New Microsoft Purview innovations for Fabric to safely accelerate your AI transformation
2026-03-17T20:52:25Z•ad705cbea8f14cb9c1faedebb85de111cda2988aed509c13884a395bfb8c65fe
AI-as-tradecraftAPTIOCsLLM-data-exfiltrationSEO-poisoningapi-token-theftbackdoorbrowser-extensioncloud-credentialscredential-theftcrypto-theftdeveloper-lurefake-vpnidentity-phishingmalwaremitigationsprompt-injectionsigned-trojanthreat-actorsvoice-phishing
What happened
Collection of Microsoft Security Blog posts (Mar 2026) describing several active and emerging threats and related defensive guidance. Key items: Storm-2561 uses SEO poisoning to push fake VPN installers that deploy signed trojans and steal VPN credentials; the “Contagious Interview” campaign lures developers with fake job interviews to deliver backdoors (OtterCookie, FlexibleFerret) that exfiltrate API tokens, cloud credentials, crypto wallets, and source code; malicious AI assistant browser extensions harvested LLM chat histories and browsing data (nearly 900,000 installs, activity across >20
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- microsoft_security_blog
- Record identifier
- ad705cbea8f14cb9c1faedebb85de111cda2988aed509c13884a395bfb8c65fe
- Enrichment time
- 2026-03-17T20:52:25Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.