New Microsoft Purview innovations for Fabric to safely accelerate your AI transformation
2026-03-18T14:52:21Z•8670642bcf2753dc8b588274629dbfadd4b9cdc021c7288ba556bf0306ab21cf
AI as tradecraftContagious InterviewCoral SleetFlexibleFerretIOCsJasper SleetLLM data exfiltrationMicrosoft PurviewOtterCookieSEO poisoningStorm-2561Teams voice phishingagentic AIcredential theftfake VPNfake developer interviewsgovernanceidentity compromisemalicious browser extensionsmitigation guidanceprompt injectionsigned trojansocial engineering
What happened
A set of Microsoft Security Blog posts (Mar 2026) covering multiple active threats and defensive guidance. Key items: Storm-2561 uses SEO poisoning to distribute fake VPN clients that install signed trojans to steal VPN credentials and mimic trusted brands; a DART investigation details a Microsoft Teams voice‑phishing (support call) identity‑led compromise and recommended mitigations; the Contagious Interview campaign weaponizes fake developer interviews to deliver backdoors (OtterCookie, FlexibleFerret) to steal API tokens, cloud credentials, wallets, and source code; nearly 900,000 installs‑
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- microsoft_security_blog
- Record identifier
- 8670642bcf2753dc8b588274629dbfadd4b9cdc021c7288ba556bf0306ab21cf
- Enrichment time
- 2026-03-18T14:52:21Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.