Cross‑tenant helpdesk impersonation to data exfiltration: A human-operated intrusion playbook
2026-04-18T20:52:17Z•4177cdc375ee440c3eeed69f6ef6ffcbb934aa05351370840317ba44a43216ec
AI‑enabled phishingAndroid SDKDNS hijackingMicrosoft DefenderMicrosoft Security BlogSOHO router compromiseSapphire SleetStorm‑2755Teamscredential theftcross‑tenant collaborationcryptocurrency theftcryptographic posture managementdata exfiltrationdevice code phishinghelpdesk impersonationincident response (IR) for AI','agentic SOCintent redirectionlateral movementmacOS intrusionman‑in‑the‑middlemobile walletspayroll fraudpredictive shieldingremote access
What happened
Collection of Microsoft Security Blog posts (Apr 6–18, 2026) describing multiple active threats and defensive guidance: cross‑tenant Microsoft Teams helpdesk impersonation leading to remote‑access abuse and data exfiltration; AI‑enabled device‑code phishing and automated social engineering at scale; a macOS intrusion campaign (Sapphire Sleet) stealing credentials and crypto; a SOHO router campaign causing DNS hijacking and MITM; an Android intent‑redirection vulnerability in a popular SDK impacting millions of wallets; financially motivated Storm‑2755 payroll diversion attacks; and defensive/準
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- microsoft_security_blog
- Record identifier
- 4177cdc375ee440c3eeed69f6ef6ffcbb934aa05351370840317ba44a43216ec
- Enrichment time
- 2026-04-18T20:52:17Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.