Inside an AI‑enabled device code phishing campaign

Microsoft Security Blog published a set of alerts and analysis covering multiple active threats and defensive guidance: an AI‑enabled device‑code phishing campaign that generates live authentication codes to scale account compromise and enable MFA bypass; Storm‑1175’s high‑tempo Medusa ransomware operations that weaponize recently disclosed web‑facing vulnerabilities for initial access, exfiltration, and encryption; broad increase in threat actor abuse of generative AI (higher phishing success and industrialized MFA bypass); cookie‑gated PHP webshell tradecraft used to hide execution and cron‑