Microsoft recognized as a Leader in The Forrester Wave™ for Workforce Identity Security Platforms
2026-05-22T20:52:15Z•6dd2630f93f032a3aad2b8746b3317a87557c99216ee111cf05b1b04d00ffd9d
CI/CD secretsClarityConfluenceF5 BIG-IPFox TempestKerberos relayLinux intrusionMini Shai HuludRAMPARTStorm-2949cloud data exfiltrationcredential theftidentity compromiselateral movementmalware-signing-as-a-servicenpmopen-source security toolssupply chain compromiseworkforce identity security
What happened
Microsoft Security Blog (May 18–22, 2026) highlights multiple high‑risk threats and defensive updates: a multi‑stage Linux intrusion that began with an exposed F5 BIG‑IP appliance and pivoted to an internal Confluence server (credential theft, Kerberos relay attempts, lateral movement); supply‑chain compromise of @antv npm packages deploying ‘Mini Shai Hulud’ to steal CI/CD secrets from Linux automation (targets include GitHub, AWS, Kubernetes, Vault, npm, 1Password); Fox Tempest’s malware‑signing‑as‑a‑service used by other criminal groups to distribute signed malware/ransomware; and Storm‑294
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- microsoft_security_blog
- Record identifier
- 6dd2630f93f032a3aad2b8746b3317a87557c99216ee111cf05b1b04d00ffd9d
- Enrichment time
- 2026-05-22T20:52:15Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.