What’s new in Microsoft Security: May 2026
2026-05-22T14:52:22Z•c2551b7e170e834120ae90348c6293541f867cc6ee0fa1686d1b9560949a9f3f
1Password@antvAI-securityAWSCI/CDClarityFox TempestGitHubKazuarKubernetesMini Shai HuludRAMPARTRCESecret BlizzardStorm-2949Vault','security-updates','defense-in-depth','gaming-securitybotnetcloud-breachcredential-theftidentity-compromisemalware-signing-as-a-servicemisconfigurationnation-statenpmsupply-chain
What happened
Microsoft Security Blog (May 2026) highlights multiple high-risk threats and defensive guidance: compromised @antv npm packages deploy the “Mini Shai Hulud” payload to steal CI/CD credentials from Linux automation environments (targets include GitHub, AWS, Kubernetes, Vault, npm, and 1Password); a malware‑signing‑as‑a‑service operation dubbed Fox Tempest enables wider malware/ransomware distribution; Storm-2949 demonstrates how stolen identities can lead to cloud‑wide breaches without malware; Kazuar is profiled as an evolving, modular P2P botnet attributed to Russian actor Secret Blizzard; in
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- microsoft_security_blog
- Record identifier
- c2551b7e170e834120ae90348c6293541f867cc6ee0fa1686d1b9560949a9f3f
- Enrichment time
- 2026-05-22T14:52:22Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.