Cross‑tenant helpdesk impersonation to data exfiltration: A human-operated intrusion playbook

Microsoft Security Blog highlights multiple high‑risk activity and research findings from April 2026: threat actors abusing external Microsoft Teams collaboration for cross‑tenant helpdesk impersonation leading to remote access, lateral movement, and data exfiltration; a real domain compromise case where exposure‑based predictive shielding curtailed credential abuse; guidance for building cryptographic inventories and quantum‑ready posture; a Sapphire Sleet (North Korea) macOS intrusion campaign that steals credentials, crypto, and data; incident response guidance adapted for AI‑era threats; a