5ebceb9375666066b3dda73c3 de07516f39845fb91d9b4f78abeb32933f39282540f8920fe6508057eedcbbea SHA-256 Payloads related to WhatsApp malware campaign 598da788600747cf3fa1f25cb4fa1e029eca1442316709c137690e645a0872bb 3bc62aca7b4f778dabb9ff7a90fdb43a4fdd4e0deec7917df58a18eb036fac6e c72f8207ce7aebf78c5b672b65aebc6e1b09d00a85100738aabb03d95d0e6a95 SHA-256 Payloads related to Malicious Crystal PDF installer campaign hxxps://empautlipa[.]com/altor/installer.msi URL Used to deliver VBS initial access payload (WhatsApp Abused to Deliver Eternidade Stealer) Negmari[.]com Ramiort[.]com Strongdwn[.]com Domain C2 servers (Malicious Crystal PDF installer campaign) Microsoft Sentinel Microsoft Sentinel customers can use the TI Mapping analytics (a series of analytics all prefixed with ‘TI map’) to automatically match the malicious domain indicators mentioned in this blog post with data in their workspace. If the TI Map analytics are not currently deployed, customers can install the Threat Intelligence solution from the Microsoft Sentinel Content Hub to have the analytics rule deployed in their Sentinel workspace. References Infostealers Strike Again: Malicious Installers Pass Through EDRs Undetected SpiderLabs IDs New Banking Trojan Distributed Through WhatsApp Learn more For the latest security research from the Microsoft Threat Intelligence community, check out the Microsoft Threat Intelligence Blog. To get notified about new publications and to join discussions on social media, follow us on LinkedIn, X (formerly Twitter), and Bluesky. To hear stories and insights from the Microsoft Threat Intelligence community about the ever-evolving threat landscape, listen to the Microsoft Threat Intelligence podcast.Hunting Infostealers - Python Stealers
In this next part of the “Hunting Infostealers” series, we’ll cover Python information stealers. The proliferation of Python stealers over the past year has become an escalating concern in the cybersecurity landscape. This gravitation towards Python is largely driven by the ease of use of the language and the availability of tools and frameworks which allow for quick development, even for individuals with limited knowledge of coding. Typically, Python infostealers are distributed via phishing emails to infiltrate systems. The sensitive information they collect includes, but is not limited to login credentials, session cookies, authentication tokens, credit card numbers, and crypto wallet data. To evade detection, threat actors utilize legitimate services such as Telegram for command-and-control communications, obfuscate their code, and use signed and living off the land binaries. Due to the growing threat of Python-based infostealers, it is important that organizations protect their environment by being aware of the tactics, techniques, and procedures used by the threat actors who deploy this type of malware. One of the most notable Python-based infostealers seen in 2025 was PXA Stealer. It harvests sensitive data from infected systems such as login credentials, financial information, and browser data. It is linked to Vietnamese-speaking threat actors who target government and education entities. It is primarily delivered via phishing campaigns that use social engineering to trick users into downloading malicious files onto their computer. Throughout the blog, we map observed activity to Microsoft Defender XDR coverage and provide actionable guidance to help organizations detect, mitigate, and respond to infostealers operating without borders. PXA Stealer: Campaign 1 In October 2025, Microsoft Defender Experts (DEX) identified a campaign involving PXA Stealer. The attack begins with a phishing email with a malicious URL. Some of the observed URLs contained in the emails were hxxp://concursal[.]macquet[.]de/uid_page=244739642061129 and hxxps://tickets[.]pfoten-prinz[.]de/uid_page=118759991475831. The URLs have the same format, but with different domain names and values for the uid_page key. When the user clicks the URL, they are taken to a blank web page that contains JavaScript to download a ZIP file from a remote location, such as allecos[.]de, once the page is fully loaded. The files contained in the ZIP file that are used to execute the next payload include an executable (renamed WinWord.exe) masquerading as a Word document with the same name as the ZIP file, a malicious DLL named msvcr100.dll, and several files used in a series of commands concatenated with “&&” that ultimately execute an obfuscated Python script that loads PXA Stealer and PureRAT. When the renamed WinWord.exe file is executed, msvcr100.dll is sideloaded which leads to the execution of the concatenated command line via cmd.exe. The command line does the following: opens a benign decoy Word document to delay the users’ suspicion and sandbox analysis, uses certutil.exe to decode a base64-encoded blob hidden in DA 성형외과 재무 보고서.pdf which results in a ZIP file named Invoice.pdf (contains Python environment, renamed Python interpreter named svchost.exe, and an obfuscated Python script named images.png), uses another file named images.png (renamed WinRAR.exe) to extract the contents of Invoice.pdf, deletes Invoices.pdf and the renamed WinRAR file, then uses svchost.exe (renamed pythonw.exe) to execute images.png with a Telegram bot identifier that’s used to fetch and execute the next payload. When images.png is executed, it creates a Registry Run key named Windows Update Service to re-execute itself when the user logs in. The script downloads PXA Stealer from urlvanish[.]com (URL shortener), which redirects to bagumedios[.]cloud, then executes the infostealer in its memory space. Before collecting information, the stealer downloads a DLL from Dropbox. The DLL is injected into a Chrome process to bypass Chrome’s App-Bound Encryption (ABE) so sensitive browser information can be stolen. After that, it collects the installed AV products and browser information such as login credentials, cookies, autofill data, and credit card information. That information is archived into a ZIP file with a file name that follows the format "[CountryCode_IPAddress] ComputerName.zip", then it’s exfiltrated using Telegram. Once the exfiltration is complete, images.png downloads another payload from hxxps://bagumedios[.]cloud/assets/media/others/ADN/pure and injects it into cvtres.exe. The payload is a commercially available remote access trojan named PureRAT which proceeds to connect to its command-and-control (C2) server 157.66.27[.]11 (located in Vietnam) over port 56001 after injection. After that, cvtres.exe uses WMI to collect installed AV products, connected cameras, and the Windows OS version. It sends the collected information to its C2 server. Chain PXA Stealer: Campaign 2 In late December 2025, DEX identified another PXA Stealer campaign. This attack also begins with a phishing email that delivers a ZIP archive that masquerades as a PDF, image, or Word document. Some similar TTPs were noted for the second campaign where the use of Living Off-the Land Binaries (LOLBINs) was invoked, such as certutil.exe. The Certutil application is a native Windows application that allows for displaying Certification Authority (CA) configuration information, configure Certificate Services, and backup and restore CA components. The program also verifies certificates, key pairs, and certificate chains. The capability used in Campaign 2 used the decode parameter in Certutil on an encoded PDF. The decoded PDF was then presented to an application with a file extension of “.png”. Further investigation of this application identified command line behavior typical to that of a WinRAR, with a password protected ZIP archive. This obfuscation allowed the application to continue to perform un-archiving steps, ultimately leading to python modules being loaded on the device. Once the Python modules were available, additional activity such as scheduled tasks were created paving the way for update scripts to be deployed on affected hosts. Communication to C2 infrastructure was then initiated through the svchost (Python interpreter) process to connect and transmit data to the attacker via hxxp://195.24.236[.]116/recover/getlink?id=sunset and hxxp://195.24.236[.]116/recover/links/sunset.txt Mitigation and protection guidance Microsoft recommends the following mitigations to reduce the impact of the Python‑based infostealers discussed in this report. These recommendations draw from established Defender blog guidance patterns and align with protections offered across Microsoft Defender XDR. Organizations can follow these recommendations to mitigate threats associated with this threat: Strengthen user awareness & execution safeguards Educate users on social‑engineering lures, such as phishing emails. Control outbound traffic & staging behavior Inspect network egress for POST requests to newly registered or suspicious domains—a key indicator for Python‑based stealer campaigns. Detect transient creation of ZIP archives under ephemeral directories, followed by outbound exfiltration attempts. Block direct access to known C2 infrastructure where possible, informed by your organization’s threat‑intelligence sources. Protect against Python‑based stealers Harden endpoint defenses around LOLBIN abuse, such as certutil.exe decoding malicious payloads. Evaluate abnormal activity involving known processes and files with suspicious file extensions, such as a Python interpreter masquerading as svchost.exe executing a Python script disguised as a PNG file. Microsoft also recommends the following mitigations to reduce the impact of this threat. Turn on cloud-delivered protection in Microsoft Defender Antivirus or the equivalent for your antivirus product to cover rapidly evolving attacker tools and techniques. Cloud-based machine learning protections block a majority of new and unknown threats. Run EDR in block mode so that Microsoft Defender for Endpoint can block malicious artifacts, even when your non-Microsoft antivirus does not detect the threat or when Microsoft Defender Antivirus is running in passive mode. EDR in block mode works behind the scenes to remediate malicious artifacts that are detected post-breach. Enable network protection and web protection in Microsoft Defender for Endpoint to safeguard against malicious sites and internet-based threats. Encourage users to use Microsoft Edge and other web browsers that support Microsoft Defender SmartScreen, which identifies and blocks malicious websites, including phishing sites, scam sites, and sites that host malware. Allow investigation and remediation in full automated mode to allow Microsoft Defender for Endpoint to take immediate action on alerts to resolve breaches, significantly reducing alert volume. Turn on tamper protection features to prevent attackers from stopping security services. Combine tamper protection with the DisableLocalAdminMerge setting to prevent attackers from using local administrator privileges to set antivirus exclusions. Microsoft Defender XDR customers can also implement the following attack surface reduction rules to harden an environment against LOLBAS techniques used by threat actors: o Block execution of potentially obfuscated scripts o Block executable files from running unless they meet a prevalence, age, or trusted list criterion o Block JavaScript or VBScript from launching downloaded executable content Microsoft Defender XDR detections Microsoft Defender XDR customers can refer to the list of applicable detections below. Microsoft Defender XDR coordinates detection, prevention, investigation, and response across endpoints, identities, email, and apps to provide integrated protection against attacks like the threat discussed in this blog. Customers with provisioned access can also use Microsoft Security Copilot in Microsoft Defender to investigate and respond to incidents, hunt for threats, and protect their organization with relevant threat intelligence. Tactic Observed activity Microsoft Defender coverage Execution - Encoded PowerShell commands downloading payload Microsoft Defender for Endpoint - Suspicious Powershell download or encoded command execution - Suspicious script launched Persistence - Registry Run key created - Scheduled task created for recurring execution Microsoft Defender for Endpoint - Anomaly detected in ASEP registry - Suspicious Scheduled Task Launched Defense Evasion - Unauthorized code execution facilitated by DLL sideloading and process injection - Renamed Python interpreter executes obfuscated Python script - Decode payload with certutil Microsoft Defender for Endpoint - An executable file loaded an unexpected DLL file - A process was injected with potentially malicious code - Suspicious Python binary execution - Suspicious certutil activity Microsoft Defender Antivirus - Obfuse' malware was prevented (Trojan:Script/Obfuse!MSR) Credential Access - Credential and Secret Harvesting Microsoft Defender for Endpoint - Possible theft of passwords and other sensitive web browser information - Suspicious access of sensitive files - Suspicious process collected data from local system Discovery - Information queried using WMI and Python Microsoft Defender for Endpoint - Suspicious System Hardware Discovery - Suspicious Process Discovery - Suspicious Security Software Discovery - Suspicious Peripheral Device Discovery Collection - Sensitive browser information compressed into ZIP file for exfiltration Microsoft Defender for Endpoint - Compression of sensitive data - Suspicious Staging of Data - Suspicious archive creation Threat intelligence reports Microsoft customers can use the following reports in Microsoft products to get the most up-to-date information about the threat actor, malicious activity, and techniques discussed in this blog. These reports provide the intelligence, protection information, and recommended actions to prevent, mitigate, or respond to associated threats found in customer environments. Microsoft Defender XDR Threat analytics Ghost in the Zip | New PXA Stealer and Its Telegram-Powered Ecosystem From Custom Scripts to Commodity RATs: A Threat Actor’s Evolution to PureRAT Hunting queries Microsoft Defender XDR Microsoft Defender XDR customers can run the following queries to find related activity in their networks: Use the following queries to identify activity related to PXA Stealer: Campaign 1 // Identify activity initiated by renamed python binary DeviceProcessEvents | where InitiatingProcessFileName endswith "svchost.exe" | where InitiatingProcessVersionInfoOriginalFileName == "pythonw.exe" // Identify network connections initiated by renamed python binary DeviceNetworkEvents | where InitiatingProcessFileName endswith "svchost.exe" | where InitiatingProcessVersionInfoOriginalFileName == "pythonw.exe" Use the following queries to identify activity related to PXA Stealer: Campaign 2 // Identify malicious Process Execution activity DeviceProcessEvents | where ProcessCommandLine has_all ("-y","x",@"C:","Users","Public", ".pdf") and ProcessCommandLine has_any (".jpg",".png") // Identify suspicious process injection activity DeviceProcessEvents | where FileName == "cvtres.exe" | where InitiatingProcessFileName has "svchost.exe" | where InitiatingProcessFolderPath !contains "system32" Indicators of compromise Indicator Type Description 9d867ddb54f37592fa0ba1773323e2ba563f44b894c07ebfab4d0063baa6e777 SHA-256 Payloads related to PXA Stealer: Campaign 1 08a1f4566657a07688b905739055c2e352e316e38049487e5008fc3d1253d03b 5970d564b5b2f5a4723e548374d54b8f04728473a534655e52e5decef920e733 59855f0ec42546ce2b2e81686c1fbc51e90481c42489757ac03428c0daee6dfe a5b19195f61925ede76254aaad942e978464e93c7922ed6f064fab5aad901efc e7237b233fc6fda614e9e3c2eb3e03eeea94f4baf48fe8976dcc4bc9f528429e 59347a8b1841d33afdd70c443d1f3208dba47fe783d4c2015805bf5836cff315 e965eb96df16eac9266ad00d1087fce808ee29b5ee8310ac64650881bc81cf39 hxxps://allecos[.]de/Documentación_del_expediente_de_derechos_de_autor_del_socio.zip URL Used to deliver initial access ZIP file (PXA Stealer: Campaign 1) hxxps://bagumedios[.]cloud/assets/media/others/ADN/pure URL Used to deliver PureRAT payload (PXA Stealer: Campaign 1) hxxp://concursal[.]macquet[.]de/uid_page=244739642061129 URL URL contained in phishing email (PXA Stealer: Campaign 1) hxxps://tickets[.]pfoten-prinz[.]de/uid_page=118759991475831 hxxps://erik22[.]carrd.co URL Used in make network connection and subsequent redirection in (PXA Stealer: Campaign 2) hxxps://erik22jomk77[.]card.co URL Used in make network connection and subsequent redirection in (PXA Stealer: Campaign 2) 157.66.27[.]11 IP Address PureRAT C2 server (PXA Stealer: Campaign 1) 195.24.236[.]116 IP Address C2 server (PXA Stealer: Campaign 2) bagumedios[.]cloud Domain C2 server (PXA Stealer: Campaign 1) Microsoft Sentinel Microsoft Sentinel customers can use the TI Mapping analytics (a series of analytics all prefixed with ‘TI map’) to automatically match the malicious domain indicators mentioned in this blog post with data in their workspace. If the TI Map analytics are not currently deployed, customers can install the Threat Intelligence solution from the Microsoft Sentinel Content Hub to have the analytics rule deployed in their Sentinel workspace. References A Vietnamese threat actor's shift from PXA Stealer to PureRAT | Huntress Ghost in the Zip | New PXA Stealer and Its Telegram-Powered Ecosystem | SentinelOne Information-Stealing Malware Distribution Campaign Using Emails Disguised as Copyright Infringement Notices – wizSafe Security Signal -Guideposts to Safety and Security- IIJ Learn more For the latest security research from the Microsoft Threat Intelligence community, check out the Microsoft Threat Intelligence Blog. To get notified about new publications and to join discussions on social media, follow us on LinkedIn, X (formerly Twitter), and Bluesky. To hear stories and insights from the Microsoft Threat Intelligence community about the ever-evolving threat landscape, listen to the Microsoft Threat Intelligence podcast.Hunting Infostealers - macOS Threats
The “Hunting Infostealers” blog series covers the ever-evolving threat of infostealers. Infostealers have gone from simple credential theft to subscription-based threats (i.e., Malware-as-a-Service) driving modern cybercrime. Threat actors target sensitive information such as browser data, cookies, and session tokens that can later be used for account takeovers or to fuel data breaches, ransomware attacks, and supply chain attacks. In this blog series, Microsoft Defender Experts examine how modern infostealers operate across operating systems and delivery channels by blending into legitimate ecosystems and evading conventional defenses. In this first part of the series, we highlight the rise of macOS-specific infostealers—including families such as DigitStealer, MacSync, and Atomic macOS (AMOS)—that abuse native utilities, user-initiated execution flows, and social-engineering techniques like “ClickFix” installers to harvest credentials and sensitive data. Throughout the blog, we map observed activity to Microsoft Defender XDR coverage and provide actionable guidance to help organizations detect, mitigate, and respond to infostealers. macOS Threats Since late 2025, Microsoft Defender Experts (DEX) has observed macOS targeted infostealer campaigns delivered through social engineering techniques, including ClickFix style prompts and malicious DMG downloads. These attacks rely on user interaction to initiate execution and are designed to steal credentials, session material, and infrastructure secrets that can enable account takeover, financial theft, and follow on compromise of cloud and developer resources. Once executed, the malware abuses trusted macOS functionality to collect a wide range of personal, financial, and enterprise related information. Stolen data can include browser authentication material, operating system credential stores, access keys used for cloud services, and artifacts commonly present on developer or administrator workstations. The potential impact of this threat extends beyond the infected device. Compromised credentials and session material can enable attackers to take over online accounts, access cloud and enterprise resources, steal cryptocurrency assets, and perform follow on intrusion activity without needing to maintain persistence on the original system. In organizational environments, this can lead to broader security incidents, including unauthorized access to internal services, cloud environments, or third-party platforms. DigitStealer In November 2025, Microsoft Defender Experts (DEX) identified a macOS infostealer campaign tracked as DigitStealer, delivered via a spoofed “DynamicLake” lure. The infection chain begins when users browse to a deceptive domain such as dynamiclake[.]org and download an unsigned disk image DynamicLake.dmg, then follow a “drag‑into‑Terminal” execution path that helps bypass Gatekeeper protections. Once mounted, DigitStealer executes a Bash-based dropper that uses native tooling (notably curl) to retrieve staged payloads from Cloudflare Pages such as hxxps://b93b559cf522386018e24069ff1a8b7a[.]pages[.]dev/703d2315783f48c0563836f02a3421ed.aspx. In subsequent stages, the malware performs host profiling with system_profiler and uses AppleScript/JXA to drive credential theft and collection, staging artifacts in temporary locations (commonly under /tmp) before compressing content into ZIP archives for outbound transfer. For exfiltration and C2, DigitStealer uses HTTPS POSTs to structured endpoints and API routes such as /api/grabber, /api/log, and /api/poll, where /api/poll is used for beaconing/tasking while upload routes handle stolen archives. Persistence is established via a macOS LaunchAgent, which can retrieve follow‑on instructions via DNS TXT records (observed use of dig + curl) and immediately execute newly fetched payloads via JXA. In higher‑value (crypto‑focused) scenarios, DigitStealer targets wallet workflows including Ledger Live, and has been observed manipulating user friction and visibility by suppressing prompts (TCC-related behavior) and tampering with wallet application assets (e.g., Ledger Live.app.asar) to facilitate hijacking. MacSync In December 2025, Microsoft Defender Experts (DEX) identified a fileless macOS infostealer campaign referred to as MacSync Stealer, commonly delivered via malvertising and ClickFix-style lures that instruct users to copy/paste commands into Terminal rather than running a traditional installer. DEX has broadly observed these macOS-targeted infostealer campaigns delivered through ClickFix prompts and malicious DMG downloads in late 2025. During observed MacSync activity, no standalone binaries are dropped. Instead, execution is driven by an in‑memory pipeline that invokes curl with TLS verification disabled, streaming the response directly through decoding/decompression (e.g., curl … | base64 -d | gunzip) without writing intermediate files to disk. This technique reduces disk artifacts and pushes detection toward process/network telemetry rather than file hashes. MacSync then leverages osascript to indirectly invoke shell execution (e.g., sh -c) to blend into legitimate macOS automation, while harvesting a wide set of artifacts across browsers and credential stores. High‑signal targeted files include Chrome databases (Cookies / Login Data / Web Data), Firefox stores (cookies.sqlite / logins.json / key4.db /cert9.db), macOS Keychains (*.keychain-db), and developer/cloud secrets including SSH keys, AWS credentials, Kubernetes config files, plus shell history such as .zsh_history.(Observed in telemetry write‑up you provided.) Staging and exfiltration are similarly low‑footprint: data is staged under /tmp using the pattern /tmp/sync[0-9]{7}, compressed using the built‑in ditto utility, and exfiltrated via HTTP POST to attacker infrastructure using a legitimate macOS browser user‑agent. Requests use custom headers (including an API key) to authenticate and manage tasking. Post‑exfiltration cleanup deletes staged directories, reinforcing the transient nature of the intrusion. Atomic Stealer (AMOS) In January 2026, Microsoft Defender Experts (DEX) observed active exploitation by Atomic macOS Stealer (AMOS), a highly automated and full‑featured macOS infostealer capable of progressing from initial user interaction to persistent command‑and‑control within minutes. Telemetry shows a modular, high‑throughput campaign optimized for credential harvesting, cryptocurrency theft, and long‑term operator control using exclusively native macOS tooling. Initial access was achieved through redirect‑based delivery chains that guided victims through multiple intermediary domains—alliai[.]com and alli‑ai[.]pro—before downloading a malicious disk image (AlliAi.dmg) hosted on newly registered infrastructure (ai[.]foqguzz[.]com). Upon execution, the unsigned application launched under App Translocation, indicating execution from an untrusted path and effectively bypassing Gatekeeper enforcement. Immediately after launch, the trojanized application executed its embedded binary (observed as FXSound) via xpcproxy, establishing outbound network connectivity to attacker‑controlled infrastructure (day.foqguzz[.]com) and spawning a staged Bash loader. The loader decoded and executed a Base64‑encoded script and used curl as an ingress tool transfer mechanism to retrieve next‑stage payloads from hxxp://217.119.139[.]117/d/dayd96331, completing a classic multi‑stage stager pattern. Once staged, AMOS executed a large modular AppleScript payload via osascript, driving extensive system discovery and data collection. Harvested artifacts included macOS Keychains (for example ~/Library/Keychains/login.keychain‑db), browser credentials and session data from Chrome, Edge, Safari, and Firefox (including SafariCookies.binarycookies), Apple Notes databases, desktop and document files, and deep inspection of browser‑based cryptocurrency wallets through IndexedDB enumeration and targeted extension directory scanning. System metadata was collected via system_profiler to uniquely identify compromised hosts and support operator tasking. Stolen data was staged under /tmp/17936/, compressed using the built‑in ditto utility into /tmp/out.zip, and exfiltrated via HTTP POST requests to hxxp://217.119.139[.]117/log. Exfiltration requests included custom headers—such as buildid, username, and cid—to uniquely identify victims and manage backend processing. AMOS incorporated retry logic and backoff mechanisms to ensure reliable data transfer before deleting local staging artifacts. For persistence, AMOS installed a root‑level LaunchDaemon (for example /Library/LaunchDaemons/com.<random>.plist) that re‑executed a Base64‑decoded AppleScript payload at system startup. This established a botnet‑style polling loop to endpoints such as /api/v1/bot/joinsystem/<botid>/<macOS_version> and /api/v1/bot/actions/<botid>, enabling operators to issue commands including doshell, repeat, enablesocks5, and uninstall. The observed activity demonstrates a mature macOS stealer architecture optimized for stealth, scalability, and continuous remote control. Shared Characteristics Across macOS Infostealer Campaigns Despite differences in tooling and maturity, DigitStealer, MacSync Stealer, and Atomic macOS (AMOS) exhibit a converging macOS infostealer tradecraft driven by user‑initiated execution, fileless delivery, and deep abuse of native macOS frameworks. All three campaigns rely on social engineering—such as malvertising, redirect chains, or ClickFix‑style prompts—to coerce users into mounting unsigned DMGs or executing commands directly in Terminal, effectively bypassing Gatekeeper through explicit user action. Payload delivery is predominantly fileless and multi‑stage, leveraging native utilities such as curl piped through Base64 decoding and decompression for in‑memory execution. Extensive use of AppleScript and JavaScript for Automation (JXA), alongside additional living‑off‑the‑land binaries (system_profiler, dscl, ditto, and shell interpreters), enables attackers to execute complex workflows while blending malicious activity into legitimate system automation. All three campaigns aggressively harvest credentials and sensitive artifacts from browsers, macOS Keychains, and developer or cloud environments, while explicitly probing cryptocurrency wallets to prioritize financially valuable victims. Stolen data is staged temporarily (commonly under /tmp), compressed using built‑in archiving utilities, and exfiltrated via HTTP or HTTPS POST requests that mimic legitimate browser traffic, followed by immediate cleanup. Where persistence is required, campaigns rely on LaunchAgents or LaunchDaemons and dynamic tasking mechanisms (such as C2 polling or DNS‑based updates) to maintain access without redeployment. Taken together, these behaviors highlight why macOS has become an increasingly attractive target: growing adoption in enterprise and developer environments, a rich set of built‑in automation and scripting capabilities that favor living‑off‑the‑land tradecraft, persistent user trust in installer and Terminal workflows, and the widespread presence of browser‑based and native cryptocurrency wallets on a single host. These factors have enabled the rise of scalable, high‑volume macOS infostealer ecosystems that rival traditional Windows‑centric campaigns in both sophistication and impact. Mitigation and protection guidance Microsoft recommends the following mitigations to reduce the impact of the macOS‑focused threats discussed in this report. These recommendations draw from established Defender blog guidance patterns and align with protections offered across Microsoft Defender XDR. Organizations can follow these recommendations to mitigate threats associated with this threat: Strengthen user awareness & execution safeguards Educate users on social‑engineering lures, including malvertising redirect chains, fake installers, and ClickFix‑style copy‑paste prompts common across macOS stealer campaigns such as DigitStealer, MacSync, and AMOS. Discourage installation of unsigned DMGs or unofficial “terminal‑fix” utilities; reinforce safe‑download practices for consumer and enterprise macOS systems. Harden macOS environments against native tool abuse Monitor for suspicious Terminal activity—especially execution flows involving curl, Base64 decoding, gunzip, osascript, or JXA invocation, which appear across all three macOS stealers. Detect patterns of fileless execution, such as in‑memory pipelines using curl | base64 -d | gunzip, or AppleScript‑driven system discovery and credential harvesting. Leverage Defender’s custom detection rules to alert on abnormal access to Keychain, browser credential stores, and cloud/developer artifacts, including SSH keys, Kubernetes configs, AWS credentials, and wallet data. Control outbound traffic & staging behavior Inspect network egress for POST requests to newly registered or suspicious domains—a key indicator for DigitStealer, MacSync, and AMOS. Detect transient creation of ZIP archives under /tmp or similar ephemeral directories, followed by outbound exfiltration attempts. Block direct access to known C2 infrastructure where possible, informed by your organization’s threat‑intelligence sources. Microsoft also recommends the following mitigations to reduce the impact of this threat. Turn on cloud-delivered protection in Microsoft Defender Antivirus or the equivalent for your antivirus product to cover rapidly evolving attacker tools and techniques. Cloud-based machine learning protections block a majority of new and unknown threats. Run EDR in block mode so that Microsoft Defender for Endpoint can block malicious artifacts, even when your non-Microsoft antivirus does not detect the threat or when Microsoft Defender Antivirus is running in passive mode. EDR in block mode works behind the scenes to remediate malicious artifacts that are detected post-breach. Enable real-time protection for macOS in Microsoft Defender Antivirus. Enable real-time behavior monitoring for macOS in Microsoft Defender Antivirus. Enable network protection for macOS in Microsoft Defender for Endpoint. Encourage users to use Microsoft Edge and other web browsers that support Microsoft Defender SmartScreen, which identifies and blocks malicious websites, including phishing sites, scam sites, and sites that host malware. Allow investigation and remediation in full automated mode to allow Microsoft Defender for Endpoint to take immediate action on alerts to resolve breaches, significantly reducing alert volume. Turn on tamper protection features to prevent attackers from stopping security services. Combine tamper protection with the DisableLocalAdminMerge setting to prevent attackers from using local administrator privileges to set antivirus exclusions. Microsoft Defender XDR detections Microsoft Defender XDR customers can refer to the list of applicable detections below. Microsoft Defender XDR coordinates detection, prevention, investigation, and response across endpoints, identities, email, and apps to provide integrated protection against attacks like the threat discussed in this blog. Customers with provisioned access can also use Microsoft Security Copilot in Microsoft Defender to investigate and respond to incidents, hunt for threats, and protect their organization with relevant threat intelligence. Tactic Observed activity Microsoft Defender coverage Execution - Execution of various commands and scripts via osascript and sh Microsoft Defender for Endpoint - Suspicious piped command launched - Suspicious AppleScript activity - Suspicious script launched Persistence - LaunchAgent or LaunchDaemon for recurring execution Microsoft Defender for Endpoint - Suspicious Pslist modifications - Suspicious launchctl tool activity Microsoft Defender Antivirus - Trojan:AtomicSteal.F Defense Evasion - Delete data staging directories Microsoft Defender for Endpoint - Suspicious path deletion Credential Access - Credential and Secret Harvesting - Cryptocurrency probing Microsoft Defender for Endpoint - Suspicious access of sensitive files - Suspicious process collected data from local system - Unix credentials were illegitimately accessed Collection - Sensitive browser information compressed into ZIP file for exfiltration Microsoft Defender for Endpoint - Compression of sensitive data - Suspicious Staging of Data - Suspicious archive creation Exfiltration - Exfiltration through curl Microsoft Defender for Endpoint - Suspicious file or content ingress - Network connection by osascript Threat intelligence reports Microsoft customers can use the following reports in Microsoft products to get the most up-to-date information about the threat actor, malicious activity, and techniques discussed in this blog. These reports provide the intelligence, protection information, and recommended actions to prevent, mitigate, or respond to associated threats found in customer environments. Microsoft Defender XDR Threat analytics From ClickFix to code signed: the quiet shift of MacSync Stealer malware MacSync infostealer campaigns leverage social engineering Hunting queries Microsoft Defender XDR Microsoft Defender XDR customers can run the following queries to find related activity in their networks: Use the following queries to identify activity related to DigitStealer // Identify suspicious DynamicLake disk image (.dmg) mounting DeviceProcessEvents | where FileName has_any ('mount_hfs', 'mount') | where ProcessCommandLine has_all ('-o nodev' , '-o quarantine') | where ProcessCommandLine contains '/Volumes/Install DynamicLake' // Identify data exfiltration to DigitStealer C2 API endpoints. DeviceProcessEvents | where InitiatingProcessFileName has_any ('bash', 'sh') | where ProcessCommandLine has_all ('curl', '--retry 10') | where ProcessCommandLine contains 'hwid=' | where ProcessCommandLine endswith "api/credentials" or ProcessCommandLine endswith "api/grabber" or ProcessCommandLine endswith "api/log" | extend APIEndpoint = extract(@"/api/([^\s]+)", 1, ProcessCommandLine) Use the following queries to identify activity related to MacSync // Identify exfiltration of staged data via curl DeviceProcessEvents | where InitiatingProcessFileName =~ "zsh" and FileName =~ "curl" | where ProcessCommandLine has_all ("curl -k -X POST -H", "api-key: ", "--max-time", "-F file=@/tmp/", ".zip", "-F buildtxd=") Use the following queries to identify activity related to Atomic Stealer (AMOS) // Identify suspicious AlliAi disk image (.dmg) mounting DeviceProcessEvents | where FileName has_any ('mount_hfs', 'mount') | where ProcessCommandLine has_all ('-o nodev', '-o quarantine') | where ProcessCommandLine contains '/Volumes/ALLI' Indicators of compromise Indicator Type Description 3e20ddb90291ac17cef9913edd5ba91cd95437da86e396757c9d871a82b1282a da99f7570b37ddb3d4ed650bc33fa9fbfb883753b2c212704c10f2df12c19f63 SHA-256 Payloads related to DigitStealer campaign 42d51feea16eac568989ab73906bbfdd41641ee3752596393a875f85ecf06417 SHA-256 Payload related to Atomic Stealer (AMOS) 217.119.139[.]117 IP Address AMOS C2 server (AMOS campaign) dynamiclake[.]org Domain Deceptive domain used to deliver unsigned disk image. (DigitStealer campaign) booksmagazinetx[.]com goldenticketsshop[.]com Domain C2 servers (DigitStealer campaign) b93b559cf522386018e24069ff1a8b7a[.]pages[.]dev 67e5143a9ca7d2240c137ef80f2641d6[.]pages[.]dev Domain CloudFlare Pages hosting payloads. (DigitStealer campaign) barbermoo[.]coupons barbermoo[.]fun barbermoo[.]shop barbermoo[.]space barbermoo[.]today barbermoo[.]top barbermoo[.]world barbermoo[.]xyz Domain C2 servers (MacSync Stealer campaign) alli-ai[.]pro Domain Deceptive domain that redirects user after CAPTCHA verification (AMOS campaign) ai[.]foqguzz[.]com Domain Redirected domain used to deliver unsigned disk image. (AMOS campaign) Day[.]foqguzz[.]com Domain C2 server (AMOS campaign) Microsoft Sentinel Microsoft Sentinel customers can use the TI Mapping analytics (a series of analytics all prefixed with ‘TI map’) to automatically match the malicious domain indicators mentioned in this blog post with data in their workspace. If the TI Map analytics are not currently deployed, customers can install the Threat Intelligence solution from the Microsoft Sentinel Content Hub to have the analytics rule deployed in their Sentinel workspace. References MacSync Stealer Evolves: From ClickFix to Code-Signed Swift Malware — Jamf Threat Labs Learn more For the latest security research from the Microsoft Threat Intelligence community, check out the Microsoft Threat Intelligence Blog. To get notified about new publications and to join discussions on social media, follow us on LinkedIn, X (formerly Twitter), and Bluesky. To hear stories and insights from the Microsoft Threat Intelligence community about the ever-evolving threat landscape, listen to the Microsoft Threat Intelligence podcast.
Part 3: Build custom email security reports with Power BI and workbooks in Microsoft Sentinel
TL;DR: We're releasing a brand-new Power BI template for email security reporting and a major update (v3) to the Microsoft Sentinel workbook. Both solutions share the same rich visuals and insights. Choose Power BI for quick deployment without Sentinel, or the Sentinel workbook for extended data retention and multi-tenant scenarios. Get started in minutes with either option. Introduction Security teams in both small and large organizations track key metrics to make critical security decisions and identify meaningful trends in their organizations. While Microsoft Defender for Office 365 provides rich, built-in reporting capabilities, many security teams need custom reporting solutions to create dedicated views, combine multiple data sources, and derive deeper insights tailored to their unique requirements. Earlier last year (Part 1 and Part 2) we shared examples of how you can use workbooks in Microsoft Sentinel to build a custom email security insights dashboard for Microsoft Defender for Office 365. Today, we are excited to announce the release of a new Power BI template file for Microsoft Defender for Office 365 customers, along with an updated version of the Microsoft Defender for Office 365 Detections and Insights workbook in Microsoft Sentinel. Both solutions share the same visual design and structure, giving you a consistent experience regardless of which platform you choose. Power BI template file - Microsoft Defender for Office 365 Detections and Insights: Microsoft Sentinel workbook - Microsoft Defender for Office 365 Detections and Insights: NEW: Power BI template file for Microsoft Defender for Office 365 Detections and Insights This custom reporting template file utilizes Power BI and Microsoft Defender XDR Advanced Hunting through the Microsoft Graph security API. It is designed for Microsoft Defender for Office 365 customers who have access to Advanced Hunting but are not using Microsoft Sentinel. Advanced Hunting data in Microsoft Defender for Office 365 tables is available for up to 30 days. The reporting template uses these same data tables to visualize insights into an organization's email security, including protection, detection, and response metrics provided by Microsoft Defender for Office 365. Note: If data retention beyond 30 days is required, customers can use the Microsoft Defender for Office 365 Detections and Insights workbook in Microsoft Sentinel. You can find the new .pbit template file and detailed instructions on how to set up and use it in the unified Microsoft Sentinel and Microsoft 365 Defender GitHub repository. This new Power BI template uses the same visuals and structure as the Microsoft Defender for Office 365 Detections and Insights workbook in Microsoft Sentinel, providing an easy way to gain deep email security insights across a wide range of use cases. UPDATED: Microsoft Defender for Office 365 Detections and Insights workbook in Microsoft Sentinel We are excited to announce the release of a new version (3.0.0) of the Microsoft Defender for Office 365 Detections and Insights workbook in Microsoft Sentinel. The workbook is part of the Microsoft Defender XDR solution in Microsoft Sentinel and can be installed and started to use with a few simple clicks. In this new release we incorporated feedback we have received from many customers in the past few months to add new visuals, updated existing visuals and add insights focusing on security operations. What’s New Here are some notable changes and new capabilities available in the updated workbook template. Improved structure: Headings and grouped insights have been added to tabs for easier navigation and understanding of metrics. Contextual explanations: Each tab, section, and visual now includes descriptions to help users interpret insights effectively. Drill-down capability: A single “Open query link” action allows users to view the underlying KQL query for each visual, enabling quick investigation and hunting by modifying conditions or removing summaries to access raw data. Detection Dashboard tab enhancements: Added an example Effectiveness metric, updated visuals to focus on overall Microsoft Defender for Office 365 protection values, and introduced new sections for Emerging Threats and Microsoft 365 Secure Email Gateway Performance. New Security Operations Center (SOC) Insights tab: Provides operational metrics such as Security Incident Response, Investigation, and Response Actions for SOC teams. Advanced threat insights: Includes new LLM-based content analysis detections and threat classification insights on the Emails – Phish Detections tab. External forwarding insights: Added deep visibility into Inbox rules and SMTP forwarding in Outlook, including destination details to assess potential data leakage risks. Geo-location improvements: Sender IPv4 insights now include top countries for better geographic context for each Threat types (Malware, Spam, Phish). Enhanced top attacked users and top senders: Added TotalEmailCount and Bad_Traffic_Percentage for richer context in top attacked users and senders charts. Expanded URL click insights: URL click-based threat detection visuals now include Microsoft 365 Copilot as a workload. How to use the workbook across multiple tenants If you manage multiple environments with Microsoft Sentinel — or you are an MSSP (Managed Security Service Provider) working across multiple customer tenants — you can also use the workbook in multi‑tenant scenarios. Once the required configuration is in place, you can change the Subscription and Workspace parameters in the workbook to be multi select and load data from one or multiple tenants. This enables to see deep email security insights in multi‑tenant environments, including: Aggregated multi‑tenant view: You can view aggregated insights across tenants in a single workbook view. By multi‑selecting tenants in the Subscription and Workspace parameters, the workbook automatically loads and combines data from all selected environments for all visuals on all tabs. Side‑by-side‑ comparison: For example, you can compare phishing detection trends or top attacked users across two or more tenants simply by opening the workbook in two browser windows placed side by side. Note: For the multiselect option‑ to work in the current workbook version, you need to manually adjust the Subscription and Workspace parameters. This configuration is planned to become the default in the next release of the workbook. Until then, you can simply apply this change using the workbook’s Edit mode. How to get the updated workbook version The latest version of the Microsoft Defender for Office 365 Detections and Insights workbook is available as part of the Microsoft Defender XDR solution in the Microsoft Sentinel - Content hub. Version 3.0.13 of the solution has the updated workbook template. If you already have the Microsoft Defender XDR solution deployed, version 3.0.13 is available now as an update. After you install the update, you will have the new workbook template available to use. Note: If you had the workbook saved from a previous template version, make sure you delete the old workbook and use the save button on the new template to recreate a new local version with the latest updates. If you install the Microsoft Defender XDR solution for the first time, you are deploying the latest version and will have the updated template ready to use. How to edit and share the workbook with others You can customize each visual easily. Simply edit the workbook after saving, then adjust the underlying KQL query, change the type of the visual, or create new insights. More information: Visualize your data using workbooks in Microsoft Sentinel | Microsoft Learn Granting other users access to the workbook also possible, see the Manage Access to Microsoft Sentinel Workbooks with Lower Scoped RBAC on the Microsoft Sentinel Blog. Do you have feedback related to reporting in Microsoft Defender for Office 365? You can provide direct feedback via filling the form: aka.ms/mdoreportingfeedback Do you have questions or feedback about Microsoft Defender for Office 365? Engage with the community and Microsoft experts in the Defender for Office 365 forum. More information Integrate Microsoft Defender XDR with Microsoft Sentinel Learn more about Microsoft Sentinel workbooks Learn more about Microsoft Defender XDRMicrosoft Ignite 2025: Transforming Phishing Response with Agentic Innovation
Phishing attacks remain one of the most persistent and damaging threats to organizations worldwide. Security teams are under constant pressure to investigate a growing number of user reported phishing emails daily, ensuring accurate verdicts and timely responses. As threats grow in volume and sophistication, SOC teams are forced to spend valuable time triaging and investigating, often at the expense of strategic defense and proactive threat hunting. At Microsoft Ignite 2025 we are delivering innovation that showcases our continued commitment to infuse AI agents, and agentic workflows into the core of our email security solution and SOC operations to automate repetitive tasks, accelerate investigations, and provide transparent, actionable insights for every reported phishing email. In addition, we continue to invest in our ecosystem partnerships to empower customers with seamless integrations, as they adopt layered security solutions to comply with regulatory requirements, enhance detection, and ensure robust protection. Today I’m excited to announce: General Availability of the Security Alert Triage Agent (previously named Phishing Triage Agent) Agentic Email Grading System in Microsoft Defender Cisco and VIPRE Security Group join the Microsoft Defender ICES ecosystem Note: The Phishing Triage Agent has since been expanded and is now called the Security Alert Triage Agent. Learn more at aka.ms/SATA The Security Alert Triage Agent is now generally available In March 2025, we introduced the Security Alert Triage Agent, designed to autonomously handle user-submitted phishing reports at scale. The agent classifies incoming alerts, resolves false positives, and escalates only the malicious cases that require human expertise. Today, we’re announcing its general availability. We will also be extending the agent to triage alerts for identity and cloud alerts. The Security Alert Triage Agent automates repetitive tasks, accelerates investigations, and every decision is transparent, allowing security teams to focus on what matters most—investigating real threats and strengthening the overall security posture. Early results prove how it is transforming analyst work: Identified 6.5X more malicious alerts Improved verdict accuracy by 77% Agent supported analysts spent 53% more time investigating real threats Agentic email grading: Advanced analysis of phishing email submissions When customers report suspicious messages to Microsoft, they expect clarity, speed, and actionable insights to protect their environment. They expect a response they can trust, understand easily, and take additional investigation and response action for the organization. Previously, when customers reported messages to Microsoft, our response depended largely on manual human grader reviews, creating delays and inconsistent verdicts. Customers often waited several hours for a response, and sometimes it lacked clarity on how a verdict was reached. Today, we are excited to announce that we integrated an agentic grading system into the Microsoft Defender submission analysis and response workflow when customers report phishing messages to Microsoft. Image 2: Agentic Email Grading: Advanced analysis of phishing email submissions The agentic grading system brings a new level of speed and transparency to phishing analysis. It uses large language models (LLMs) orchestrated within an agentic workflow to analyze phishing emails, assess the full content of a submitted email, and communicate context and related metadata. This system combines advanced AI with existing machine learning models and human review for additional levels of accuracy and transparency for decision making. Every verdict comes with higher quality, clear verdicts, and context-rich explanations tailored to each phishing email submission. Additionally, it establishes a feedback mechanism that enhances continuous learning and self-healing, thereby strengthening and optimizing protection over time. By reducing reliance on manual reviews, users will experience lower wait times, faster responses and higher-quality results. It will enable security teams to respond promptly and act confidently against phishing threats. Over time we plan to expand beyond phishing verdicts to include spam, scam, bulk, and clean classifications, making the process more comprehensive. The system will continue to evolve through feedback and adapt to emerging attack patterns. How to view agentic submission responses in Microsoft Defender When you report a suspicious email—whether as an admin or an end user—you can now see how Microsoft Defender’s new agentic grading system evaluates your submission. To view agentic grading system responses, follow the steps below: Report the suspicious email Submit the email through the admin submission or user-reported submission process. Sign in to Microsoft Defender Go to https://security.microsoft.com. Navigate to Submissions From the left menu, select: Investigation & response > Actions & submissions > Submissions. Choose the correct tab Emails for admin submissions User reported for user submissions Open the submission details Click the email submission you want to review. A flyout panel will display Result details. Look for the Agentic AI note If the verdict was generated by Agentic AI, you’ll see: “AI-generated content may be incorrect. Check it for accuracy.” Image 3: AI generated explainable verdicts Expanding the Integrated Cloud Email Security (ICES) ecosystem In June, we introduced the Microsoft Defender ICES vendor ecosystem, a unified framework that enables seamless integration of Microsoft’s Defender’s email security solution with trusted third-party vendors. Today we are excited to announce two new partners: Cisco and VIPRE Security Group. The addition of these partners to our ecosystem reinforces our ongoing commitment to support customers in their choice to strategically layer their email security solutions. Organizations benefit from a unified quarantine experience, and a deep integration across the various SOC experiences including threat explorer, advanced hunting, and the email entity page, while providing clear insight into detection efficacy of each solution. As we continue to innovate, our commitment remains steadfast: empowering defenders with intelligent, transparent, and integrated security solutions that adapt to the evolving threat landscape. By infusing agentic AI into every layer of Microsoft Defender, expanding our ecosystem of trusted partners, and delivering faster, more actionable insights, we’re helping organizations build resilience and stay ahead of attackers. Our strategy is rooted in delivering real value making security simpler, more effective, and adapted to the needs of every customer. Learn More: Want to know what else is new in Microsoft Defender at Ignite 2025 check out the blog here. For info on how to complete admin phish submissions, please see For end user reported phish submissions, you need to have it configured for reporting messages to Microsoft. Set it up today. Join us at Microsoft Ignite Join us at Microsoft Ignite to see these advancements in action and discover how intelligent, agentic defense is becoming accessible to every organization. Don’t miss our featured sessions: AI vs AI: Protect email and collaboration tools with Microsoft Defender on Thursday, November 20 th . Learn More. Microsoft Defender: Building the agentic SOC with guest Allie Mellen on Wednesday, November 19 th . Learn more. Empowering the SOC: Security Copilot and the rise of Agentic Defense on Friday, November 21 st . Learn more.Sploitlight: Hunting Beyond the Patch
Many people aren’t aware that Microsoft security isn't just about Microsoft, it’s also about the platforms supporting the products we build. This means our reach extends across all operating systems: iOS, Android, Linux, and macOS! In early 2025 Microsoft disclosed CVE-2025-31199, a macOS vulnerability that abused Spotlight, macOS’s metadata importer framework to bypass Transparency, Consent, and Control (TCC). After the Defender team reported this to Apple, a patch was released that closed the hole. But, the underlying behavior behind the threat still matters to Microsoft! Once attackers learn that trusted macOS services can be redirected, they will reuse the method for nefarious purposes, so it is important to track them down. The next variant won’t look the same, and Spotlight is a commonly targeted service. [1] So, in this article, we teach you how to hunt beyond the patch! Why Hunt for Sploitlight Spotlight importers (.mdimporter) extend macOS indexing. They normally process metadata for search visibility. Attackers can twist that design to index protected files, extract sensitive data, or trigger code execution, perhaps with elevated system trust and privileges. Even with the patch in place, the same logic paths remain valuable targets for attackers. We recommend hunting for patterns around importers, indexing behavior, and TCC privileged binaries to help detect attempts to rebuild this chain of abuse. Advanced Hunting Queries (AHQs) 1. Detect Unusual Spotlight Importer Activity Looking for manual invocations of mdimport may tip you off to attacker activity DeviceProcessEvents |where ProcessCommandLine contains "mdimport" OR DeviceProcessEvents | where ProcessCommandLine contains "mdimport" | where isempty(extract(@"-(\w+)", 1, ProcessCommandLine)) == false | extend mdimportFlag = extract(@"-(\w+)", 1, ProcessCommandLine) | where mdimportFlag in~ ("r", "i", "t", "L") Why it’s important: A Spotlight plugin being developed or tested will be called from the command line using the mdimport utility. For a wide-sweeping query, just search for mdimport alone. However, to get more granular, you can search for it with common parameters such as "r", "i", "t", or "L". 2. Investigate Anomalous Spotlight Activity Use this query to monitor Spotlight activity in the background DeviceProcessEvents | where FileName in~ ("mdworker", "mdworker_shared") Why it’s important: The Advanced Hunting Portal creates timelines for you to quickly zoom in on abnormal behavior, and peaks can show when new Spotlight plugins are invoked. Defender Recommendations Establish a baseline of normal Spotlight activity before setting detection thresholds. Tag importer activity by TCC domain to surface unexpected access. Correlate unsigned importer drops with system events such as privilege escalation or installer execution. Deploy these AHQs in Microsoft Defender XDR or Sentinel for continuous telemetry review. The Bigger Picture The point isn’t to memorize CVEs. It’s to understand the logic that made them possible and look for it everywhere else. Threat actors don’t repeat exploits; they repeat success patterns. Visibility is the only real control. If a process touches data, moves it, or indexes it, it’s part of your attack surface. Treat it that way. 👉 Join the Defender Experts S.T.A.R. Forum to see Sploitlight detection strategies and live hunting demonstrations: Defender Experts Webinar Series [1] References: https://theevilbit.github.io/posts/macos_persistence_spotlight_importers/ https://www.blackhat.com/docs/us-15/materials/us-15-Wardle-Writing-Bad-A-Malware-For-OS-X.pdf https://newosxbook.com/home.html https://www.microsoft.com/en-us/security/blog/2025/07/28/sploitlight-analyzing-a-spotlight-based-macos-tcc-vulnerability/Delivering more threat hunting insights with Microsoft Defender Experts’ newest capabilities
The cybersecurity threat landscape continues to evolve with novel attacks and techniques emerging each day. Microsoft Defender Experts for Hunting, included with Microsoft Defender Experts for XDR, helps security teams stay ahead of evolving attacks by providing proactive threat hunting, powered by Microsoft’s vast threat intelligence with 100 trillion daily signals processed by over 10,000 experts. To date, our managed threat hunting reports have provided details about the hunts we conduct after observing suspicious activity, with full attack summary details provided for verified threats (also known as Defender Experts Notifications). Today, we are excited to announce the general availability of new capabilities that deliver deeper hunting context to our customers. More specifically, we will provide greater insight into each hunt we carry out—not just the ones that result in verified threats. And we’ll also give our customers visibility into the hypothesis-based hunts we conduct on their behalf. Introducing investigation summaries for the hunts we conduct Each hunt we conduct tells a story, even when no active threat is found. So, to keep you informed, you will now receive an investigation summary to go along with nearly each hunt we conduct in their environment—regardless of whether a confirmed threat was found. This summary will detail what we hunted for, why we hunted for it, and how we reached our final determination. Beyond transparency, these summaries provide assurance that we thoroughly hunted down the threat and that your defenses remain intact. They help validate your security posture and, when applicable, highlight any previously uncovered threats during the process. Even in cases where no threat is detected, you can analyze our hunt summaries to be tangibly assured that we are continuously hunting on your behalf—keeping you informed, prepared, and ahead of new risks. New Emerging threats section of the Defender Experts for Hunting report Our threat hunters constantly analyze substantial amounts of threat intelligence to hunt for new and emerging techniques. To share this information with you, we are unveiling a new section of our report titled “Emerging threats” which details the proactive, hypothesis-based hunts we’ve conducted in your environment. These hunts focus on tactics that adversaries are just beginning to adopt, meaning they might bypass traditional detection mechanisms. This section will provide a title briefly describing each emerging threat, the severity we’ve ascribed to it, its relevant threat category, and most importantly, whether we’ve identified any evidence of impact in your environment. Additionally, by clicking into the hunt, you’ll see when we started and ended our hunt for the threat, along with a full investigation summary detailing our hunt. By surfacing these emerging threat hunts, we give you visibility into how we’re anticipating attacker behavior, validating your defenses against cutting-edge techniques, and identifying relevant suspicious activity before significant exploitation. Conclusion With these new capabilities, Microsoft Defender Experts for Hunting goes beyond detection to deliver transparency, assurance, and proactive defense. By surfacing investigation summaries and emerging threat insights, we help security teams validate their defenses, anticipate attacker tactics, and stay ahead of evolving risks. You can access these new capabilities by visiting your Hunting report, located in the Defender portal. To learn more about our hunting service, visit our Microsoft Defender Experts for Hunting page, read our hunting documentation, or watch our explainer video. To learn more about our managed XDR service, visit our Microsoft Defender Experts for XDR page, or read our XDR documentation. You can also visit our Tech Community discussion space to ask questions, engage in conversations, and share your expertise and feedback. What's next? Join us at Microsoft Ignite in San Francisco on November 17–21, or online, November 18–20, for deep dives and practical labs to help you maximize your Microsoft Defender investments and to get more from the Microsoft capabilities you already use. Security is a core focus at Ignite this year, with the Security Forum on November 17th, deep dive technical sessions, theater talks, and hands-on labs designed for security leaders and practitioners Featured sessions BRK237: Identity Under Siege: Modern ITDR from Microsoft Join experts in Identity and Security to hear how Microsoft is streamlining collaboration across teams and helping customers better protect, detect, and respond to threats targeting your identity fabric. BRK240 – Endpoint security in the AI era: What's new in Defender Discover how Microsoft Defender’s AI-powered endpoint security empowers you to do more, better, faster. BRK236 – Your SOC’s ally against cyber threats, Microsoft Defender Experts See how Defender Experts detect, halt, and manage threats for you, with real-world outcomes and demos. LAB541 – Defend against threats with Microsoft Defender Get hands-on with Defender for Office 365 and Defender for Endpoint, from onboarding devices to advanced attack mitigation. Explore and filter the full security catalog by topic, format, and role: aka.ms/SessionCatalogSecurity. Why attend? Ignite is the place to learn about the latest Defender capabilities, including new agentic AI integrations and unified threat protection. We will also share future-facing innovations in Defender, as part of our ongoing commitment to autonomous defense. Security Forum—Make day 0 count (November 17) Kick off with an immersive, in person preday focused on strategic security discussions and real-world guidance from Microsoft leaders and industry experts. Select Security Forum during registration. Register for Microsoft Ignite >Safeguarding Microsoft Teams with Microsoft Defender for Office 365
As organizations rely more on Microsoft Teams for daily collaboration, securing this platform has become a top priority. Threat actors are increasingly targeting Teams chats and channels with phishing links and malicious files, making it critical for IT admins and security professionals to extend protection beyond email. Enter Microsoft Defender for Office 365, now armed with dedicated Teams protection capabilities. Microsoft Defender for Office 365 enables users to report suspicious messages, brings time-of-click scanning of URLs and files into Teams conversations, and provides rich alerts and hunting insights for SecOps teams. As a collaborative piece between Pierre Thoor, a Microsoft Security Most Valuable Professional (MVP), and the Defender for Office 365 Product Engineering Team, the below guides with accompanying videos emphasize a proactive, user-driven approach to threat detection and response, turning everyday Teams interactions into actionable security signals for SecOps. See something, say something: Reporting suspicious messages in Microsoft Teams Your fastest sensor isn’t AI – it’s your people. Report this message in Microsoft Teams lets anyone flag a suspicious conversation in two clicks and routes a triageable submission to your security team in the Microsoft Defender portal. Why this matters: Speed to signal: Catch threats at the conversation layer, not just in email. Complete context: Original message, participants, URLs, and verdicts in one place. Habit-forming: A simple, repeatable action employees remember under pressure. How to report (desktop, web, and mobile) In Desktop/Web Hover the message → … More options → Report this message Select Security concern → (optional) add a short note → Report In Mobile (iOS/Android) app Long-press the message → Report message Select Security concern → (optional) add a short note → Report *Tip: Short notes like “Unexpected MFA reset link” help analysts triage faster. Where reports go (for security teams) In the Microsoft Defender portal, navigate to: Investigation & response → Actions and submissions → Submissions → User reported. Open an item to view the Teams message entity (sender/domain, Teams message ID, extracted URLs, verdict) and take action – mark as phish/clean, pivot to Explorer or Advanced Hunting, or copy indicators. Quick setup check Defender portal → Settings → Email & collaboration → User reported settings: enable Monitor reported messages in Microsoft Teams. Licensing: Microsoft Defender for Office 365 Plan 2 (included in Microsoft 365 E5). What good looks like (mini playbook) User reports the message. Security triages the submission and captures the URL/domain and other indicators. Block or allow as appropriate via the Tenant Allow/Block List (TABL). Hunt for related activity or clicks (see Video 3). Close the loop: thank the reporter and share the outcome to reinforce the behavior. Common gotchas Reporting is disabled in the Teams messaging policy – verify before rollout. Some users assume “Report” notifies the sender – clarify that it routes to the Security team, not the sender. Call to action: Enable reporting for your users and add this line to your awareness site: “If it feels phishy, report – don’t click.” Think before you click - Safe Links catches threats at click-time Links can change after delivery. Safe Links waits until click-time, evaluates the destination, and shows an in-app warning page in Teams. Pair it with the Tenant Allow/Block List (TABL) to tune quickly across the tenant. Why this matters Prevents delayed redirects: Avoids “clean-at-send” methods. Consistent protection in Teams: Familiar warning UX reduces risky clicks. Rapid tuning: Block newly observed domains in seconds; no advanced transport rules required. What you’ll see in the video Policy check (Teams in scope) Defender portal → Email & collaboration → Policies & rules → Threat policies → Safe Links → ensure Apply Safe Links to Microsoft Teams is enabled for target users or groups OR that you use Standard/Strict Preset Policy. Warning page at click-time Post a benign test URL in Teams and click it to show the Safe Links warning experience. Block it as you spot it (Allow/Block) Defender portal → Threat policies → Tenant Allow/Block List → URLs → Add (domain or URL). Re-click in Teams – now blocked at click-time. Optional telemetry (Advanced Hunting) Confirm outcomes and adoption: UrlClickEvents | where Timestamp > ago(24h) and Workload == "Teams" | summarize Clicks=count(), Users=dcount(AccountUpn) by ActionType | order by Clicks desc Deployment tips Start with a pilot group that includes IT + power users; expand after validation. Create a review cadence for TABL (e.g., monthly) and expire temporary blocks. Troubleshooting No warning page? Verify policy scope includes the user and the Teams workload. Block not taking effect? Give TABL a short sync window, then re-test; confirm you blocked the correct domain/URL pattern. “Hunt the chat”: Advanced hunting for Teams threats Overview With Advanced Hunting you can quickly reconstruct activity in Microsoft Teams – who sent the message, who clicked the link, and what protections kicked in. This section shows how the four Teams-relevant tables work together, so you can move from signal to action quickly. New: message warnings for malicious URLs (internal and external) Teams now shows a warning banner on messages that contain URLs flagged as spam, phishing, or malware. Warnings appear in internal and external chats/channels, and can be added after delivery (up to ~48 hours) if a URL’s reputation changes. This complements Safe Links (time-of-click) and doesn’t replace ZAP; when ZAP removes a message, that action takes precedence. Public preview began September 2025; GA November 2025, enabled by default at GA and manageable in Teams admin center → Messaging settings. See Message Center: https://admin.cloud.microsoft/?#/MessageCenter/:/messages/MC1150984 The four tables you’ll use MessageEvents – delivery context (sender, thread, internal vs. external). MessagePostDeliveryEvents – post-delivery actions, including Phish ZAP and Malware ZAP. MessageUrlInfo – URLs extracted from Teams messages. UrlClickEvents – time-of-click outcomes for links, including those clicked in Teams. What you’ll learn in the video Surface active external domains in your tenant’s Teams chats. Identify who clicked risky links and the click outcomes (via Safe Links telemetry). See where message warnings appear in the chat UI. Pivot to an incident and block indicators fast via the Tenant Allow/Block List (TABL). A couple hunts to try right now 1) Malicious verdicts in Teams (last 24 hours) Find messages that already carry a Spam/Phish/Malware verdict – your fastest triage queue. MessageEvents | where Timestamp > ago(1d) | where ThreatTypes has "Phish" or ThreatTypes has "Malware" or ThreatTypes has "Spam" | project Timestamp, SenderDisplayName, SenderEmailAddress, RecipientDetails, IsOwnedThread, ThreadType, IsExternalThread, ReportId Use it for: a quick sweep + pivot to incident/entities, then TABL block if needed. 2) “IT helpdesk” imposters in external DMs (last 5 days) Surface social-engineering lures that impersonate support. MessageEvents | where Timestamp > ago(5d) | where IsExternalThread == true | where (RecipientDetails has "help" and RecipientDetails has "desk") or (RecipientDetails has "it" and RecipientDetails has "support") or (RecipientDetails has "working" and RecipientDetails has "home") or (SenderDisplayName has "help" and SenderDisplayName has "desk") or (SenderDisplayName has "it" and SenderDisplayName has "support") or (SenderDisplayName has "working" and SenderDisplayName has "home") | project Timestamp, SenderDisplayName, SenderEmailAddress, RecipientDetails, IsOwnedThread, ThreadType, ReportId Use it for: first-contact scams (external tenant posing as IT). Pair with Safe Links telemetry to see who clicked. Tip: has is token-aware and generally faster/cleaner than contains for word matches. Keep both hunts detection-ready by ensuring the final projection includes Timestamp and ReportId. 3) BONUS! External DMs with links (last 7 days) MessageEvents | where Timestamp > ago(7d) and IsExternalThread == true | join kind=inner (MessageUrlInfo) on TeamsMessageId | summarize Links=dcount(Url), Senders=dcount(SenderEmailAddress) by UrlDomain | top 10 by Links desc 4) Who clicked (Teams workload) – exposure view: UrlClickEvents | where Timestamp > ago(7d) and Workload == "Teams" | project Timestamp, AccountUpn, Url, ActionType | order by Timestamp desc “From Hunt to Action”: Respond & contain Finding a risky link in Teams is only half the job. This walkthrough shows how to go from detection to containment – block the domain, clean up delivered messages, and cut attacker access. Why this matters Speed: Shrink time from “we saw it” to “it’s blocked”. Consistency: Turns ad-hoc hunting into a repeatable response flow. Coverage: Pair URL blocking with identity and device containment. What you’ll see in the video Turn a hunt into an alert In Advanced Hunting, run a short query (below) and choose Create detection rule to schedule it. Alerts auto-create incidents you can triage. Block at click-time (Safe Links + TABL) In the incident, open the URL entity and add the URL/domain to the Tenant Allow/Block List (TABL) so future Teams clicks are blocked by Safe Links. Post-delivery cleanup (ZAP) If a malicious message slipped through, ZAP can remove or mark it after delivery. You’ll see evidence on the incident timeline. Contain accounts and devices Revoke user sessions in Entra ID to invalidate active tokens. Reset the password (and require strong, unique credentials), then enforce MFA for the account. Review MFA methods and remove anything suspicious; review app consents and revoke illicit grants. If endpoints are onboarded, isolate the device in Microsoft Defender for Endpoint to stop outbound connections while you investigate. The Microsoft Learn guide, https://learn.microsoft.com/en-us/defender-office-365/responding-to-a-compromised-email-account, for compromised accounts recommends session revocation, password reset, MFA enforcement, reviewing OAuth app consents and admin roles, and checking mail forwarding/rules – steps that complement the Teams response you see here. The hunt This KQL surfaces rare external domains in Teams and any user clicks. let lookback = 1d; // External Teams messages let externalMsgs = MessageEvents | where Timestamp > ago(lookback) and IsExternalThread == true | project MsgTime = Timestamp, TeamsMessageId, SenderEmailAddress, ME_ReportId = ReportId; // URLs found in Teams messages let urlsInMsgs = MessageUrlInfo | where Timestamp > ago(lookback) | project MUI_Time = Timestamp, TeamsMessageId, Url, UrlDomain, MUI_ReportId = ReportId; // Clicks coming from Teams let clicks = UrlClickEvents | where Timestamp > ago(lookback) and Workload == "Teams" | project ClickTime = Timestamp, Url, Clicker = AccountUpn, ClickAction = ActionType, UCE_ReportId = ReportId; // Define “rare” domains in the period let rareDomains = urlsInMsgs | summarize msgCount = dcount(TeamsMessageId) by UrlDomain | where msgCount < 3; rareDomains | join kind=inner (urlsInMsgs) on UrlDomain | join kind=leftouter (externalMsgs) on TeamsMessageId | join kind=leftouter (clicks) on Url | project Timestamp = coalesce(ClickTime, MUI_Time, MsgTime), UrlDomain, Url, SenderEmailAddress, Clicker, ClickTime, ClickAction, TeamsMessageId, ReportId = coalesce(UCE_ReportId, MUI_ReportId, ME_ReportId) After verifying results, select Create detection rule, set a schedule (e.g., hourly), and map entities so incidents include the right artifacts. What good looks like (response playbook) Alert fires → open incident; confirm scope and entities. Block URL/domain via TABL to stop future clicks. Confirm ZAP removed or marked delivered messages. Revoke sessions and reset password; enforce MFA. Review MFA methods and remove unknown devices/methods. Audit app consents (revoke illicit grants) and verify the user holds no unexpected admin roles. If email abuse is suspected, check for forwarding or malicious Inbox rules. Isolate device if execution is suspected; collect artifacts and un-isolate after remediation. FAQs Does the block remove the message? No – TABL blocks at click-time. Post-delivery removal is handled by ZAP when detections apply. Will revoking sessions disrupt users? It forces sign-in again (expected). Communicate this in your response template. What if the attacker used consent phishing? Revoke the offending enterprise app consent and review publisher verification status. Call to action: Save the query, create the detection, and attach this playbook to your incident template. The goal every time: find → block → clean up → contain Securing Microsoft Teams is most effective when technology and people work together. By enabling user reporting, leveraging real-time protections, and empowering security teams to act quickly, organizations can turn everyday collaboration into a strong defense against threats. ## Please take two minutes to take this survey to let us know what you think of this blog (series), video, and community content. Questions or comments on this blog "Microsoft Defender for Office 365 – A Four-Part Guide to Secure Collaboration" for the author or other readers? Please log in and post your response below! _____________ This blog has been generously and expertly authored by Microsoft Security MVP, Pierre Thoor with support of the Microsoft Defender for Office 365 product team. Pierre Thoor Microsoft Security MVP | Microsoft Defender for Office 365 Champ Learn More and Meet the Author 1) December 16th Ask the Experts Webinar: Microsoft Defender for Office 365 | Ask the Experts: Tips and Tricks (REGISTER HERE) DECEMBER 16, 8 AM US Pacific You’ve watched the latest Microsoft Defender for Office 365 best practices videos and read the blog posts by the esteemed Microsoft Most Valuable Professionals (MVPs), now bring your toughest questions or unique situations straight to the experts. In this interactive panel discussion, Microsoft MVPs will answer your real world scenarios, clarify best practices, and highlight practical tips surfaced in the recent series. We’ll kick off with a who’s who and recent blog/video series recap, then dedicate most of the time to your questions across migration, SOC optimization, fine-tuning configuration, Teams protection, and even Microsoft community engagement. Come ready with your questions (or pre-submit here) for the expert Security MVPs on camera, or the Microsoft Defender for Office 365 product team in the chat! REGISTER NOW for 12/16. 2) Additional MVP-Authored Blogs in this Four- Part Series: Microsoft Defender for Office 365: Migration & Onboarding by Purav Desai (This post) Safeguarding Microsoft Teams with Microsoft Defender for Office 365 You may be right after all! Disputing Submission Responses in Microsoft Defender for Office 365 by Mona Ghadiri Microsoft Defender for Office 365: Fine-Tuning by Joe Stocker Learn and Engage with the Microsoft Security Community Log in and follow this Microsoft Defender for Office 365 blog and follow/post in the Microsoft Defender for Office discussion space. Follow = Click the heart in the upper right when you're logged in 🤍 Learn more about the Microsoft MVP Program. Join the Microsoft Security Community and be notified of upcoming events, product feedback surveys, and more. Get early access to Microsoft Security products and provide feedback to engineers by joining the Microsoft Customer Connection Community. Join the Microsoft Security Community LinkedInMicrosoft Defender for Office 365: Migration & Onboarding
This blog covers four key areas that are frequently missed, but they are essential for a secure and auditable deployment of Defender for Office 365. Before diving into the technical details, it is important to clarify a common misconception about Defender for Office 365 protections. Blocking Malicious File Downloads in SharePoint and OneDrive A common assumption during onboarding is that Microsoft Defender for Office 365 protections only apply to email. In reality, Safe Attachments also integrates with SharePoint Online, OneDrive for Business and Microsoft Teams. It scans files for malware even after they are uploaded or shared internally. However, this protection is only effective when the configuration explicitly prevents users from downloading files flagged as malicious. Without this setting, files detected as threats can still be downloaded locally. This creates a major risk particularly if the malware is detected post-delivery. In one investigation, I found that this setting had been left at its default, allowing users to download malicious files from SharePoint. This oversight created a significant exposure risk until it was corrected. This setting is part of the Safe Attachments for SPO/ODB policy and is critical in reducing internal exposure. Once enabled, this setting protects users in real time and acts as a powerful audit point. If someone disables this setting, whether intentionally or by accident, that action is recorded in Purview's Unified Audit Log under the DisallowInfectedFileDownloadDisabled operation. The video below offers a brief walkthrough on how to enable the setting, details the associated audit log events, and provides guidance on configuring alerts for any modifications: Regularly auditing for this event can help identify misconfiguration or potentially malicious administrative activity that could indicate insider threat behaviour. Including this check as part of your continuous security monitoring process is a smart, proactive move. Learn more at Step 2: (Recommended) Use SharePoint Online PowerShell to prevent users from downloading malicious files Once you have established protection against malicious files, the next step is ensuring your tenant is correctly set up to create and manage threat policies. Ensuring Organization Customization is Enabled A frustrating yet common hurdle during Defender for Office 365 onboarding is the inability to create threat policies such as anti-phishing or Safe Attachments policies. This confusion often stems from a basic configuration oversight: the tenant has not been enabled for organization customization. Without this step, the Microsoft 365 platform prevents the creation or editing of many critical security policies in Defender for Office 365. A few years prior with a new client being onboarded to Defender for Office 365, I encountered a situation where policy creation kept failing because this step wasn’t followed. It caused unnecessary delays and frustrated the security team until we identified the missing customization. The fix is simple. Run the Enable-OrganizationCustomization PowerShell cmdlet from Exchange Online. It is a one-time configuration task, but it is essential for policy management and overall service functionality. Including this step early in your deployment or migration plan prevents unnecessary delays and ensures the security team can fully leverage Defender for Office 365's capabilities from day one. This is particularly important for consultants who are brought in to assist after issues have already arisen. Getting ahead of this configuration means one less troubleshooting rabbit hole. With customization enabled, you can now take advantage of the preset security policies to quickly build a solid baseline. Using Preset Security Policies for a Strong Starting Point One of the best tools Microsoft has provided for onboarding is the Preset Security Policies feature. These come in two flavors: Standard and Strict. Figure 4 - Defender for Office 365 Preset security policies (Standard & Strict protection) They represent Microsoft’s recommended baseline configurations for anti-malware, anti-phishing, and spam protection. Learn more at Preset security policies in cloud organizations. For customers with limited security maturity or time to deeply understand the inner workings of Defender for Office 365, these presets are a game-changer. Figure 5 - Microsoft recommendation is to apply standard protection to all users In several cases, I have seen organizations with limited security teams benefit from activating these presets early. This approach gave them immediate protection while freeing up time to better understand and tune policies over time. For incident response, having a consistent and known-good baseline also helps reduce noise and false positives in the initial stages of deployment. Figure 6 - Apply strict Defender for Office 365 protection for priority users After setting foundational policies, controlling who has access to what within Defender for Office 365 is crucial to maintaining a secure environment. Implementing Unified RBAC for Least Privilege Access As more business units engage with Defender for Office 365 for everything from investigation to reporting, it is important to ensure each role has access only to what they need. Unified Role-Based Access Control (RBAC) in Defender for Office 365 makes this possible by allowing granular control over who can see and change what within the security portal. Figure 7 – Example least privilege role configuration for a Defender for Office 365 Incident Responder (image trimmed). This becomes critically valuable in larger or more complex organizations where responsibilities are split between security, compliance, IT, and operations teams. Figure 8 - Activating Microsoft Defender for Office 365 Workload in Defender XDR Roles. By using unified RBAC, you can avoid the dangerous and often default behavior of assigning Security Administrator rights to everyone involved. Instead, define roles based on function. For example, Tier 1 analysts might only need view and investigation access, while admins can manage policies. Figure 9 - Assigning a user to a Custom Microsoft Defender for Office 365 role, Entra Security Groups are also supported. This approach aligns with zero trust principles and makes it easier to audit who has access to sensitive areas. During onboarding, I recommend mapping stakeholders to the available roles and applying this model as early as possible. This helps establish accountability and improves your security posture before an incident occurs. Learn more at Map Defender for Office 365 permissions to the Microsoft Defender XDR Unified RBAC permissions Having set the right roles and permissions, it is vital to understand how these configurations contribute to a resilient and well-prepared security posture. Final Thoughts Successful onboarding to Microsoft Defender for Office 365 is not just about flipping switches. It is about making intentional configuration choices that support operational efficiency and long-term security goals. The points covered here are often missed in quick start guides but they are essential for building a solid foundation. Those who invest time in proper configuration are far better prepared when incidents arise. Migration is just the beginning. Set up Defender for Office 365 right to reduce risk and build real resilience. Please take two minutes to take this survey to let us know what you think of this blog (series), video, and community content. Questions or comments on this blog "Microsoft Defender for Office 365 Migration & Onboarding" for the author or other readers? Please log in and post your response below! _____________ This blog has been generously and expertly authored by Microsoft Security MVP, Purav Desai. with support of the Microsoft Defender for Office 365 product team. Lead M365 Incident Responder, Financial Services | Dual Microsoft Security MVP Learn More and Meet the Author 1) December 16th Ask the Experts Webinar: Microsoft Defender for Office 365 | Ask the Experts: Tips and Tricks (REGISTER HERE) DECEMBER 16, 8 AM US Pacific You’ve watched the latest Microsoft Defender for Office 365 best practices videos and read the blog posts by the esteemed Microsoft Most Valuable Professionals (MVPs). Now bring your toughest questions or unique situations straight to the experts. In this interactive panel discussion, Microsoft MVPs will answer your real-world scenarios, clarify best practices, and highlight practical tips surfaced in the recent series. We’ll kick off with a who’s who and recent blog/video series recap, then dedicate most of the time to your questions across migration, SOC optimization, fine-tuning configuration, Teams protection, and even Microsoft community engagement. Come ready with your questions (or pre-submit here) for the expert Security MVPs on camera, or the Microsoft Defender for Office 365 product team in the chat! REGISTER NOW for 12/16. 2) Additional MVP Tips and Tricks Blogs and Videos in this Four-Part Series: (This post) Microsoft Defender for Office 365: Migration & Onboarding by Purav Desai Safeguarding Microsoft Teams with Microsoft Defender for Office 365 by Pierre Thoor You may be right after all! Disputing Submission Responses in Microsoft Defender for Office 365 by Mona Ghadiri Microsoft Defender for Office 365: Fine-Tuning by Joe Stocker Learn and Engage with the Microsoft Security Community Log in and follow this Microsoft Defender for Office 365 blog and follow/post in the Microsoft Defender for Office 365 discussion space. Follow = Click the heart in the upper right when you're logged in 🤍 Learn more about the Microsoft MVP Program. Join the Microsoft Security Community and be notified of upcoming events, product feedback surveys, and more. Get early access to Microsoft Security products and provide feedback to engineers by joining the Microsoft Customer Connection Community. Join the Microsoft Security Community LinkedInHow Microsoft Defender Experts and partners like Quorum Cyber are redefining cybersecurity teamwork
In today’s rapidly evolving threat landscape, cybersecurity demands more than just great technology—it requires great teamwork. That’s the story behind the collaboration between Microsoft Defender Experts and MXDR partner, Quorum Cyber, joining forces to deliver end-to-end threat protection for organizations worldwide. Microsoft-verified MXDR partner Microsoft Defender Experts recognized the need for partner-led managed services to complement their first-party MDR (Managed Detection and Response) service. Quorum Cyber is a trusted Microsoft solutions partner and MSSP of the Year. They are also a Microsoft-verified MDR partner, which means they passed Microsoft’s validation process to deliver services using Microsoft’s security technologies. Quorum Cyber complements Microsoft Defender Experts, MDR services with additional security operations center (SOC) capabilities, extended coverage, non-Microsoft telemetry, and 3rd party domain expertise. “Quorum Cyber’s reputation for customer focus and security expertise made them the ideal Microsoft-verified MDR partner.” – Vivek Kumar, Microsoft “We saw Defender Experts as a way to extend our reach and deliver even more value to customers. It wasn’t about replacing—it was about enhancing.” – Ricky Simpson, Quorum Cyber Why teamwork matters The Microsoft-verified MDR partner program was born out of a shared mission: to provide holistic, customer-led security solutions to address the growing security needs of organizations worldwide. Today, cyber security needs to be a team sport. Organizations that provide security services, like Microsoft’s Defender Experts and Quorum Cyber, need to join together with customers to defend an ever-expanding attack surface against today’s sophisticated threats. Facing the modern threat landscape together From skill shortages to complex attacks, organizations need security providers who can adapt and collaborate. “Hackers only need to get it right once while SecOps needs to get it right every time. Customers need an end-to-end security solution to eliminate gaps and strengthen vulnerabilities. No single provider can address the needs of every organization—everywhere. Only teamwork can get the job done.” – Vivek Kumar, Microsoft How MDR providers working together is important for CISOs and other security leaders Meeting real-world challenges Modern SecOps must navigate an increasingly complex and multifaceted threat landscape. One of the most pressing challenges is the global shortage of cybersecurity professionals. Although the security workforce has grown by 9%, the gap has widened even further, with nearly 4.8 million additional professionals needed to adequately protect organizations last year. ¹ Meanwhile, adversaries are becoming more sophisticated and agile. They work in groups, using many individuals who process deep domain expertise is executing various attack techniques and tactics. In May 2024 alone, Microsoft Defender XDR detected over 176,000 incidents involving tampering with security settings, impacting more than 5,600 organizations. ² That surge in threat activity coincides with a pivotal moment in technological evolution as organizations rapidly scale cloud operations and explore the transformative potential of generative AI. These innovations, while powerful, also expand the attack surface and the likelihood of gaps and vulnerabilities. Comprehensive coverage across security domains Microsoft Defender Experts brings deep integration across Microsoft’s ecosystem and manages incidents across Microsoft Defender products (Endpoint, Office 365, Identity, Cloud Apps, and Defender for Cloud/Servers). Quorum Cyber, a Microsoft-verified partner, offers flexibility and specialized coverage to extend beyond Microsoft Defender Experts. “What is so exciting about this approach, is that together, we created a layered defense strategy that’s greater than the sum of its parts and provides coverage for nearly all of the customers’ environment. Microsoft SDM/SecDeliveryExperts worked together with Quorum Cyber to create a nearly seamless, unified defense strategy. They not only help to eliminate the skills gap but are designed to scale easily to address nearly any volume of sophisticated threats.” – Sebastien Molendijk, Microsoft With shared tooling, real-time communication, and complementary expertise, this teamwork eliminates blind spots and delivers coverage across an environment that includes non-Defender Experts supported technology such as 3rd party and legacy systems, custom applications, IoT, firewalls, network gear, and more. Additionally, the combined telemetry for all covered systems, Defender Experts and Quorum Cyber, enriches incident context and improves detection accuracy and hunting. Real-world impact – Customer success stories Proactive threat hunting is a core component of Defender Experts. Experts are not just cross-checking Indicators of Compromise (IOCs) against the environment or only validating them against known tactics, techniques, and procedures (TTPs). The hunting approach is differentiated by the 78T signals and hundreds of tracked threat actors. The intelligence informing Microsoft hunts spans across nation state, criminal activity, evolving vulnerabilities, and newly observed behaviors. That is something Defender Experts can uniquely provide customers. One of many customer examples of this teamwork involved an organization already engaged with Quorum Cyber MDR for Microsoft E5 services. When Defender Experts engaged with the customer, the two teams co-created a solution tailored to meet the CISOs needs by combining Quorum Cyber’s analytics and monitoring with Defender Expert’s proactive threat hunting. That not only expanded coverage but provided the customer with both proactive and reactive services across nearly their entire environment. Another example is adversary in the middle alerts, Defender Experts performs the investigation of malicious QR codes and then escalates to Quorum Cyber if malicious activity is observed. Quorum Cyber then takes delegated authority to reset the user's password, revokes their sessions, and takes other actions as needed. Unique services Collaboration is more than Quorum Cyber and Microsoft working as one. Quorum Cyber develops unique services including their data security service – Clarity Data. This service handles incidents generated via Microsoft Purview - DLP and IRM. It includes Quorum Cyber’s 24/7 365 SOC services to address those incidents without interfering with security signals being addressed by other analysts. Operational flexibility Customers have the option to divide responsibilities. For example, Microsoft manages Defender-specific alerts and Quorum Cyber manages alerts from all the other tools. Guided response playbooks allow Microsoft Defender Experts and Quorum Cyber teams to work as one to perform containment and remediation across workstreams. “We built solutions from scratch, keeping customer outcomes at the center. The results are frictionless, powerful security models that address unique customer needs.” – Ricky Simpson, Quorum Cyber Overcoming challenges, building trust, working as one Like building any team, there were hurdles. From workflow alignment to incident handoffs, mutual respect and a shared commitment to customer satisfaction paved the way to building frictionless workstreams. Teamwork thrived on technical integration. Because Defender Experts is built atop the Microsoft Defender portal and Microsoft Graph, the service is inherently designed for seamless collaboration. When Defender Experts assigns incidents, initiates proactive threat hunts, publishes investigation notes, or executes one-click remediation actions, those activities are fully integrated into both the Defender user experience and the Graph API. That integration enables Quorum Cyber to synchronize directly with those workflows, allowing their teams to operate within their existing toolsets while customers receive real-time updates and final resolutions through platforms such as Microsoft Defender, Sentinel, or their ITSM systems. A notable example is the ‘real-time chat’ feature within Defender Experts, which is architected to support joint participation from both customers and partners like Quorum Cyber—ensuring transparency and responsiveness throughout the incident lifecycle. That level of tooling integration is essential to delivering a unified experience. Customers benefit from the deep expertise of Defender Experts, the broad coverage of a trusted partner like Quorum Cyber, and the operational efficiency of a tightly connected security services ecosystem. It truly represents the best of both worlds. “Defender Experts’ use of Microsoft Graph and Defender Portal enabled seamless incident sharing, real-time chat, and synchronized updates across platforms. Live dashboards from Defender Experts offer a clear, prioritized view of incidents. That allowed Defender Experts and Quorum Cyber to work as one team to keep customers secure and do that quickly and efficiently.” – Ricky Simpson, Quorum Cyber The bigger picture – innovation and growth This partnership isn’t just about solving today’s problems—it’s about shaping the future. It has opened doors for Quorum Cyber to expand into new service areas, like managed data security, while reinforcing Microsoft’s commitment to flexible, scalable security solutions. Customers don’t have to choose between Microsoft and their trusted MDR provider like Quorum Cyber—they can have both. By combining Microsoft Defender Experts with MDR providers like Quorum Cyber, organizations gain a flexible, scalable, and deeply integrated security strategy that adapts to their unique needs and can grow as they grow. Whether you're augmenting your SOC, expanding global coverage, or navigating a transition, this “better together” model ensures your security operations are resilient, responsive, and ready for what’s next. “We’ve proven, and our customer agree, that first-party and partner-led services can coexist and thrive together.” – Ricky Simpson, Quorum Cyber “Customers get the best of both worlds—expertise from Defender Experts and coverage from Quorum Cyber, all delivered as it should be—in a timely and seamless way.” – Vivek Kumar, Microsoft In summary – Microsoft Defender Experts and Quorum Cyber – the benefits are clear End-to-End Threat Protection – Combines Microsoft Defender capabilities with Quorum Cyber extended SOC services and third-party telemetry. Comprehensive Coverage –Protects both Microsoft and non-Microsoft environments, including legacy systems, IoT, and custom applications. Proactive and Reactive Security –Integrates threat hunting with incident response for full-spectrum defense. Operational Flexibility –Allows tailored division of responsibilities and coordinated remediation through guided playbooks. Real-Time Collaboration –Enables seamless communication and incident management via shared tooling, dashboards, and chat features. Advanced Threat Intelligence –Leverages Microsoft’s 78T signals and threat actor tracking, with partner TI, to enrich incident context and improve detection. Complementary Services –For example, Quorum Cyber’s Clarity Data service handles Microsoft Purview incidents without disrupting other security workflows. Unified Customer Experience –Delivers frictionless, scalable, and resilient security operations through deep integration and mutual trust. Learn more If you like this blog, and would like to learn more, see this insightful webinar for more details The Better Together Story of Defender Experts and Quorum Cyber - Quorum Cyber And listen to what these experts from Quorum Cyber and Microsoft have to say about the benefits of ‘Better Together.’ Ricky Simpson | LinkedIn Paul Caiazzo | LinkedIn Scott McManus | LinkedIn Raae Wolfram | LinkedIn Sebastien Molendijk | LinkedIn Henry Yan | LinkedIn Vivek Kumar | LinkedIn Next Steps For organizations considering a multi-provider strategy, the message is clear: collaboration works. Microsoft Defender Experts and Quorum Cyber show that when service providers align around customer needs, the results are transformative. “Microsoft Security has got you covered—whether through Defender Experts, partners like Quorum Cyber, or both.” – Vivek Kumar, Microsoft Ready to strengthen your cyber resilience, Join the conversation through Microsoft’s public webinar series Explore the CTI community Reach out to learn more about how this partnership can support your organization. Sources ¹ ISC2-2024-Cybersecurity-Workforce-Study ² Microsoft Digital Defense Report 2024
