What’s new in Microsoft Security: May 2026

Microsoft Security May 2026 highlights multiple high-risk supply chain and cloud threats plus new AI‑security tooling and guidance. Key findings: (1) Mini Shai‑Hulud — malicious code injected into compromised @antv npm packages that executes during npm install on Linux CI/CD runners to harvest credentials across GitHub, AWS, Kubernetes, HashiCorp Vault, npm, and 1Password; (2) Fox Tempest — a malware‑signing‑as‑a‑service (MSaaS) enabling other criminals (e.g., Vanilla Tempest, Storm groups) to distribute signed malware and ransomware; (3) Storm‑2949 — identity compromise escalated to a cloud‑w