Microsoft made WSL Containers generally available with a wslc.exe CLI, an app-facing API, and Intune settings to disable it or allow-list registries. Through that API any native Windows app can start a Linux container, so policy has to cover software launches as well as developers at a prompt.
Perspective Coverage
3 publishers
- Builder
- Builder 53%
- Operator
- Operator 42%
- Investor
- Investor 5%
Reality
- Evidence64
- Adoption
- Not scored
- Hype gap+12
- Incentives58
- Confidence70
Microsoft says phishing emails seen in July 2026 deliver a signed MSP360 remote-management installer that then installs ConnectWise ScreenConnect. The chain uses no exploit, only a user's click and features the two admin tools ship with.
Perspective Coverage
3 publishers
- Builder
- Builder 18%
- Operator
- Operator 77%
- Investor
- Investor 5%
Reality
- Evidence70
- Adoption
- Not scored
- Hype gap+5
- Incentives35
- Confidence72
Microsoft says China-linked operators have used NeedyMantis since at least October 2025 to keep access to telecom, university and government-linked networks. It goes in after the break-in, so defenders have to hunt for it inside networks already breached.
Perspective Coverage
3 publishers
- Builder
- Builder 22%
- Operator
- Operator 67%
- Investor
- Investor 11%
Reality
- Evidence62
- Adoption
- Not scored
- Hype gap+18
- Incentives40
- Confidence60
buildOne report1 publisher Defender's new agent detections start at the Microsoft 365 app connector
Microsoft's public preview flags jailbreaks, prompt injection and credential leakage from agent telemetry, and agents built outside Copilot Studio, Foundry and Agent Builder need the Agent 365 SDK first.
Publishers:learn.microsoft.com
Reality
- Evidence52
- Adoption12
- Hype gap+15
- Incentives78
- Confidence58
ClickFix crews are staging the second stage inside Binance Smart Chain smart contracts
Blackpoint's SOC worked an incident where a fake captcha on the victim company's own WordPress site ran a hidden PowerShell downloader, and the campaign's later stage sits in a blockchain contract no provider can pull.
Publishers:blackpointcyber.com
Reality
- Evidence60
- Adoption30
- Hype gap+15
- Incentives65
- Confidence55
Fake helpdesk calls use the passkey rollout as the pretext for Microsoft 365 intrusions
Microsoft has tracked intrusions since May in which callers posing as IT told employees a passkey update was due, then steered them to a phishing page or a device-code prompt. The enrollment step is where the chain starts.
Reality
- Evidence55
- Adoption35
- Hype gap−5
- Incentives60
- Confidence58
Microsoft traces four months of Graph-based mail theft to fake passkey helpdesk calls
Since May, intruders posing as IT have walked employees through a passkey update on their personal phones, then registered their own authentication method and pulled mail and files through Graph, SharePoint and Exchange APIs.
Reality
- Evidence62
- Adoption32
- Hype gap+12
- Incentives65
- Confidence58