Real world incident response: Microsoft and AXA XL strengthen cyber resilience

This collection of Microsoft Security Blog posts highlights several active and high-impact threats plus strategic defensive moves. Key incidents: ACR Stealer campaigns (late Apr–mid Jun 2026) using ClickFix lures to steal browser credentials, authentication tokens, and documents; an AsyncAPI npm supply-chain compromise that weaponized trusted CI/CD workflows to deliver import-time payloads; and GigaWiper (aka BLUERABBIT), a destructive backdoor built by combining multiple malware families. Microsoft also documents OAuth abuse tied to activity consistent with ShinyHunters targeting SaaS apps,發布