The agentic SOC—Rethinking SecOps for the next decade

Collection of Microsoft Security Blog posts (Mar–Apr 2026) reporting multiple high-impact threats and tradecraft trends: a North Korean‑attributed npm supply‑chain compromise of Axios (Sapphire Sleet) that exposed many users; an Android intent‑redirection vulnerability in a widely deployed third‑party SDK impacting millions of apps and mobile wallets; SOHO router compromises and DNS hijacking by Forest Blizzard enabling adversary‑in‑the‑middle operations; financially motivated Storm‑2755 “payroll pirate” attacks diverting Canadian employee salaries; Storm‑1175 fast‑moving Medusa ransomware ops