Secure agentic AI for your Frontier Transformation
2026-03-10T02:52:18Z•73f5057203132df108198f257534dbdb9cc5ceed4e9f2c6cefbf5838e1a3b868
AIAiTMC2Coral SleetEV certificateJasper SleetLLMNext.jsNorth Korean threat actorsOAuth redirectionPhaaSRCERMMTycoon2FAagentic AIbackdoorbrowser extensionsdata exfiltrationphishingphishing deliveryphishing-as-a-servicesecurity operations','Microsoft Defendersigned malwaresupply chainthreat modeling
What happened
The Microsoft Security Blog aggregation highlights multiple high-risk trends: malicious AI browser extensions scraped LLM chat histories and browsing data with nearly 900,000 installs affecting ~20,000 enterprise tenants; Tycoon2FA AiTM phishing-as-a-service (PhaaS) operated at scale (impacting ~500,000 organizations monthly) and was disrupted; signed malware using a stolen EV certificate deployed legitimate RMM tools to establish persistent backdoors; OAuth redirection flows are being abused to deliver phishing and malware; and developer-targeting supply-chain attacks used malicious Next.js N
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- microsoft_security_blog
- Record identifier
- 73f5057203132df108198f257534dbdb9cc5ceed4e9f2c6cefbf5838e1a3b868
- Enrichment time
- 2026-03-10T02:52:18Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.