The agentic SOC—Rethinking SecOps for the next decade

Microsoft Security Blog (Apr 2026) highlights multiple high-impact threats and trends: a financially motivated actor (Storm-2755) performing “payroll pirate” attacks against Canadian employees; a severe intent‑redirection vulnerability in a widely used Android SDK exposing millions of wallets; SOHO router compromises by Forest Blizzard leading to DNS hijacking and adversary‑in‑the‑middle activity; an AI‑enabled device‑code phishing campaign that generates live authentication codes and scales account compromise (including MFA bypass); Storm‑1175 conducting high‑velocity Medusa ransomware ops by