The data breach affects the Defense Manpower Data Center (DMDC), which maintains personnel records for the Department of Defense.
The post Pentagon Personnel Agency Data Breach Impacts 3 Million People appeared first on SecurityWeek.
Apple released iOS and macOS updates to patch a zero-day vulnerability (CVE-2026-86950) reported by Meta’s product security team.
The post Apple Patches Zero-Day Linked to ‘Extremely Sophisticated Attack’ appeared first on SecurityWeek.
Microsoft has served the Middle East since it began operations in the region in 1991. Since then, we’ve steadily expanded our presence and investments, growing from a local technology provider into a long-term partner to governments, businesses, educational institutions, and civil society organizations. Today, Microsoft is reaffirming that commitment through a new framework focused initially on Kuwait, Qatar, Saudi Arabia, and the United Arab Emirates.
We are expanding our investments in the Middle East with confidence in the region’s future as it pursues one of the world’s most ambitious AI transformations. We will add to our local partnerships across the region. We will build on the work we have done to stand by these countries’ governments and people through a period of significant challenges. As we look to the future, we will invest further in technology, digital resilience, and the people across the region.
From now until 2030, we will pursue the following initiatives with our partners in the region:
We will expand cloud and AI infrastructure across the Middle East
Microsoft will continue to invest in cloud and AI infrastructure across the region, expanding capacity, launching new capabilities, and delivering long-term infrastructure commitments. We plan to invest more than $10 billion in capital and operating expenses between now and 2030 in the region.
We will deepen our partnerships through national AI champions
Microsoft will deepen strategic partnerships with governments and national AI champion organizations to translate AI ambition into economic growth, modern public services, and global competitiveness. This builds on work with organizations including HUMAIN, G42, QAI, and the Government of Kuwait, alongside digital-government initiatives such as TAMM in the UAE, SDAIA’s ALLaM in Saudi Arabia, TASMU in Qatar, and Microsoft 365 Copilot adoption across the Government of Kuwait.
These partnerships will support responsible AI adoption, sovereign-ready cloud services, Arabic and multilingual AI, and the use of AI to improve services for citizens and businesses. They will be supported by capabilities including Microsoft Sovereign Public Cloud, Sovereign Private Cloud, and Project Digital Shield, where relevant and available.
We will invest in subsea and terrestrial connectivity
Digital resilience depends on strong and reliable networks. Protecting subsea and terrestrial connectivity requires sustained cooperation between governments and the private sector, but the foundation of continuity is redundancy. A diverse network of high-capacity routes allows traffic to be rerouted around disruptions, minimizing latency and maintaining critical data flows.
Microsoft has helped expand both the capacity and reliability of digital connectivity across regions through investments in major international subsea cable systems, including SeaMeWe-6, which has landings in Qatar, Saudi Arabia, and the United Arab Emirates, as well as operating a global network spanning more than 275,000 miles of terrestrial and subsea fiber. During network disruptions, Microsoft has demonstrated the value of redundancy by rerouting traffic through Middle East corridors and maintaining service continuity with minimal impact on customers.
Building on this foundation, Microsoft plans to invest more than $400 million in subsea and terrestrial connectivity across the Middle East by 2030. This investment will expand capacity, strengthen regional data flows, and support Microsoft’s growing cloud and AI infrastructure footprint across the region.
We will build AI infrastructure with the planet in mind
As we expand our cloud and AI infrastructure in Kuwait, Qatar, Saudi Arabia, and the UAE, we will do so with a focus on responsible growth. Guided by Microsoft’s global goals to address carbon, water, waste, and ecosystems, we will work with our lessor partners to ensure that the cloud infrastructure supporting our services advances Microsoft’s water-positive ambitions, including by prioritizing zero-water cooling technologies where feasible.
Water resilience is particularly important across the Middle East. Building on Microsoft’s global experience advancing water stewardship through water reuse, replenishment, and innovative water management solutions, we will work with governments and local stakeholders to identify opportunities that advance responsible water stewardship across the region.
As AI accelerates economic opportunity across the Middle East, expanding access to clean energy will be essential to ensuring this growth is sustainable. We will also collaborate with regulators, utilities, and our lessor partners to help create the market conditions needed to expand carbon-free electricity procurement and stimulate new clean energy investment. By combining infrastructure investment with local partnerships and innovation, we aim to support the region’s energy and water priorities while helping build the sustainable foundations needed for long-term AI-led economic growth.
We will launch a new Middle East digital resilience initiative
Conflict in the Middle East has reinforced the connection between digital resilience and digital sovereignty. Microsoft has worked with customers to support business continuity through resilience options tailored to different operational and regulatory needs. Going forward, Microsoft will make digital resilience a cornerstone of its Middle East strategy, helping organizations strengthen continuity and recovery through digital resilience assessments, reference architectures, readiness guidance, continuity planning, and enablement programs that help identify vulnerabilities, protect critical data, and build tested recovery capabilities.
We will strengthen data protection, privacy, and business continuity
Microsoft will expand our existing commitments on data-protection sovereignty and business continuity to eligible governments and customers in Kuwait, Qatar, Saudi Arabia, and the UAE. These are designed to give organizations greater confidence in how their data, systems, and operations are protected while maintaining continuity in times of uncertainty. They will be complemented by Microsoft’s growing sovereign-cloud portfolio, including Sovereign Public Cloud and Sovereign Private Cloud capabilities, together with Project Digital Shield and other capabilities that support security, privacy, transparency, and operational resilience.
We will expand and strengthen cybersecurity cooperation
As Kuwait, Qatar, Saudi Arabia, and the UAE accelerate their digital transformation, cybersecurity has become a core pillar of national and economic security. As governments, critical infrastructure, and economies become more connected, cyber threats and influence operations can have consequences that extend far beyond physical borders. That’s why we are announcing that we are deepening our partnerships with the cybersecurity authorities in these countries.
A network of dedicated Microsoft cybersecurity champions in Kuwait, Qatar, Saudi Arabia, and the UAE will help governments translate these resources into action and connect national priorities with expertise across Microsoft. Stronger cybersecurity benefits far more than individual networks. It helps build trust to ensure digital transformation will succeed.
We will advance responsible AI through governance, assurance, and inclusion
Microsoft will work with governments, businesses, researchers, and civil society organizations across the Middle East to help people and institutions benefit from new technology. As AI advances, realizing its full potential will require not only access to powerful technology, but the governance, assurance, and skills required to deploy it confidently and responsibly.
We will help strengthen AI governance capabilities across the region and support practical approaches to testing, evaluating, and assurance systems. We will also expand collaboration with the Responsible AI Future Foundation (RAIFF), co-founded with G42 and the Mohamed bin Zayed University of Artificial Intelligence (MBZUAI), to support the development and sharing of responsible AI practices and evaluation tools that can be applied across high-impact AI use cases in the Middle East and beyond.
By helping organizations align with emerging international practices, we aim to strengthen confidence in AI systems, support responsible innovation, enhance global competitiveness, and ensure that the Middle East plays an active role in shaping the future of AI.
We will advance AI for Good research and innovation
Microsoft’s AI for Good Lab will continue to support the region through research and partnerships focused on food security, low-resource language development, and climate and disaster resilience. This includes work through initiatives such as the LINGUA program, which supports the development of language technologies for underserved communities.
In partnership with governments, NGOs, nonprofits, and research institutions, the AI for Good Lab will continue developing and scaling AI solutions that address real-world challenges across the Middle East and beyond.
We will prepare the next generation for the AI economy
We believe AI should enhance human ambition, strengthen human capability, and help prepare workers to thrive in a changing economy. That is why Microsoft will continue to invest in AI skills, workforce readiness, public-sector capability building, and inclusive talent development across Kuwait, Qatar, Saudi Arabia, and the UAE, building on existing commitments to help skill more than 4.2 million people by 2030.
This work includes training for public-sector leaders, students, and workers; initiatives focused on expanding opportunities for women; and partnerships with educational institutions across the region. This work builds on programs such as Saudi Arabia’s AI Global Leadership Program, AI Skills 4 Women programs in Saudi Arabia and Qatar, and the Women’s Datacenter Academy in Saudi Arabia. Microsoft will also engage with workforce coalitions that can support national talent strategies and policy recommendations.
We will help education communities prepare learners for the AI era
Microsoft is working with governments, educators, institutions, and partners across the Middle East to develop responsible AI principles across primary, secondary, and tertiary education. This includes supporting AI literacy, helping educators integrate AI into teaching and learning, and sharing practical guidance for responsible AI use in educational settings. Across Kuwait, Qatar, Saudi Arabia, and the UAE, we will work with local partners to ensure students and educators can benefit from AI safely, responsibly, and effectively and will engage educators, policymakers, industry leaders, and civil society to support practical approaches to AI implementation that reflect local priorities.
We will help empower workers in the AI economy
We will partner with governments, employers, workers, education providers, and other stakeholders to help people adapt to changing workplace demands. Our focus is on practical skills development, workforce readiness, and leadership development that helps countries build competitive economies and create new opportunities for workers in an AI-enabled future.
We will support local and national AI talent priorities across the Middle East
Microsoft is partnering with governments, academic institutions, and civil society organizations to support national talent priorities by advancing AI skills, leadership development, and workforce readiness programs for public-sector leaders, students, underrepresented talent, and people across the Middle East. The goal is to help countries build globally competitive workforces, accelerate innovation, and unlock new economic opportunities in the AI era.
While no one can predict the future, one thing is certain: Microsoft has been part of this region’s journey for more than 35 years, and we are committed to being a partner for the long term. We look forward to continuing to work alongside governments, businesses, educators, and communities to help build that future together.
The post Microsoft strengthens its commitment to the Middle East by investing in technology, digital resilience, and people appeared first on Microsoft On the Issues.
Microsoft has disrupted EvilTokens, a powerful cybercrime platform that used AI at every step of the attack chain—from compromising email accounts to designing intricate roadmaps for financial fraud and scams. While EvilTokens helped cybercriminals access email accounts, at the center of the service was an AI-style chatbot that could analyze a victim’s inbox and help criminals identify trusted relationships, payment authorizations, and sensitive responsibilities, as well as other circumstances where fraud was most likely to succeed. The platform could even recommend fraud strategies, including drafting messages that impersonated trusted contacts to help criminals trick victims into taking action.
In short, AI was not simply helping attackers write more convincing messages. It helped them decide who to target, who to impersonate, and how to most effectively exploit the relationship to extract as much money as possible.
Within months of launching in February 2026, EvilTokens had been linked to more than 12,000 compromised email inboxes across over 10,000 organizations worldwide, showing how quickly the service gained traction. Microsoft observed the highest concentrations of victim activity in the United States, Canada, the United Kingdom, Australia, India, and France. Affected organizations ranged from wholesale distribution and construction to financial services, real estate, higher education, and healthcare. Working with partners, Microsoft seized 50 websites used to operate the service and disabled more than 150 additional domains tied to its supporting infrastructure. In the United Kingdom, the Metropolitan Police Service’s cybercrime team arrested two men on suspicion of offenses connected with the alleged operation of EvilTokens.
But the significance of EvilTokens extends beyond its rapid growth and global reach. It offers an early warning of what happens when cybercriminals combine stolen access with AI capable of understanding how an organization works.
EvilTokens helped criminals gain access to email accounts by tricking victims into entering an authentication code on Microsoft’s legitimate sign-in page. By completing the normal authentication sign-in process, victims unknowingly gave criminals access to their email accounts without revealing their passwords. That access could persist even after a password reset if the associated sessions and tokens were not also revoked. Microsoft Threat Intelligence provides additional technical details about the operation, how device-code attacks work, and steps customers can take to protect themselves here.
Once inside an account, criminals have traditionally needed time and experience to sift through thousands of messages, identify decision-makers, understand payment processes, and find opportunities for fraud.
EvilTokens began automating that work. Its AI tools could summarize and translate emails, surface financial conversations, map organizational roles, identify trusted relationships, and recommend potential targets. Preset prompts offered to find wire-transfer discussions, identify the organization’s “money movers,” locate vendor invoices, and determine the best people to impersonate.
Sold through Telegram for a $1,500 initiation fee and a recurring $500 subscription, EvilTokens combined account compromise, mailbox analysis, target selection, and fraud preparation in a single service. Capabilities that once required experience across identity attacks, cloud systems, social engineering, and financial fraud were available through a ready-made interface.
Investigators found evidence that large portions of EvilTokens had been “vibe coded,” with AI helping its creators build the platform itself. They also determined that EvilTokens drew on capabilities from multiple AI models.
The result was more than a collection of attack tools. EvilTokens packaged much of the fraud process into a commercially run service, complete with subscription pricing, customer support, management dashboards, and tools designed to move customers from account access toward financial exploitation.
No single organization could disrupt EvilTokens alone. The service relied on hosting providers, cloud services, AI tools, financial services, and other online resources that cybercriminals repurposed to support fraud at scale.
The disruption combined civil legal action with coordinated operational work across industry and law enforcement. Because healthcare organizations were among those targeted, Health-ISAC—a global non–profit that helps health sector organizations share cyber threat information and collaborate to improve operational resilience—joined Microsoft’s legal action as a co-plaintiff.
With authorization from the U.S. District Court for the Eastern District of Virginia, Microsoft and Health-ISAC worked with Cloudflare, Coinbase, OpenAI, Railway, SpyCloud, The Shadowserver Foundation, and TRM Labs to act against key parts of the platform. Microsoft also notified affected customers, helped remediate compromised accounts, and shared intelligence to support further defensive and investigative action.
The operation also demonstrated the value of rapid cooperation between private-sector investigators and law enforcement. Microsoft worked closely with specialist officers from the Metropolitan Police Service’s cybercrime team, sharing intelligence that enabled officers to take operational action in the United Kingdom. On September 11, 2026, officers arrested two men, aged 32 and 38, and seized digital devices and other items for examination. Both men have been released on police bail subject to conditions while the investigation continues.
While EvilTokens used AI to identify targets and prioritize fraud opportunities, Microsoft investigators used reverse engineering and AI-powered tools to analyze evidence, accelerate the investigation, and identify the infrastructure supporting the service. The case shows how AI is changing not only how cybercriminals operate, but also how defenders investigate and disrupt them.
This action marks the Microsoft Digital Crimes Unit’s (DCU) 40th court-authorized disruption spanning nearly two decades of targeting cyber threat actors, malicious tools, and supporting infrastructure. It is also DCU’s first action against an end-to-end AI-enabled cybercrime service.
The infrastructure supporting EvilTokens has been disrupted, but the model it demonstrated will not disappear with it. As Microsoft notes in its 2026 Responsible AI Transparency Report, increasingly capable and accessible AI is being used to scale fraud, impersonation, and other forms of online abuse. EvilTokens offers an early example of how those capabilities can be combined with compromised accounts to accelerate financial fraud.
For organizations, the lesson is: assume that once an inbox is compromised, criminals may understand its contents in minutes, not days. Strong identity protections and monitoring remain essential, but organizations should also independently verify requests to change payment information, redirect funds, or approve unusual transactions through a trusted second channel.
The post Disrupting EvilTokens: The AI Chatbot Built for Cybercrime appeared first on Microsoft On the Issues.
Today we published our latest Global AI Diffusion Report. Global AI diffusion continued to climb in the second quarter of 2026. In June, AI usage was 18.8% of the working-age population worldwide, an increase of about 1% from the first quarter of this year. Growth was broad-based: almost every economy saw increased usage.
Notably, the UAE (73.3%) and Singapore (64.3%) continue to top the leaderboard. South Korea again saw the largest absolute change, with an increase of 3.5 percentage points. Saudi Arabia climbed five places from 30th to 25th, the largest rise in the rankings. Japan recorded the largest relative change, growing by 2.2 percentage points, or roughly 10% relative to its Q1 usage of 22.5%. Worldwide, the quarter brought a continued widening of the AI gap between the Global North and South, with usage now at 28.8% in the North and 16.2% in the South.
To track all these trends, we continue to measure AI diffusion as the share of people worldwide ages of 15 and 64 who have used a generative AI product during the reported period. This measure is derived from aggregated and anonymized Microsoft telemetry data and is adjusted to reflect differences in operating system and device market share, internet penetration, and population. Additional details on the methodology are available in our AI Diffusion technical paper.
No single metric is perfect, and this one is no exception. Through the Microsoft AI Economy Institute, we continue to refine how we measure AI diffusion globally, including how adoption varies across countries in ways that best advance priorities such as scientific discovery and productivity gains. For this report, we rely on the strongest cross-country measure available today. Over the past year, there has been a significant rise in new AI tools and models. For our next report, we will expand our measure to include usage of these new tools and expect this update to increase AI user share across almost all economies, with larger projected increases in China.
In addition to our comparison of AI diffusion between the Global North and the Global South, we also find important differences in how AI is being used. Using consumer Microsoft Copilot usage insights, we examined these differences. The most notable difference is a higher share of education and learning use in the Global South.
This report also includes a substantive discussion of open-weight AI models. Open-weight AI model use is increasingly visible through application programming interface (API) usage of AI, where open models have captured a growing share of token volume. This shift could especially benefit the Global South by lowering access costs and enabling adaptation to local languages and needs, although barriers such as infrastructure, connectivity, and skills remain.
Download the latest Global AI Diffusion report and explore the data here.
The post The continued state of global AI diffusion in 2026 appeared first on Microsoft On the Issues.
Why LinkedIn is challenging an overbroad government demand—and why Congress must make secrecy the exception
Today, the U.S. Court of Appeals for the Fourth Circuit heard oral argument in LinkedIn’s (a Microsoft subsidiary) appeal challenging a government demand for user records and a related secrecy order that is preventing LinkedIn from notifying those users that the government is seeking their data. The appeal asks important, constitutional questions about whether service providers may challenge demands that sweep in records unrelated to an investigation, and when the government may prevent a provider from notifying the user of a request.
This appeal continues Microsoft’s longstanding work to ensure that secrecy orders remain the exception, not the rule. LinkedIn’s appeal asks courts to enforce meaningful limits on both the scope of government demands and the secrecy that can accompany them.
We recognize law enforcement’s important role in protecting public safety and investigating crime, and sometimes that does need to be done covertly. We respond to lawful legal requests. At the same time, customers and users deserve meaningful limits and independent oversight through an adversarial process. And, customers deserve to be notified when the government seeks their data, unless the government clearly establishes the need for secrecy under statutory and constitutional standards.
Those safeguards fulfill basic constitutional rights. The Fourth Amendment protects the right to be free from unreasonable searches and seizures. That right applies to papers kept in a desk, and it also applies when personal and business records are stored online. Online service providers, like LinkedIn and Microsoft, also have a First Amendment right to speak to their customers when the government obtains an order to search their private information. Secrecy may sometimes be justified—but it should be tailored to demonstrated needs and subject to meaningful review.
This particular case arose after LinkedIn received a court order seeking user records together with a secrecy order preventing LinkedIn from informing anyone about the order. The details remain under seal, including the nature of the information the government seeks and the people who own that information. But the Fourth Circuit partially unsealed LinkedIn’s opening brief in July, allowing the public to understand some of the core issues. LinkedIn argues that the demand is overbroad, the secrecy order is unconstitutional, and the government has violated LinkedIn’s due process by withholding evidence from LinkedIn.
Three amicus briefs from a broad coalition support LinkedIn’s position. The American Civil Liberties Union and ACLU of Virginia argue that users’ privacy interests must inform whether a demand is reasonable and that providers may be the only practical means of challenging unlawful process because users often receive no notice. The Reporters Committee for Freedom of the Press warns that overbroad demands, delayed notice, and secret evidence can expose confidential sources and chill newsgathering. Amazon, Apple, Google, Meta, and X emphasize that cloud providers are uniquely positioned to identify irrelevant requests and that secrecy orders require case-specific evidence rather than boilerplate assertions. Together, these briefs show why cloud providers must be able to test both the scope of government demands and the need for secrecy.
Microsoft has a long record of standing up for these principles. In 2014, Microsoft successfully challenged a secrecy order connected to a National Security Letter that prevented notice to an enterprise customer. In 2016, we filed a landmark challenge to the widespread use of indefinite secrecy orders. We’ve successfully challenged individual secrecy orders time and again over the years. Our efforts contributed to updated Justice Department policies, but executive-branch practices can change. Durable protections require the development of case law and legislation.
The U.S. House of Representatives recently took an important step in that direction. On August 31, the House passed legislation to rein in secret surveillance and strengthen notice protections when the government seeks data held by technology providers. As we explained when the bill passed, the reforms would place clearer limits on secrecy orders, require greater accountability, and help ensure that secrecy is the exception – not the rule. The Senate should act promptly to send these historic reforms to the President.
The House –passed legislation recognizes that privacy and public safety are not opposing values. Clear standards can give investigators the confidentiality they genuinely need while providing courts, providers, and customers with predictable rules. The pending legislation and LinkedIn’s appeal are the latest, complementary chapters in this broader effort. Legislation can establish durable, system-wide rules for notice and accountability. Courts must meanwhile enforce the limits already contained in existing statutes and the Constitution. Neither task requires obstructing legitimate investigations. Rather, both mean the government must seek only relevant information, justify secrecy with specific evidence, and infringe on speech to the least extent possible.
That is why today’s argument matters beyond a single sealed investigation. People and organizations increasingly entrust their most sensitive information to online services. If providers cannot challenge demands they know are overbroad—or if courts may silence them without a rigorous, adversarial review—the safeguards the law requires will be weakened precisely when they are most needed.
Microsoft and LinkedIn will continue to support lawful investigations while standing up for customer privacy, transparency, and the rule of law. We have appealed to the Fourth Circuit to preserve providers’ ability to challenge overbroad demands and to require the government to meet its constitutional burden before imposing secrecy. And we urge the Senate to complete the work the House began by enacting durable non-disclosure order reform.
Further reading
The post Protecting customer privacy means standing up for transparency appeared first on Microsoft On the Issues.
As Americans prepare to vote this November, artificial intelligence is changing how many people find and understand election information.
Some voters are deliberately turning to AI tools with questions about candidates, ballot measures, election procedures, and issues that matter to their communities. Others are encountering AI-generated summaries at the top of search results. In either case, AI is increasingly becoming a front door to election information.
This shift is happening quickly. More than 30% of the U.S. working-age population now uses AI (Microsoft AI Diffusion Index, Q1 2026; Microsoft, AI Adoption Across the United States). These tools can help people understand complicated topics, compare information, and explore unfamiliar issues. But election information can also present some challenges for AI. It is highly local, changes quickly, and can be incomplete, contested, or stripped of essential context.
The answer is not to steer voters away from AI, it is to help people use it wisely, particularly when the information may influence aspects of their voting experience, such as how, when, and where they cast their ballot.
That is why, on National Voter Registration Day, a day when our brands and products come together to encourage civic participation, we’re launching the next phase of our voter education initiative, Check. Recheck. Vote. This year, the campaign will equip voters with practical AI literacy skills for the 2026 election season.
We launched Check. Recheck. Vote. in 2024 to help voters recognize the risks posed by deceptive AI-generated content. Deepfakes and other deceptive media remain a serious concern. But in conversations with voters and election organizations, we are also hearing about a broader and more immediate challenge. Millions of people now encounter election information through AI-generated answers, and many are not sure how to determine whether those answers are current, complete, or reliable.
The updated campaign gives voters three straightforward steps:
At the center of the campaign is a new 75-second video that shows how an AI-generated answer can appear during an ordinary election-related search, explains where these answers can fall short, and offers simple steps voters can take before relying on them.
YouTube Video
The campaign website pairs the video with practical guidance and links to authoritative election resources, including state-by-state voting information and tools for educators.
We are working with the National Association of Secretaries of State (NASS) and the National Association of State Election Directors (NASED) to scale the reach of this campaign across all fifty states and the territories and to point voters to accurate information directly from state and local election officials so they can participate with confidence.
We believe that civics and voter education start well before a citizen is old enough to vote. That’s why we are also investing in efforts to extend AI voter literacy education in the classroom. The campaign website includes a classroom activity to help students examine how AI may shape the election information they encounter, practice verifying claims, and keep their own judgment at the center of the process. We are also amplifying our impact on this important issue by supporting the News Literacy Project.
We’re also proud to announce today that, in partnership with iCivics, we are launching Village Square – a new Minecraft Education civic learning experience that helps students explore how communities make decisions and solve shared challenges. The game brings concepts such as dialogue, participation, and collective decision-making to life through immersive gameplay. Village Square gives educators and families an engaging, nonpartisan way to help young people practice listening to different perspectives, weighing trade-offs and working together to build stronger communities.
Finally, we know that credible local reporting remains essential to informed civic participation, and that reporting is under strain in many communities.
In Washington state, Microsoft is partnering with the Associated Press Fund for Journalism to expand election coverage for 10 local newsrooms operating 14 news websites. Participating newsrooms receive access to AP election results and race calls, vote tabulations, state-specific maps and graphics, and resources that help local journalists connect national and statewide developments to the communities they serve.
The newsrooms represent communities from Seattle to Spokane and the Wenatchee Valley. Their work complements the reporting of the Associated Press, helping trusted, fact-based election coverage and results reach communities that might otherwise lack access.
This investment reflects a broader reality. Voters need more than information. They need reliable sources that can provide context, ask hard questions, correct mistakes, and explain what national developments mean at the local level.
Voters aren’t the only ones navigating this AI moment, so are the people running campaigns and conducting elections, all while facing an increasingly complex cybersecurity landscape. Microsoft has long supported the security and resilience of campaigns and elections. In 2018, we launched AccountGuard to help political campaigns and democracy-focused organizations defend against cyberattacks, and during the 2024 election cycle we joined dozens of other technology companies in the Tech Accord to Combat Deceptive Use of AI in 2024 Elections. Here’s how that commitment continues today:
Equipping election officials. With The Elections Group, International IDEA, Ready for Tuesday and Arizona State University’s Mechanics of Democracy Lab, we launched the free, open-source AI + Elections Skills Hub: prompts, sample AI agents, and draft policies for responsible adoption. It’s already reached 1,000+ officials across 45 states.
Strengthening cybersecurity. We’ve deployed Microsoft Sentinel to several state and local election offices for stronger threat detection, and we’re also supporting select election and political stakeholders with MDASH to find and fix software vulnerabilities faster.
Countering bomb hoaxes. More than 300 emailed bomb hoaxes disrupted polling places in 2024. In response, we’ve started a new Elections Bomb Threats Task Force alongside partners Social Scout, Nisos, and the Committee for Safe and Secure Elections (CSSE) to bring together digital intelligence and law enforcement expertise to track & share trends and reduce disruptions. An initial report on the hoaxes encountered in 2024 will shape our approach for 2026.
Supporting campaigns. Built with Defending Digital Campaigns, our Secure AI Toolkit for Campaigns has reached 3,000+ campaigns and political stakeholders with practical AI guardrails. Our Campaign Technology team has also trained thousands of candidates, staff, and officials from both parties on responsible AI use and cybersecurity best practices.
The technology continues to change, but our approach remains consistent: help voters find authoritative information and make informed judgments, help campaigns and election authorities defend against evolving threats, and help the election community adopt technology that strengthens security, accountability, and civic participation. This work is bipartisan by design, and it includes:
The 2026 election will be the first U.S. federal election in which generative AI is part of the everyday environment for millions of voters as well as those who support the political process. That creates new risks, but it also gives us an opportunity to equip people with skills that will remain valuable well beyond a single election.
The post 2026 midterm elections: Helping voters navigate election information in the age of AI appeared first on Microsoft On the Issues.
Today, Microsoft is sharing our Safe Participation Framework, which centers on designing and enabling safe, privacy-preserving, and age-appropriate experiences for young people online. Members of our AI Youth Futures Council have delivered a clear message: they want to learn, create, and prepare for a future with AI. Protecting their privacy, ensuring their safety, and preserving their opportunity to participate must go hand in hand.
They are right. Children and families should not have to choose between the protections they need and the opportunities technology can provide.
Technology companies have a responsibility both to protect young people from harm and to ensure they can benefit from technology through thoughtfully designed experiences, age-appropriate protections, and demonstrable safeguards. Microsoft’s Safe Participation Framework serves as a foundation for our work today, and we expect it to continue evolving as technology, research, and societal expectations change. We do not claim to have all the answers, but we believe it is important to share our approach and our learnings to help inform emerging regulatory frameworks and advance protection and opportunity together.
Microsoft recognizes our responsibility to help create safer experiences for all users, particularly children and those more vulnerable to harm. Our safety-by-design approach seeks to embed protection from the outset: identifying foreseeable risks, examining the impact of product features and user experiences, and implementing proportionate safeguards. As risks evolve, we continue to learn from emerging research, science, andas well as from customers, governments, and other stakeholders.
For more than a decade, Microsoft has invested in technologies designed to protect people online, beginning with PhotoDNA in 2009 and continuing through our work to build safeguards for AI experiences and address emerging harms such as synthetic and non-consensual intimate imagery. We have also learned that families want tools that are simpler, intuitive, and easier to use. That is why, earlier this week, we announced new protections and defaults for children, teenagers, and families using Windows Family Safety. We view these changes as an important step forward, while recognizing that earning and maintaining trust requires continued investment, learning, and iteration.
Bing has also strengthened protections against child sexually abusive material (CSAM) across its generative AI experiences. We have also expanded SafeSearch globally to cover additional categories of harmful content, helping reduce the risk of exposure to harmful material. We will continue to make progress, listen to our users and stakeholders, and learn by working with others to strengthen safety.
Our goal is to help children and teenagers participate confidently in appropriate digital experiences that reinforce access to the meaningful educational, social, and economic opportunities technology can provide. Achieving that goal requires real protections that are proportionate to risk and implemented in ways that respect users’ privacy. Risks are not uniform across different technologies and services, and safeguards should reflect and address those differences.
We recognize that young people are not a single group. Their needs, capabilities, and expectations evolve with age, development, and context. For that reason, age-appropriate design is an important element of creating safer digital experiences and complements safety-by-design. Age-appropriate design ensures protections and experiences are responsive to the needs of users at different stages of development. This approach informs experiences across Microsoft’s consumer ecosystem.
On XBOX, we leverage family safety and privacy tools designed specifically to help manage online interactions, content access, spending, screen time, and privacy settings. These features are intended to support safer experiences while giving families flexibility to make choices. We are applying many of these same learnings to Copilot. All users must now sign in to use Copilot, and access is restricted for children under 13 (or older where required by local law). We have also implemented measures to reduce exposure to harmful content, directing users to crisis support resources when self-harm risks are detected, and encouraging healthy use through transparency, break reminders, reporting tools, and guardrails to protect against delusional outputs.
Microsoft has now also extended protections at the platform level. Through our new Windows Age application programming interface (API), expanded age assurance capabilities, and enhanced family safety tools, Microsoft is helping establish a more consistent and privacy-conscious foundation for age-appropriate experiences across the broader ecosystem. These capabilities are intended to provide developers with trusted age signals to support age-appropriate protections, making the experience ultimately easier for families to understand and navigate downstream.
Reliable age signals play an important role in enabling age-appropriate experiences. Innovations such as the Windows Age API help provide privacy-preserving age signals while minimizing the collection and sharing of personal data. Young people share this expectation. Participants in Microsoft’s AI Youth Futures Council have consistently emphasized the importance of understanding how their information is collected, used, and protected.
Technology alone cannot deliver safe participation. Young people and their families must have an opportunity to provide direct feedback, and they must have easy access to tools and resources that support and build their knowledge as they navigate digital experiences, evaluate what they encounter, and decide when to seek help. Digital literacy is, therefore, a core component of child safety.
Microsoft has invested in digital literacy and safety education for years through resources and partnerships that reach communities around the world. Earlier this year, we launched Behind the Chat: A Human Guide to Safe AI Conversations, designed specifically to help young people understand the opportunities and risks associated with AI companionship. This toolkit is supported by classroom resources for educators and materials for parents and trusted adults, reflecting our belief that supporting young people requires an ecosystem approach. Beginning this fall, we will expand these resources throughout Europe, Asia, and the Americas. We will also continue working closely with educators to ensure safety and privacy.
Over the coming year, we will deepen partnerships with researchers, AI Safety Institutes (AISIs), governments, and civil society to advance the research, evaluations, and benchmarks needed for safer digital and AI experiences. Working together, we will learn and help build the foundation for the next generation of trusted technology.
Our work is far from finished. As technology evolves, our understanding of how to support young people safely and responsibly must continue to evolve with it. This framework reflects our current approach, informed by evidence, shaped by young people and their families, and grounded in ongoing learning. We recognize that we do not have every answer, and that building safer digital experiences will require continued experimentation, humility, and collaboration. No single organization can do this alone. Progress will depend on deep partnerships across government, industry, civil society, educators, and families worldwide. Together, we can help build a future in which every young person has the opportunity to participate, create, learn, and thrive.
The post Safe Participation Framework: Opportunity and Safety for the Next Generation in the Age of AI appeared first on Microsoft On the Issues.
The extortion group has modified its exploit in new attacks targeting the PeopleSoft vulnerability CVE-2026-35273.
The post Google Warns of ShinyHunters’ Fresh Oracle PeopleSoft Campaign appeared first on SecurityWeek.
The platform combines open source software and a reference system design to keep AI agents within set boundaries.
The post Nvidia Unveils AI Agent Safety Platform With Hardware-Based Watchdog appeared first on SecurityWeek.
Citrix has released patches for the critical NetScaler vulnerabilities tracked as CVE-2026-88771 and CVE-2026-88772.
The post Citrix Confirms 2 NetScaler Zero-Days After Admins Pulled the Plug appeared first on SecurityWeek.
CISA added CVE-2026-65660 to its KEV catalog, giving federal agencies a patching deadline of September 28.
The post Microsoft SharePoint Flaw CVE-2026-65660 Now Exploited in Attacks appeared first on SecurityWeek.
In this post, Flashpoint analysts examine Process Parameter Poisoning—a novel EDR evasion technique we validated in Rust—and detail how abusing undocumented process parameters allows attackers to inject code and bypass standard security products.
Table Of ContentsModern Endpoint Detection and Response (EDR) platforms have made traditional malware injection techniques significantly harder to execute. In most cases, if a threat actor attempts to write malicious code into a process, an alert will fire. However, that sense of security is being actively challenged as cybercriminals and red teams find new ways to blend malicious payloads into standard operating system routines.
Flashpoint’s Intelligence team built and tested a proof-of-concept for a newly disclosed technique known as Process Parameter Poisoning. By compiling a custom payload and layering evasion mechanics, our analysts demonstrated how easily traditional API hooks can be rendered blind in a laboratory environment—achieving zero alerts across tested EDR/XDR controls.
Process Parameter Poisoning is a novel endpoint detection and response (EDR) evasion technique that combines process parameter spoofing and thread execution hijacking to inject code into foreign processes without triggering standard security detection mechanisms.
Discovered by researchers Max Hirschberger and Ogulcan Ugur, Process Parameter Poisoning is designed to inject code in foreign processes without relying on the conventional memory-manipulation workflows that modern security tooling monitors.
To execute process injection, historically security tools and threat actors alike have focused on a small set of well-known Windows application programming interfaces (APIs). Process Parameter Poisoning shifts away from these heavily watched routines entirely. Instead of calling memory-accessing APIs to allocate and write into a target process, the technique hides the malicious payload directly inside standard process initialization structures during the initial creation of a process. The result is a fundamental shift in defense evasion that effectively blinds traditional, API-hooking EDR agents during the initial stages of code execution.
Process Parameter Poisoning allows attackers to bypass suspicious memory-accessing Windows APIs, such as VirtualAllocEx(), WriteProcessMemory(), and MapViewOfFile2(). Security products heavily monitor these specific APIs due to their high rate of abuse in traditional process injection techniques. However, by avoiding these calls, an attacker effectively bypasses the initial primary triggers used by endpoint agents to flag malicious cross-process memory activity.
When using the Windows application programming interface (API), CreateProcessA/W(), the developer can specify parameters such as the command-line to be executed by the new process, environment variables for the new process, current working directory for the process, window title if it is a console application, create a hidden window, create the process in a suspended state, etc. Many of these parameters are passed into CreateProcessA/W() via the STARTUPINFOA/W structure.
Some entries are undocumented and labeled “reserved” by Microsoft. The discovering researchers found that data stored in STARTUPINFO->lpReserved ends up in the Process Environment Block once the new process is initialized in an entry called “ShellInfo.” Below is an example of placing data into the STARTUPINFOW->lpReserved entry in a test application and the data stored in ShellInfo while debugging the newly created process.
Flashpoint analysts created a proof-of-concept (POC) in Rust to test this technique based on the POC C++ source code provided by the researchers:
Flashpoint confirmed that after changing the memory to have executable permissions, the threat actors can perform thread hijacking by using GetThreadContext() to acquire information about the current running thread, change the instruction pointer to point to the ShellInfo.Buffer address, and then SetThreadContext() to apply the changes and execute the shellcode.
Flashpoint analysts further confirm that this technique also works with the WindowTitle entry, CommandLine entry using the same series of steps.
The technique also works with the Environment entry but requires additional steps. Environment blocks require a variable name and the variable data separated by an “=.” Environment blocks can contain multiple variable entries in which each entry is ended with a null terminator. Two null terminators are necessary to denote the end of the environment block. This means the payload needs to be embedded in a longer string with a “{NAME} = {VALUE}” format.
Flashpoint analysts note that four null terminators were appended to the shellcode bytes to denote the end of an environment block in Unicode. The resulting payload buffer is then passed into the lpEnvironment variable of CreateProcessW() along with the CREATE_UNICODE_ENVIRONMENT creation flag.
The rest of the process remains the same as reading the PEB and RTL_USER_PROCESS_PARAMETERS structure. The Environment entry is read, but at the offset of the embedded shellcode within the poisoned environment block string. Because four bytes were added to the beginning of the shellcode to make the Unicode environment block, execution needs to begin after four bytes from the beginning of the buffer to begin executing at the shellcode.
Flashpoint notes that the shellcode requires no NULL bytes, and, if using the PAGE_EXECUTE_READ flag, it cannot overwrite itself. This means automated shellcode generators such as MSFVenom might not work either because they contain NULL bytes or use encoders that perform memory writes during execution. Flashpoint analysts wrote custom shellcode to further test this technique. The shellcode downloads and executes an additional payload. The combination of this technique, custom shellcode, and the use of Rust as the programming language proved successful in minimizing initial static detections by security software.
Flashpoint tested this technique with a commonly-used open source EDR platform. The EDR platform itself failed to produce any alerts from executing the malicious binary. However, the XDR component blocked on the initial creation of a new process and COM interactions by the second stage payload.
Flashpoint analysts then combined this technique with the DLL unhooking technique and applied the non-Microsoft block DLL policy during the creation of the sacrificial process. Analysts observed no blocks from the XDR during execution and observed no alerts on the platform.
| Tactic | Technique ID | Technique Name |
| Stealth | T1055 | Process Injection |
| Stealth | T1055.003 | Process Injection: Thread Execution Hijacking |
| Stealth | T1564.010 | Hide Artifacts: Process Argument Spoofing |
Security teams can leverage several detection strategies to identify Process Parameter Poisoning, though each approach carries distinct limitations:
Process Parameter Poisoning demonstrates another advancement in stealthy process injection and the constantly evolving research into evading security products. By using the previously unknown purpose of the lpReserved field within the STARTUPINFOW structure to house shellcode, this technique bypasses standard security product triggers associated with common memory-allocation APIs. While this proof-of-concept was proven successful in lab testing, the technique has multiple opportunities for detection and will most likely require a combination of additional evasion techniques to achieve a higher success rate.
As threat actors continue to refine technique-stacking and exploit overlooked Windows internals, relying on traditional API hooks is no longer enough to protect your enterprise. Staying ahead of modern evasion mechanics requires proactive intelligence and deep visibility into emerging adversary TTPs.
Request a demo today to see how best-in-class threat intelligence can help security teams detect, prepare for, and neutralize advanced defense evasion techniques before they impact your network.
The post Process Parameter Poisoning: Inside a Novel EDR Evasion Technique appeared first on Flashpoint.
The Daybreak initiative will provide subsidized AI cyber capabilities, training and technical assistance, though OpenAI has disclosed few details about costs and eligibility.
The post OpenAI Pledges $1 Billion to Bring Frontier AI to Critical Infrastructure Defenders appeared first on SecurityWeek.
Dubbed PostGREShell, CVE-2026-6471 turns low-level replication access into code execution, permanent superuser privileges and a persistent database backdoor.
The post 12-Year-Old PostgreSQL Vulnerability Enables Database, Server Takeover appeared first on SecurityWeek.
Today, Microsoft published its 2026 Responsible AI Transparency Report. The report highlights the progress we’ve made in building and deploying AI responsibly, supporting our customers, and strengthening our responsible AI governance, tools, and practices. You can explore the report in its entirety here.
AI is moving fast, and so are societal expectations. The boundaries of what people can accomplish with AI are expanding, and communities are asking more questions about how AI systems are designed, built, and used. As AI becomes more integral to how we live and work, confidence that AI systems are operating reliably and securely is becoming an essential prerequisite to their broad and beneficial adoption.
At Microsoft, we have been building a responsible AI program for nearly a decade, rooted in two core beliefs: that trust is foundational to realizing the benefits of AI and that the empowerment of people and organizations must remain at the center of our strategy. As capabilities advance and adoption accelerates, that experience is helping us meet this moment and adapt for what comes next.
Our third annual Responsible AI Transparency Report shares how our program is evolving and the priorities that continue to shape our work. Over the last year, investing in three specific areas has enabled us to embed trust more deeply and at greater scale: adaptive governance and technical risk management, practical tools and capabilities, and shared practices and strong partnerships. These investments cut across five trends shaping the AI landscape, including the rapid expansion of agentic AI.
Taken together, these trends and investments underscore our view that model capability alone will not determine the impact of AI. That will depend on organizations that develop and deploy AI technologies that deliver real value—and govern them with the rigor and adaptability needed to earn and sustain trust.
As the frontiers of AI advance, we are making our governance more adaptive and more tightly integrated with engineering workflows. In practice, this means that we have updated our policies to better match the AI tech stack and AI value chain, evolved our risk management practices to address emerging AI capabilities and risks, and strengthened the readiness of our responsible AI community: the people who operationalize our program at enterprise scale.
This year, we re-engineered our Responsible AI Standard to make it more adaptive to evolving technical realities, uses, risks, and regulatory requirements. The new Standard is structured by reference to different components of the tech stack—models, platform services, and applications—and the role that Microsoft plays in developing or deploying those components. It combines core requirements that always apply with more targeted, scenario-specific requirements that can evolve as capabilities and risks change. For example, we apply some of our most rigorous risk management measures to AI systems with the most significant cyber capabilities, helping ensure that advances in AI favor the defenders responsible for securing critical digital infrastructure.
We are also evolving our technical risk management practices. Increasingly capable systems can retain memory, use tools, access data, and take actions on behalf of users. Governing these systems requires us to think beyond the behavior of an individual model or application to interactions among models, agents, applications, tools, data, and people. Our work increasingly focuses on controls such as agent identities, tool permissions, and monitoring of actions.
And governance only works when people can put it into practice. We have continued to build responsible AI capabilities across Microsoft, equipping thousands of engineers and product managers with training on topics such as agentic AI threat modeling and prompt injection defenses.
Together, these investments are helping us move toward a more continuous, lifecycle-based approach to AI governance. With agentic AI, risks can evolve as systems interact with their environments, users, and other systems. Our governance needs to evolve with these agentic capabilities—and incorporate what we learn from their testing and deployment.
Effective governance depends on tools that help translate policy goals into action. As developers and organizations navigate a more complex technical and regulatory environment, they need practical ways to identify risks, evaluate systems, establish controls, and monitor how AI behaves in the real world.
We are applying what we learn from governing AI at Microsoft into tools, capabilities, and resources that help developers and organizations beyond Microsoft do just that—whether they build on our platforms or leverage open-source projects.
We have expanded tools to evaluate AI systems across the lifecycle. A new AI Red Teaming Agent helps accelerate the identification and evaluation of risks. Agent evaluators help developers measure the quality, safety, and performance of agentic applications. RAMPART turns red team findings into repeatable tests, enabling more continuous coverage as systems change.
We are also building greater visibility and control into agentic systems. With ASSERT and Agent Control Specification, developers can evaluate agents against their policies, place runtime controls at critical points in an agent’s workflow, and monitor behavior.
These tools and capabilities reflect a shift: as systems become more dynamic, governance needs to become more operational. Organizations need to be able to see what their systems are doing, test how they behave, and intervene when necessary—not just assess them before deployment.
Organizations also need confidence—and increasingly need to demonstrate—that responsible AI practices are being implemented consistently. Microsoft is one of the few companies certified against ISO 42001 across a broad portfolio, including Microsoft 365 Copilot, Foundry, and GitHub Copilot. Over the last year, we have simplified and strengthened our internal processes that support that certification.
Ultimately, responsible AI governance is a shared responsibility across the AI value chain. Our goal is to help make the practices and capabilities needed to meet that responsibility more accessible, practical, and scalable.
The challenges of governing AI are bigger than any one company, and increasingly interconnected AI systems make collaboration even more essential.
As AI adoption expands across borders and sectors, we need shared expectations for how systems are evaluated, monitored, and governed, as well as interoperable standards that enable visibility into interactions across tools, data, and systems. We also need to keep advancing the underlying science and technical practices so that we can benefit from rigorous, applied insights into what effective governance looks like and where the remaining gaps are.
That starts with research. Over the past year, we advanced our work with the US Center for AI Standards and Innovation and AI Safety and Security Institutes in Australia, Singapore, and the UK to strengthen the science and practice of AI evaluation. We also launched an External Red Team Alliance with 18 universities across six continents to expand understanding of priority risks.
Common technical practices and standards are critical. Through the Frontier Model Forum, OpenTelemetry, and the Appia Foundation, we are helping develop approaches spanning frontier cyber benchmarks, end-to-end observability for increasingly agentic systems, and AI assurance across supply chains and sectors. We are also contributing to efforts that make transparency reporting more interoperable across organizations and jurisdictions, including through an OECD-led informal task force that developed the Hiroshima AI Process Reporting Framework version 2.0.
We also need shared ways to measure progress. We cannot meaningfully assess progress if every organization measures AI risks differently. Through our work with MLCommons, we are helping expand AILuminate into a broader suite of reliability benchmarks, creating common approaches for evaluating areas such as jailbreak resilience, multilingual performance, and psychosocial risk in conversational AI.
Shared learning, shared practices and standards, and shared measurement can help the entire ecosystem develop while raising shared expectations for trust.
Our experience over the past year has reinforced that responsible AI cannot be static. It has to be embedded in development processes, supported by practical tools, and continually informed by what we learn. That is why our responsible AI investments extend from the systems we build, to the tools we provide our customers, to the research, practices, and measurement approaches we help develop with the broader ecosystem.
Our 2026 Responsible AI Transparency Report explores this work in more depth—from how we re-engineered our Responsible AI Standard to how we are strengthening governance for agentic AI, advancing evaluation, and addressing AI misuse. We invite you to explore the report to see what we have learned, what we have changed, and how we are putting our priorities into practice.
As AI becomes more powerful and more present in people’s lives, our commitment is to keep listening and learning, to keep strengthening our safeguards, and to keep putting the empowerment of people and organizations at the center of our strategy.
The post Responsible AI in 2026: How we are adapting for what’s ahead appeared first on Microsoft On the Issues.
Today, the House of Representatives passed historic legislation that will protect our customers’ most fundamental privacy rights in the cloud. The bipartisan NDO Fairness Act (H.R.6048) would require that federal courts apply a rigorous standard when issuing non-disclosure orders (NDOs), or secrecy orders, that prevent technology providers from telling customers when law enforcement accesses their emails, texts, photos, and other personal information in the cloud. Microsoft has strongly supported these reforms, and they are consistent with our commitment to protect our customers and ensure trust in the digital services that are powering the global economy. The House’s passage of the NDO Fairness Act marks a significant step forward. We now look forward to working with the Senate to advance these important reforms.
The NDO Fairness Act would finally correct the glaring disparity between covert searches in the physical and digital worlds. Law enforcement must meet a strict standard for secret physical searches, but these restrictions do not apply to secret searches for data stored by technology providers. Instead, law enforcement can obtain boilerplate secrecy orders under a 40-year-old law, the Electronic Communications Privacy Act (ECPA), enacted before the cloud even existed. This represents a fundamental shift from historical law enforcement practices where secrecy was the exception, not the norm. Officers or agents would knock on your door with a warrant or serve your company with a subpoena. If you had an issue with that, you could go to court to object. But NDOs, often obtained without meaningful judicial review, allow law enforcement to skip going to you and instead go to your cloud provider for your data in secret.
This is a problem with far-reaching consequences. The overuse of secrecy orders erodes trust in and discourages adoption of the cloud, stifles transparency and accountability, and threatens our fundamental freedoms. Notice is perhaps the most foundational protection against government overreach. It is necessary to give meaning to nearly every other right we enjoy. This is because it is a lot more difficult to assert your rights when you don’t know they are at risk to begin with.
In recent years, Congress has learned this lesson firsthand. Microsoft first testified and began working with Congress in support of the NDO Fairness Act following reports in 2021 that the first Trump Justice Department used NDOs in a leak investigation that prevented notice of legal demands to Members of Congress, their staff, and the press. In a subsequent review, the Justice Department’s Inspector General found that the NDOs used boilerplate justifications that did not include case-specific information and did not even inform the court that some accounts belonged to Members of Congress. The NDOs were then renewed for years—some even after the investigation was public and individuals were no longer targets.
This is despite the fact that, under our Constitution, Congress is a separate branch of government and has unique Speech or Debate privileges, and the press is entitled to heightened First Amendment protections.
Separately, a recent Senate investigation revealed that the Biden Justice Department’s “Arctic Frost” probe of the 2020 presidential election sought telephone records from more than a dozen Members of Congress. As first disclosed by Senator Grassley and recently reported in the New York Times, the subpoenas were accompanied by NDOs that, again, did not inform the judge of the fact that the phone numbers belonged to Members of Congress.
The NDOs in these two investigations illustrate a core problem with NDOs. And it’s a problem that spans administrations and extends well beyond investigations involving Members of Congress: Too often, courts are not aware of the most basic facts needed to evaluate whether total secrecy is necessary.
This is why Microsoft, for years, has fought to strengthen our customers’ rights and has challenged unlawful secret surveillance. We’ve stood up for our customers not just in the halls of Congress, but in courts across the country and in daily negotiations with law enforcement. We routinely challenge NDOs and convince the government to modify secrecy orders to permit notice to our customers. When we can’t reach a reasonable agreement with the government, we don’t hesitate to go to court. Microsoft is currently seeking to modify or vacate several NDOs in courts across the country. While the details of these challenges remain under seal, this includes a now-public appeal brought by LinkedIn, a Microsoft subsidiary, that is scheduled for oral argument before the US Court of Appeals for the Fourth Circuit on September 15.
Our efforts over the years have led to policy changes at the Department of Justice, including guidance limiting the duration of NDOs after Microsoft filed a lawsuit against the US government in 2016 challenging indefinite NDOs as unconstitutional.
Sometimes, challenges to secrecy orders are unsealed, and we’re able to share additional details; most often, we simply provide our customers with notice, allowing them to take steps to further protect their rights. But these efforts, no matter how successful, have not stopped the flow of overbroad NDOs.
Challenges in court cannot do the work of Congress. We need the legislative reforms contained in the NDO Fairness Act. These would:
The NDO Fairness Act would not eliminate NDOs. Nor should it. Temporary secrecy is appropriate in some cases—particularly those involving child exploitation, terrorism or other violent crimes, nation-state cyberattacks, or cases where there is clear evidence that notice would jeopardize a sensitive investigation. Microsoft is a strong partner with law enforcement in its efforts to protect our nation and the most vulnerable members of society. But these reforms would ensure that NDOs are consistent with our most fundamental rights and freedoms.
Congress has made significant progress advancing these reforms. I want to thank Speaker Johnson and Majority Leader Scalise as well as Representatives Fitzgerald and Nadler for scheduling a vote and sponsoring this legislation. House Judiciary Committee Chairman Jordan and Ranking Member Raskin also deserve our appreciation for championing this legislation through the House committee process. As consideration moves to the Senate, we look forward to working with Senators Lee and Coons and supporting their leadership and efforts to enact this bill into law.
Microsoft has fought for the NDO Fairness Act because we stand up for our customers and will fight for their rights. I am thrilled to see bipartisan support for these reforms culminate in today’s House passage of this legislation. But the work is not yet finished. The Senate now has an opportunity to build on this momentum and help enact these critical reforms into law.
The post House passes historic reforms to rein in secret surveillance appeared first on Microsoft On the Issues.
Threat actors are no longer just using automation to execute tasks, they are leveraging prepackaged, safeguard-free AI, weaponizing stolen session data, and directly targeting defenders’ security stacks.
Table Of ContentsIn our latest webinar, Flashpoint Vice President of Intelligence, Ian Gray, briefed security leaders on the evolving threat environment, providing critical insights from the Flashpoint Global Threat Intelligence Report (GTIR): 2026 Midyear Edition.
The threat landscape has developed at a striking pace with Flashpoint tracking over 22 million illicit AI discussions, 7.4 million compromised hosts yielding 1.7 billion stolen credentials, and over 21,600 disclosed vulnerabilities in just six months. Beyond these staggering numbers, the on-demand session detailed something even more alarming: a fundamental shift in adversary operational tradecraft.
Here are the five critical shifts every cyber threat intelligence (CTI), Vulnerability Management, and SOC team needs to know.
The public discussion surrounding criminal artificial intelligence (AI) has reached a critical inflection point. Early in the AI boom, Flashpoint observed threat actors collaboratively experiment across underground forums, jailbreaking commercial frontier models or advertising surface-level tools like WormGPT and DarkGPT.
Today, adversaries are shifting from public forums to running fine-tuned, open-source models locally on private servers, which greatly hampers traditional signature-based detection. Flashpoint analysts are now seeing attackers generate unique, highly tailored malware variants, flawless phishing lures, and custom exploit scripts at extremely low costs—completely offline and shielded from public monitoring.
“A few months ago, a lot of this was collaborative… public outsourcing. Now what we’re seeing is scarier: pre-packaged cybercrime models run locally on private infrastructure. Malicious code, exploit scripts, and targeted phishing are all being generated inside closed environments.”
Ian Gray, VP of Intelligence, Flashpoint
Another eye-opening tactical insight shared during the session was how threat actors are repurposing defender infrastructure for automated initial access and extortion. In the webinar, we pointed to recent campaigns where adversaries specifically targeted misconfigurations and zero-day vulnerabilities inside open-source vulnerability scanners, secrets-detection tools, Kubernetes clusters, and Infrastructure-as-Code(IaC) environments.
What this means for defenders is that the attack surface is no longer bounded by traditional enterprise network boundaries: it extends directly into CI/CD pipelines, security orchestration tooling, and third-party SaaS integrations. Security teams are finding themselves in a race against attackers who use automated scanning scripts to weaponize vulnerabilities in the security tools themselves.
Flashpoint tracked 7.4 million hosts compromised by infostealers in H1 2026—a 27% increase period-over-period—harvesting 1.7 billion credentials and identity information.
While the top infostealer strains remain familiar, law enforcement operations have created vacuums that competitors rapidly fill.
Threat actors are leveraging drive-by downloads, watering holes, and pirated software packages to plant stealers. Once a machine is compromised, the logs capture corporate SSO credentials, active browser cookies, VPN keys, and SaaS session tokens. This enables adversaries to simply log in without having to leverage complex technical exploits.
The Common Vulnerabilities and Exposures (CVE) and National Vulnerability Database (NVD) have failed to keep pace with the velocity of AI-assisted vulnerability discovery. As such, vulnerability management teams are facing significant operational delays.
| Metric | Flashpoint GTIR Midyear H1 2026 Data | Operational Impact |
| Total Disclosures | 21,667 | Remediation volume exceeds defender bandwidth. |
| Exploit Availability | 19% (4,015 CVEs) | Functional code is ready before patches are deployed. |
| Public Catalog Lag | Growing Backlog (NVD/KEV) | Delay in official scoring leaves teams blind to active risk. |
Therefore, waiting for NVD enrichment before prioritizing a patch is a dangerous strategy. To compensate, security teams require Vulnerability Intelligence (VI) that provides primary-source confirmation of weaponization, exploit availability, and actionable mitigation guidance long before public databases update.
Ransomware-as-a-Service (RaaS) activity surged by 45% period-over-period, reaching 6,256 verified victim postings on data leak sites. However, total on-chain payout revenue dropped by 8% to $820 million, with victim pay-rates hitting a record low of 28%.
Faced with declining payouts and resilient enterprise backups, extortion syndicates are adapting. Rather than relying exclusively on technical file-encrypting malware, groups are executing pure data extortion campaigns—frequently targeting cloud platforms or extracting data through third-party vendor access.
Defending against machine-speed attacks requires moving beyond reactive, post-incident telemetry. Flashpoint arms security, CTI, and vulnerability management teams with the primary-source intelligence required to preempt adversary operations:
Request a demo, or watch the full on-demand webinar to explore the data shaping today’s risk landscape.
The post Cybercrime at Machine Speed: Key Takeaways from Flashpoint’s 2026 Midyear Threat Intelligence Briefing appeared first on Flashpoint.
In this post we examine how modern hacktivism has evolved into a tool of global hybrid warfare, analyzing crowdsourced attack tactics, media-driven propaganda, and real-world impacts across Ukraine, the Middle East, European Union, and NATO nations.
Table Of ContentsHacktivism used to be perceived as digital graffiti, with lone-wolf threat actors defacing government websites or temporarily crashing banking portals to make a political point. However, Flashpoint is tracking a fundamental shift in how these groups operate.
Modern hacktivism is evolving into a disciplined component of global hybrid warfare, capable of bridging digital disruptions with tangible real-world impact. Today, these operations blur the line between volunteer activism and coordinated state interest, leveraging crowdsourced infrastructure to disrupt critical utilities, manipulate media narratives, and target public infrastructure on a global scale. Unpacking these modern hacktivist collectives reveals what their tactics look like in practice and their far-reaching consequences across dozens of nations.
Hacktivism is the use of cyberattacks to promote or advance a particular political or social cause, leveraging a wide range of tactics such as website defacement, distributed denial-of-service (DDoS) attacks, and data breaches. Modern hacktivist collectives serve as the loud, high-visibility arm of cyber conflict—frequently aligning with state geopolitical interests, as seen most prominently in recent pro-Russian operations and Iranian-aligned cyber campaigns.
These pro-Russian hacktivist groups, such as NoName057 and Killnet, alongside pro-Iranian collectives and proxy ecosystems like Handala Hack, often react to the news cycle and target countries designated by state media or ideological narratives as enemies. As such, modern hacktivist campaigns are opportunistic and tied to global events—from the escalation in the Middle East following military operations like Operation Epic Fury, to the Milan-Cortina Winter Olympics and new aid packages to Ukraine. These groups’ justification narratives typically mirror state messaging.
In tracking modern hacktivist groups, Flashpoint analysts identified a new method these groups are utilizing to convert ordinary devices into tools for hybrid warfare—the gamification of cyberattacks. Flashpoint has observed groups like NoName057 turning DDoS attacks into community-based “patriotic online games,” such as their “DDoSia Project,” with participants earning military-style ranks and cryptocurrency rewards for overloading the websites of government institutions, banks, and various infrastructure across various countries.
This model has enabled the scaling of operations by utilizing a large, low-skilled participant base rather than having to rely on sophisticated technical tradecraft. The model’s decentralized structure and ideological appeal continue to pose a significant challenge for international law enforcement.
Beyond technical disruptions, publicity is the primary currency of modern hacktivism. Hacktivist groups demonstrate a consistent pattern of media-seeking behavior and self-promotion, likely intended to amplify their perceived impact and reinforce notoriety within the broader cyber threat landscape. Many of these groups repeatedly repost media coverage and news articles referencing themselves.
This serves as a curated self-promotion mechanism, allowing the group to selectively showcase external validation of its operations, including coverage from mainstream and security-focused outlets, to its followers. This behavior aligns with a broader trend observed with especially pro-Russian hacktivist collectives, in which media visibility is treated as a measure of operational success independent of verified technical impact. It also serves as a deliberate tactic for engagement and recruitment that reinforces “patriotic” branding and sustains participant morale and visibility.
In some cases, the digital targeting of hacktivist collectives is more aligned with kinetic objectives, rather than public perception or propaganda initiatives. This is especially true for Iranian-aligned hacktivists and proxy groups who are more deeply intertwined with military operations in the Middle East. These groups have expanded their operations from website disruptions into claims of large-scale data wipers, extortion, and cyberattacks targeting key infrastructure across the Gulf.
Major geopolitical flashpoints in the Middle East have triggered waves of hacktivist activity that has spread across North America, with threat actors targeting supply chains, financial infrastructure, and operational technology and control systems.
Simultaneously, pro-Russian hacktivist groups, particularly NoName057, have been extremely prolific within the last year—carrying out two major illicit campaigns heavily targeting Ukraine, which then spilled over to more than 30 nations globally. The following breakdown contains statistics and targeting dynamics of pro-Russian hacktivist groups observed between July 2025 and 2026:
Ukraine has been the primary target for pro-Russian hacktivist groups who seek to damage Ukrainian infrastructure and morale. Anti-Ukrainian content is constantly distributed through dedicated per-language channels, making it the most linguistically developed target spanning six languages. Involved channels each post near-identical translated content within minutes to hours of the Russian original, down to the same image file with identical SHA1 hashes, which suggests a sustained propaganda distribution operation.
This has resulted in alleged data breaches impacting Ukrainian General Staff, military enlistment offices, medical, and morgue databases to push a casualty-count narrative. It also has resulted in the defacement or disruption of websites of regional capitals and administrative centers, energy plants, water and power-adjacent infrastructure, and many more.
However, Ukraine is not the sole casualty of modern hacktivism. Recent pro-Russian hacktivist campaigns have spread to other EU nations and NATO members. Germany, the United Kingdom, and Spain have been observed to be priority targets, with threat actors targeting public transportation, federal and security agencies, municipal government and utilities, financial markets, and other infrastructure. In some cases, hacktivist campaigns manifest in the real-world, with physical sticker drives on municipal streets, alongside doxxing operations releasing alleged personal data and automated scans hijacking exposed CCTV camera systems across Europe.
As hacktivist operations continue to blur the boundary between digital disruption and real-world interference, organizations can no longer view DDoS attacks or low-level intrusions as simple background noise. Protecting critical assets requires proactive visibility into threat actor networks, early detection of targeting narratives, and primary source threat intelligence.
Request a demo today to see how Flashpoint provides actionable intelligence to help security teams, government agencies, and infrastructure providers identify, monitor, and mitigate emerging hacktivist campaigns before they impact operations.
The post The Evolution of Hacktivism in Hybrid Warfare: Modern Tactics and Real-World Impact appeared first on Flashpoint.
Flashpoint’s monthly analysis of insider threat recruitment, illicit access advertising, and threat actor activity targeting enterprise environments.
Table Of ContentsUnknowingly, a member of key personnel is living two separate lives. On the clock, they are a highly-trusted systems administrator, but in their personal time, they moonlight on the deep and dark web, advertising their trust and access to the highest bidder. One day, they get a simple offer: $15,000 in the crypto of their choice to approve a single push notification at 2 AM. They accept. By morning, the attacker walks away with active domain admin credentials without the need for malware or cracking firewalls.
This is just one example of how insider threats lead to modern enterprise breaches. This year, Flashpoint uncovered 7,282 unique insider threat posts, with an average of 34 unique posts being posted daily. As perimeter security, EDR coverage, and other security tools mature, threat actors are finding it faster—and cheaper—to target the human element and simply buy an insider’s credentials or pay an employee to open the front door.
In a threat landscape where identity is becoming the primary attack surface, monitoring illicit marketplaces and recruitment efforts is critical. This new monthly report leverages Flashpoint’s Primary Source Collection (PSC) to analyze insider threat tactics, tracking active recruitment and advertising on dark web forums and encrypted networks.
In July 2026, Flashpoint analysts identified a total of 12,653 insider posts. These communications include both threat actors attempting to recruit insiders in target organizations, as well as insiders advertising their services on illicit forums and marketplaces.
Of these total communications, Flashpoint observed 1,132 unique posts in July 2026.
Historically, the Telecommunications, Retail, and Financial industries are most adversely affected by insider threat activity. However, July 2026 findings noticeably deviate from this trend. Flashpoint found 58.6% of total insider threat posts affected “Other” industries—suggesting adversaries are diversifying their target base. Threat actors may be attempting to recruit within supply chain partners, logistic hubs, manufacturing platforms, and specialized service providers to find alternative entry points into target networks.
The following table shows a breakdown of unique insider posts by industry in July 2026:
| Industry | Posts |
| Other | 663 |
| Financial | 150 |
| Retail | 112 |
| Technology | 84 |
| Telecom | 74 |
| Public Sector | 43 |
| Healthcare | 3 |
| Media | 3 |
| Total | 1,132 |
Active insider threats work in two ways: an insider is “recruited” by a malicious outside party, or a malicious insider “advertises” their access and skills to an interested threat actor. Regardless, by leveraging this connection, insiders assist adversaries by exfiltrating valuable data, installing malware, sabotaging IT systems, or performing SIM swaps.
In July 2026, Flashpoint found that over 75% of unique threat actor posts came from insiders advertising their access to malicious third parties. This indicates a highly motivated internal threat landscape where disgruntled employees actively seek out buyers for corporate data and network entry points.
Insider threats are inherently difficult to detect using internal security controls alone because the malicious activity relies on valid credentials and legitimate access privileges. Relying solely on internal logs means security teams often only detect an insider threat after data exfiltration or system sabotage has already occurred.
Flashpoint protects organizations against insider threats through our Primary Source Collection (PSC) and specialized intelligence platforms:
To learn more about how Flashpoint can help protect your enterprise from insider risk and monitor illicit underground communities, Request a Demo Today.
What is the Flashpoint Insider Threat Report?
The Flashpoint Insider Threat Report is a monthly intelligence brief that analyzes trends, volume, targeted industries, and tactics surrounding insider threat recruitment and illicit access advertising on the deep web, dark web, and encrypted chat channels.
How does Flashpoint collect insider threat data?
Flashpoint collects data using its Primary Source Collection (PSC) engine, which actively monitors thousands of dark web forums, illicit marketplaces, and underground chat networks where threat actors and malicious insiders communicate.
What is the difference between insider recruitment and insider advertising?
Insider recruitment occurs when an external cybercriminal attempts to entice a corporate employee into assisting with a cyberattack. Insider advertising occurs when an employee or contractor proactively lists their legitimate access or services for sale on illicit marketplaces.
The post Insider Threat Report: Dark Web Recruitment & Access Trends appeared first on Flashpoint.
Login