The agentic SOC—Rethinking SecOps for the next decade
2026-04-13T14:52:19Z•c7ba331499304bf2def8ddda4bc8e353264cd7fb95d64f36d602b24432bb496d
adversary-in-the-middleai-enabled-phishingandroid-intent-redirectionaxios-npm-supply-chaincookie-controlled-php-webshellscritical-infrastructuredevice-code-phishingdns-hijackingforest-blizzardincident-responselinux-hostingmedusa-ransomwaremfa-bypassmobile-walletsnpm-compromisephp-webshellsapphire-sleetsecops-agentic-socsoho-router-compromisestorm-1175storm-2755supply-chain-securitythird-party-sdkthreat-intelligence
What happened
A collection of Microsoft Security Blog posts (early April 2026) describing a range of high-risk active threats and emerging tradecraft: AI-enabled device‑code phishing and industrialized MFA bypass; financially motivated campaigns (Storm-2755 “payroll pirate” targeting Canadian employee payroll, Storm-1175 high-tempo Medusa ransomware operations); state‑linked supply‑chain compromise of Axios npm packages attributed to North Korean actor Sapphire Sleet; a severe Android intent‑redirection vulnerability in a widely deployed third‑party SDK exposing millions of wallets; SOHO router compromises/
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- microsoft_security_blog
- Record identifier
- c7ba331499304bf2def8ddda4bc8e353264cd7fb95d64f36d602b24432bb496d
- Enrichment time
- 2026-04-13T14:52:19Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.