August 3 – August 10, 2026

What changed

Microsoft Threat Intelligence published analysis of ChainDrop, a large-scale npm supply chain compromise affecting more than 400 packages across multiple unrelated publishers, including packages tied to major enterprise ecosystems such as keyv, flat-cache and cache-manager. The malicious releases carry a Mini Shai-Hulud variant: a heavily obfuscated Bun-based JavaScript payload that runs from an npm preinstall lifecycle hook, so it executes on developer workstations and build runners before installation completes and before any test or scanning step. It harvests npm, GitHub, cloud, Kubernetes and HashiCorp Vault credentials from files, environment variables, shell history and GitHub Actions runner memory, then uses those identities to call the services' APIs and pull further secrets. Exfiltration is AES-256-GCM encrypted to an attacker HTTPS endpoint whose active domain is resolved through an on-chain contract, with a public GitHub repository as fallback. The propagation routine is what makes this a worm: with a stolen publishing token it downloads a publisher's latest tarballs, injects itself, bumps the patch version and republishes, and where a workflow is configured as an npm trusted publisher it republishes through GitHub Actions OIDC so the release carries valid provenance. It also writes setup files into .claude and .vscode configuration paths across repository branches, creating a developer-to-developer reinfection path that survives host cleanup. Treat any workstation or build runner that installed an affected version with lifecycle scripts enabled as compromised: rotate every credential reachable by that identity from a known-clean host, audit for unauthorized npm releases and unexpected workflow changes, purge npm and yarn caches including shared CI caches and golden runner images, and rebuild downstream artifacts from a trusted baseline. Defender for Endpoint, Defender Antivirus and Defender for Cloud all have named detections for the loader, the Bun runtime abuse and the credential access stage. (Microsoft Security Blog)

A second Microsoft Threat Intelligence report tracks a macOS ClickFix operation delivering MacSync and Atomic Stealer through more than 250 confirmed front-end domains, and documents a tradecraft shift that matters for anyone relying on scanning or sandboxing. The same infrastructure that used to serve the paste-to-Terminal lure directly in page HTML now returns a roughly 2.5 KB JavaScript profiling routine instead, collecting navigator, screen, window, document, location and console attributes and submitting them server-side. Only requests that look like a genuine, non-virtualized macOS browser get the fake Download for macOS page with the obfuscated curl one-liner; simple crawlers see a parked page and JS-capable sandboxes that fail the checks get a decoy such as a fake VPN extension or an unrelated business site. The practical consequence is that a benign-looking response from one of these domains is not evidence the domain is safe, because the decision is made per request. Domains cluster around a dictionary-word generator using a file token, giving names like filecopperbasket and fileoceanhammer, which is a useful hunting pivot but not a signature. Microsoft's guidance is to alert on Terminal or shell sessions spawning curl, base64, gunzip or osascript shortly after browsing, block the shared back-end and staging hosts rather than the disposable front ends, and note that macOS 26.4 and later warns users when they paste a potentially malicious command into Terminal. (Microsoft Security Blog)

Microsoft Sentinel brought UEBA anomaly intelligence directly into the Behaviors layer in preview, so each behavior record now carries anomaly insights and explainability alongside the sequenced events rather than requiring the analyst to correlate the two by hand. The insights cover first-seen activity, unusually high behavior volumes, uncommon values and threat intelligence matches. The same release widens what UEBA can see: the Behaviors layer now supports Fortinet FortiGate events from the CommonSecurityLog table with more than 40 new behaviors covering administrative activity such as rapid reconfiguration, configuration backups, certificate changes and security service disruption, mapped to techniques including T1685, T1070, T1078 and T1602.002. Classical UEBA anomaly detection adds Check Point, Fortinet and Zscaler firewall, VPN and web proxy events, with ten new anomaly rules for anomalous and failed VPN sign-ins, first-time access to high-risk web categories, bursts of detections on a single device and suspicious administrative changes, plus identity-linked AWS GuardDuty findings from the AWSGuardDuty table. Events are enriched with source IP geolocation, ISP and threat intelligence context. This is the first time the behavioral layer reaches past identity telemetry into network and cloud sources, which is where a compromised firewall admin account has historically been invisible to UEBA. (Microsoft Sentinel Blog)

The AI-powered playbook generator is now available to all Microsoft Sentinel customers working in the Defender portal, and Security Copilot enablement is no longer a prerequisite. That was the friction point: the feature reached general availability on 31 May but required Security Copilot wallet provisioning to get started, which kept it out of reach for teams that had not onboarded Security Copilot even though the generator never consumed SCUs. It sits under Automation, Create, Playbook Generator, takes a natural-language description of the response you want, and returns an editable code-based playbook with tests, documentation and a visual flow diagram. Building or deploying generated playbooks needs the Automation Playbooks unified RBAC permission with read and write access. There is no additional charge beyond Sentinel. (Microsoft Sentinel Blog)

Sentinel's Codeless Connector Framework gained nested API support in public preview, which closes a long-standing gap for list-then-detail APIs. Many vendor log APIs return a list of alert IDs or case references from one call and require a follow-up call per record to get the full detail, a pattern CCF could not express, so partners either restructured their endpoints or customers wrote middleware. Nested API support lets a single polling cycle chain those dependent calls and ingest complete records. The pattern is also available through the Sentinel connector VS Code extension for anyone building their own connector. Early adopters shipping on it include BigID, Cisco Email Threat Defense and Idira Audit, alongside Microsoft-built connectors for CrowdStrike Falcon Endpoint Protection, InsightVM CloudAPI and Salesforce Service Cloud. If you have a homegrown Logic App or Function wrapper doing exactly this chaining today, it is now a candidate for retirement. (Microsoft Sentinel Blog)

Microsoft Defender Experts MDR P2 reached general availability, extending the managed detection and response service beyond Microsoft's own products into third-party and multicloud sources ingested into Sentinel. Supported non-Microsoft sources at launch span cloud with AWS, identity with Okta, email with Proofpoint, network with Palo Alto Networks, Cisco, Fortinet and Zscaler, and endpoint with CrowdStrike. For heterogeneous estates this changes the calculus on Defender Experts, which until now meant handing over only the Microsoft half of the picture while the SOC kept triaging everything else. Microsoft says coverage of further non-Microsoft products will continue to expand. (Microsoft Defender XDR Blog)

On-demand malware scanning in Microsoft Defender for Storage added targeted scanning in public preview on 6 August. Rather than scanning an entire storage account, you can now scope a scan to a single blob or file, a specific container or file share, or everything matching a path prefix, using filters in the REST API request body. Omitting filters keeps the existing whole-account behaviour. This is the difference between a scan you can run during an incident against the exact prefix an attacker touched and one you schedule overnight and hope finishes, and it also takes the cost sting out of re-scanning after a suspected upload. (Microsoft Defender for Cloud release notes)

Azure Firewall explicit proxy went generally available on 5 August. Explicit proxy lets applications and browsers send HTTP and HTTPS traffic to Azure Firewall through proxy settings instead of relying on route-based steering, which gives more precise control over outbound web traffic and removes a class of asymmetric-routing problems. The GA release adds serving both HTTP and HTTPS destinations through a single proxy endpoint, managed identity based PAC file retrieval, and a reworked portal configuration experience. Microsoft calls out Azure Arc onboarding in hybrid environments as a headline use case, with Azure Firewall acting as forward proxy for Arc-enabled servers so they reach the required Microsoft endpoints while outbound access stays centrally controlled. (Azure updates)

Network security perimeter picked up a perimeter link feature in public preview on 4 August, allowing trusted resources sitting in two different network security perimeters to communicate using managed identity without opening additional perimeter access rules or changing network configuration. The point is that cross-perimeter service-to-service access no longer has to be bought with a hole in the boundary, which is the usual compromise when a workload in one perimeter legitimately needs to call a PaaS resource governed by another. (Azure updates)

Defender Vulnerability Management added vulnerability assessment for Microsoft Store applications in preview. Store-delivered apps have been a persistent blind spot in software inventory because they do not install or version like conventional Win32 software, and the covered list is exactly the set that shows up on real endpoints: Microsoft Teams, Mozilla Firefox, WhatsApp, Slack, Dropbox, DuckDuckGo, Dell Command, HP Smart, HP Support Assistant, Dell SupportAssist for Home PCs and NVIDIA Control Panel among others. The software evidence area on the software page shows the file path for the vulnerable application plus a suggested query returning the app, version and file location, so a finding turns into a remediation target without manual hunting. (Microsoft Defender for Endpoint what's new)

KQL to try

Audits write and delete operations against Log Analytics workspace tables, covering the tamper path that removes the evidence rather than the alert. (Azure Log Analytic Table Operation Audit — Jay Kerai)

//For auditing Write/Delete actions upon LAW Tables
AzureActivity
| where TimeGenerated > ago(90d)
| where OperationNameValue contains "MICROSOFT.OPERATIONALINSIGHTS/WORKSPACES/TABLES/"
| extend TableName = Properties_d.resource
| project-reorder TimeGenerated, TableName, Caller

Worth knowing

Microsoft expanded its Zero Trust for AI programme with two things a security team can actually run. The Zero Trust Assessment, which evaluates tenant configuration and activity signals and turns them into prioritised recommendations, now carries new pillars for AI, Security Operations and Infrastructure alongside the existing Identity, Devices, Network and Data pillars. The Zero Trust Workshop gains a DevSecOps pillar with 15 control groups and 91 tasks covering developer platforms, CI/CD pipelines, source repositories, dependencies, artifacts and infrastructure-as-code, plus four tasks aimed squarely at AI-assisted development: code governance, tool allowlisting, data protection, and pipeline supply-chain security. Given what ChainDrop did to build pipelines this week, that pillar is better timed than Microsoft could have planned. (Microsoft Security Blog)

The Defender monthly news post for August recaps July's shipping across the portfolio and is worth a skim for anything you missed at the time. Two items stand out for operational impact: Defender for Endpoint AI agent runtime protection no longer requires Beta channel configuration and now inspects Codex CLI and the GitHub Copilot app natively, with network inspection covering Node.js-based agents that expose no vendor event interface; and new Defender for Office 365 Plan 2 organizations now default to the unified RBAC permission model, so tenants provisioned from July onward will not match the Exchange-role assumptions baked into older runbooks. (Microsoft Defender XDR Blog)