Microsoft Defender

A cybersecurity blog has published a detailed breakdown of a modern phishing campaign abusing Microsoft OneDrive, walking through how attackers craft convincing file-sharing lures and what investigators can do to trace them. The write-up is aimed at digital forensics and OSINT practitioners, touching on the psychology behind cybercrime and the growing role of AI tools in both attacks and investigations.

Microsoft says defending against AI-fueled cyberattacks requires organizations to prioritize identity management and data governance. As attackers use AI to automate and scale intrusions, the company argues that controlling access to systems and properly governing data are now central to security, shifting focus from traditional perimeter defenses toward identity-first protection strategies.

A reported comparison of three leading endpoint security vendors highlights a claimed $1 million cost gap in enterprise EDR deals heading into 2026. CrowdStrike, Microsoft Defender and SentinelOne are the benchmarks most enterprises weigh when choosing endpoint detection, and the price differences between them are said to be substantial. The discussion centres on whether premium pricing buys proportionally better protection.

Security outlets report the Antino backdoor uses Microsoft Outlook and OneDrive for command-and-control in a China-linked espionage campaign, letting attackers blend traffic with legitimate cloud services. The same digest rounds up eight updates from five sources, including GitLab patch releases, as defenders track the evolving threat.

Attackers are reportedly using Microsoft Defender's exclusion settings to conceal malware from antivirus scanning, according to a report by Spanish security blog elhacker.NET. By adding malicious files or folders to Defender's exclusion list, malware can run undetected on Windows systems. The technique highlights ongoing concerns that trusted security tools themselves can be manipulated by attackers to bypass endpoint protection.