What’s new in Microsoft Security: May 2026

Microsoft Security Blog (May 2026) roundup covering multiple high‑impact security topics: a supply‑chain compromise of @antv npm packages (“Mini Shai‑Hulud”) that steals CI/CD credentials from Linux automation environments (targets include GitHub, AWS, Kubernetes, Vault, npm, 1Password); a malware‑signing‑as‑a‑service operation (Fox Tempest) used to distribute malicious code and ransomware; Kazuar, an evolving P2P nation‑state botnet; Storm‑2949’s identity‑based cloud‑wide breach demonstrating how stolen credentials enable extensive data theft without malware; and exploitable misconfigurations