Microsoft recognized as a Leader in The Forrester Wave™ for Workforce Identity Security Platforms
2026-05-26T14:52:16Z•1ba45cf6de63fc7b0bfb55e85d2576b2984641de21989758b1d4c12ef9b91f4f
CI/CD credential theftClarityConfluenceF5 BIG-IPFox TempestKerberos relayMicrosoft DefenderMini Shai-HuludRAMPARTStorm-2949cloud breachcredential theftdetection and responseidentity compromiselateral movementlinux intrusionmalware-signing-as-a-servicenpm supply-chainsupply-chain compromise
What happened
The feed highlights multiple high-impact threats and supply-chain compromises: a multi-stage Linux intrusion that began with an exposed F5 BIG‑IP appliance and pivoted to an internal Confluence server for credential theft (including attempted Kerberos relay and lateral movement); compromised @antv npm packages that deploy the Mini Shai‑Hulud payload to steal CI/CD secrets from Linux automation environments and exfiltrate credentials for GitHub, AWS, Kubernetes, Vault, npm, and 1Password; a malware‑signing‑as‑a‑service operation dubbed Fox Tempest used to distribute signed malicious binaries; и
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- microsoft_security_blog
- Record identifier
- 1ba45cf6de63fc7b0bfb55e85d2576b2984641de21989758b1d4c12ef9b91f4f
- Enrichment time
- 2026-05-26T14:52:16Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.