New Microsoft Purview innovations for Fabric to safely accelerate your AI transformation
2026-03-17T08:52:22Z•76d4739765ecb01ad26014505b8217c7720c5aa74ac0129b191213507d40b7d8
AI-governanceCoral-SleetFlexibleFerretIOCsJasper-SleetLLM-data-exfiltrationOtterCookieSEO-poisoningbackdoorbrowser-extensioncredential-theftdeveloper-targetingfake-vpnmitigationnation-statephishingprompt-injectionsigned-binariessocial-engineeringtrojanvoice-phishing
What happened
A batch of Microsoft Security Blog posts highlights multiple active threat trends and defensive guidance. Key incidents: Storm‑2561 is using SEO poisoning to push fake VPN clients that install signed trojans to steal VPN credentials (TTPs, IOCs, and mitigations provided); the Contagious Interview campaign uses fake developer job interviews and coding assessments to deliver backdoors (OtterCookie, FlexibleFerret) to harvest API tokens, cloud credentials, crypto wallets, and source code; malicious AI browser extensions (~900k installs, >20k enterprise tenants) are harvesting LLM chat histories/b
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- microsoft_security_blog
- Record identifier
- 76d4739765ecb01ad26014505b8217c7720c5aa74ac0129b191213507d40b7d8
- Enrichment time
- 2026-03-17T08:52:22Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.