Secure agentic AI for your Frontier Transformation
2026-03-09T20:52:20Z•7c88f91108a6560d49a89158289b4b236f60070c644b5e2681e2d40f5cb7c3d8
AiTMCoral SleetJasper SleetLLM data exfiltrationMicrosoft DefenderNext.jsOAuth redirection abuseRMM backdoorTycoon2FAagentic AI threatsdeveloper supply chainenterprise exposuremalicious browser extensionsoperational AI by threat actorsphishing-as-a-servicesecurity operationssigned malwarestolen EV certificatesupply chain securitythreat modeling
What happened
A Microsoft Security Blog feed highlights a cluster of high-impact adversary techniques and defensive guidance. Notable reports: malicious AI browser extensions harvested LLM chat histories and browsing data (≈900k installs, impacting >20k enterprise tenants); Tycoon2FA AiTM phishing-as-a-service reached hundreds of thousands of organizations monthly before disruption; signed malware using a stolen EV certificate deployed legitimate RMM tools for persistent backdoors; OAuth redirection abuse is being weaponized for phishing and malware delivery; and developer-targeting via malicious Next.js RE
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- microsoft_security_blog
- Record identifier
- 7c88f91108a6560d49a89158289b4b236f60070c644b5e2681e2d40f5cb7c3d8
- Enrichment time
- 2026-03-09T20:52:20Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.