Real world incident response: Microsoft and AXA XL strengthen cyber resilience

This Microsoft Security Blog feed summarizes multiple July 2026 posts covering active threats, supply‑chain compromises, identity/authentication changes, and defensive services. Notable items: ACR Stealer campaigns (late Apr–mid‑Jun) using ClickFix lures to exfiltrate browser credentials, auth tokens, and documents; an npm/AsyncAPI supply‑chain compromise that weaponized CI/CD and import‑time payload delivery; GigaWiper (aka BLUERABBIT), a destructive backdoor combining multiple malware families; observed ShinyHunters‑style OAuth abuse targeting SaaS apps (including vishing and guest access/mc