The agentic SOC—Rethinking SecOps for the next decade
2026-04-13T08:52:27Z•95f93015122c891b04794238d0838f5149dc33e6308129d07a013133deab762f
AI‑enabled phishingAndroidAxiosDNS hijackingForest BlizzardMFA bypassMedusaSDK vulnerabilitySOHO router compromiseSapphire SleetStorm-1175Storm-2755agentic SOCcookie‑gated PHP webshellcron persistencedevice code phishingfinancial fraudintent redirectionmobile walletsnpmpayroll diversionphp-fpmransomwaresupply chainwebshells
What happened
Microsoft Security Blog highlights a cluster of high-impact threats and defensive shifts: widespread supply-chain compromise of Axios npm packages attributed to North Korean actor Sapphire Sleet; a severe intent‑redirection vulnerability in a widely used Android SDK that exposed millions of wallets; SOHO router compromises and DNS hijacking linked to Forest Blizzard; high‑tempo Medusa ransomware operations by Storm‑1175 and payroll‑diversion attacks by Storm‑2755 against Canadian employees; and increasingly AI‑enabled device‑code phishing and automated MFA bypasses. Tradecraft updates include:
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- microsoft_security_blog
- Record identifier
- 95f93015122c891b04794238d0838f5149dc33e6308129d07a013133deab762f
- Enrichment time
- 2026-04-13T08:52:27Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.