Cross‑tenant helpdesk impersonation to data exfiltration: A human-operated intrusion playbook

Microsoft Security Blog round-up (Apr 6–18, 2026): multiple active threats and defensive lessons. Key reports describe cross‑tenant Microsoft Teams helpdesk impersonation where attackers use external collaboration to socially engineer remote access, then abuse legitimate admin tools to move laterally and exfiltrate data; a domain compromise mitigated by exposure‑based predictive shielding that slowed lateral movement; a sophisticated macOS campaign attributed to North Korea’s Sapphire Sleet stealing credentials and crypto; an emerging financially‑motivated Storm‑2755 “payroll pirate” targeting