Breaking the code: Multi-stage ‘code of conduct’ phishing campaign leads to AiTM token compromise

Microsoft Security Blog highlights a large-scale, multi-stage credential theft campaign that used “code of conduct” lures, legitimate email services and fully authenticated attacker-controlled domains to perform AiTM (adversary-in-the-middle) token compromise and widespread credential harvesting. Microsoft also reports a high-severity Linux vulnerability, CVE-2026-31431 (“Copy Fail”), enabling local root privilege escalation across cloud and Kubernetes environments with an exploit observed in the wild. Additional posts cover Microsoft Agent 365 general availability (shadow AI discovery/mitigat