Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Researchers at Microsoft are tracking a social engineering campaign that uses passkey-themed lures to trick users into granting persistent access to their accounts and online work environments.

Threat actors are using phishing emails with blank SMTP sender fields to bypass Microsoft 365 security filters, according to researchers at ReliaQuest. Microsoft 365 Exchange Online uses a feature called “RejectDirectSend” to block unauthenticated Direct Send emails from an organization’s trusted domain. If an attacker omits the domain field from these emails, however, RejectDirectSend will no longer block the messages.

A natural-language decision can now trigger a real API call, query sensitive data, deploy code, or modify infrastructure. MCP expands the security boundary beyond the connection to the identities, privileges, tools, credentials, and downstream systems behind each action. That challenge is growing with adoption. Anthropic reported more than 10,000 active public MCP servers by December 2025, alongside 97M+ monthly downloads of its Python and TypeScript MCP SDKs.

I know, I know. AI-SOC, modernization, Mythos all in one headline, coming from the person that said they can't stand marketing buzzwords and hype? Hear me out. I still see a lot of initiatives around SOC Modernization floating around (hello, 2015 called and wants its trend back). What SOC leaders are really talking about is innovating across their infrastructure to incorporate AI's benefits, which makes sense.

Every security team knows the feeling. The quarterly vulnerability scan completes. The report lands, with thousands of findings, color-coded by CVSS severity, neatly timestamped. And the moment it’s printed, it’s already out of date. That is the fundamental flaw at the heart of traditional exposure management: it is built around a point in time.

JUMPSEC’s DART (Detection & Response Team) raised an alert to the Threat Research team regarding a specific ticket that arrived in a clients’ inbox, passing SPF, DKIM, and DMARC. The email contained an attachment and a subject which spoke about Tax Audits, that attachment, named “Tax_Notice_45594.exe” is not actually an exe but instead an.ISO. On the surface this looks like a fairly typical phishing lure, but the delivery mechanism underneath is anything but.

Anthropic CEO Dario Amodei published an essay this month called “We Must Pace the Frontier.” His argument is straightforward, calling out the reality that AI capabilities are advancing faster than the industry’s ability to align and safeguard them, and frontier labs need to slow the rate of capability growth long enough for safety work, alignment, and interpretability to catch up. He points to two developments behind his concern.

Arctic Wolf has launched Aurora MDR Connect, a new tier of Aurora Managed Detection and Response (MDR) built exclusively for managed service providers (MSPs).

Guest post by Neil Holme, Founder and CEO of Impact Business Technology, a WatchGuard partner. The cloud environments MSPs manage change every week. Clients adopt new SaaS applications, AI tools, and collaboration services, making it difficult to track what is in use, how it is configured, and which access permissions remain active. Exposure grows without a clear warning sign until an incident occurs. The cloud is also the fastest-growing attack surface an MSP manages.

Your vulnerability report is sorted by severity. The adversary looking at the same environment is sorted by path. That mismatch is the whole problem. Open any scanner output, and you get a tidy hierarchy: criticals at the top, then highs, then a long tail of mediums and lows that most teams will never touch. To the person who wrote the ticket, that tail is noise. To someone who thinks in chains, it’s a roadmap. A page of “lows” is not a page of things you can ignore.