Breaking the code: Multi-stage ‘code of conduct’ phishing campaign leads to AiTM token compromise

Collection of Microsoft Security Blog posts (late Apr–early May 2026) covering a range of active threats and defensive releases. Highlights include: a large-scale multi-stage ‘code of conduct’ credential-phishing campaign that used legitimate email services and fully authenticated mail from attacker-controlled domains to perform AiTM (adversary-in-the-middle) token compromise; a high-severity Linux vulnerability (CVE-2026-31431, “Copy Fail”) enabling root privilege escalation across cloud environments and Kubernetes workloads with a working exploit in the wild; Microsoft Agent 365 general-ava​