Secure agentic AI for your Frontier Transformation
2026-03-11T02:52:19Z•4a9dc6639266aded4e2bab7f111f1be45d5e1a434f53a9c3beceaa0fe3982437
ai-assistant-extensionsai-securityaitmautonomous-defensecoral-sleetdeveloper-supply-chaindeveloper-targetingjasper-sleetllm-data-exfiltrationmalicious-browser-extensionsnextjsnorth-koreaoauth-redirection-abusepersistencephishingphishing-as-a-servicerce-to-c2rmm-backdoorsecurity-operationssigned-malwarestolen-ev-certificatethreat-actorsthreat-modelingtycoon2fa
What happened
Microsoft Security Blog roundup (Feb–Mar 2026) highlighting multiple high-impact threats and defensive guidance. Key incidents: malicious AI browser extensions harvesting LLM chat histories and browsing data (≈900,000 installs, activity across >20,000 enterprise tenants); Tycoon2FA AiTM phishing-as-a-service operating at scale (≈500,000 organizations monthly) and disrupted by law enforcement; signed malware using a stolen EV certificate to deploy legitimate RMM tools for persistent backdoors; OAuth redirection abuse used to weaponize trusted authentication flows for phishing and malware; and a
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- microsoft_security_blog
- Record identifier
- 4a9dc6639266aded4e2bab7f111f1be45d5e1a434f53a9c3beceaa0fe3982437
- Enrichment time
- 2026-03-11T02:52:19Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.