Microsoft recognized as a Leader in The Forrester Wave™ for Workforce Identity Security Platforms
2026-05-25T14:52:18Z•d248a9add6f3253d02281c685a60184f65b983941b29f2a10462d36d0e9b76af
@antvAI securityCI/CD secretsClarityConfluenceF5 BIG-IPForrester WaveFox TempestKerberos relayMicrosoft DefenderMini Shai-HuludRAMPARTStorm-2949cloud breachcredential theftidentity compromiselateral movementlinux intrusionmalware-signing-as-a-servicenpmopen-source security toolsransomwaresupply chainworkforce identity security
What happened
Microsoft Security Blog (mid-May 2026) details multiple high-risk incidents and new defensive tooling: a multi-stage Linux intrusion that began with an exposed F5 BIG‑IP appliance and pivoted to an internal Confluence server to steal credentials (including attempted Kerberos relay and lateral movement) — Microsoft Defender detected and blocked activity; compromised @antv npm packages deployed the Mini Shai‑Hulud payload to exfiltrate CI/CD secrets from Linux automation environments (targeting GitHub, AWS, Kubernetes, Vault, npm, 1Password) during npm install; Fox Tempest operated a malware‑sig
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- microsoft_security_blog
- Record identifier
- d248a9add6f3253d02281c685a60184f65b983941b29f2a10462d36d0e9b76af
- Enrichment time
- 2026-05-25T14:52:18Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.