Improving security posture across the Microsoft partner ecosystem

Collection of Microsoft Security Blog posts (June–July 2026) highlighting ecosystem and product updates plus multiple active threats. Key security advisories include: MCP/tool-poisoning risk where malicious tool descriptions can co-opt AI agents to perform unauthorized actions and exfiltrate data; a malicious Chromium extension spoofing Perplexity AI that redirects browser search using MV3 APIs and intermediary infrastructure; a multi-stage Photo ZIP campaign targeting hospitality organizations in Europe and Asia that uses fake image shortcut files to deliver a persistent Node.js implant; anda