Original malware analysis, verified KQL detections, and autonomous threat hunt reports from the Overwatch team.
A small 32-bit DLL caught by our honeypot exists for one job: the moment it is loaded, it fetches three executables from an operator server on port 811, drops them in C:\Windows an...
Microsoft Security recently detailed a campaign involving typosquatted npm packages designed to steal cloud and CI/CD secrets, a critical supply chain compromise (T1195.002). This ...