MICROSOFT CORP

Form 8-K Item 1.05 filed 2024-01-19

Form 8-K/A amendment

press report (acknowledged): Microsoft has confirmed that its official X account was taken over on Thursday

press report (press_reported): The activity, which has been detected since May 2026

press report (press_reported): indicators of compromise (IoCs) associated with the May 2026 Daemon Tools supply chain attack

press report (press_reported): The researchers tracked the campaign between July 14 and September 22, 2026

press report (press_reported): The Microsoft 365 brute-force campaign is said to have unfolded across three different waves from late July to August 2026

press report (press_reported): The campaign compromised 7 accounts

press report (press_reported): sending over a million scam emails between August 3 and 5, 2026

press report (press_reported): The Microsoft 365 brute-force campaign is said to have unfolded across three different waves from late July to August 2026

press report (press_reported): the Metropolitan Police Service arrested two men, aged 32 and 38, on September 11, 2026, in connection with the illicit commercial operation

press report (press_reported): On September 11, 2026, officers from the Metropolitan Police Service’s cybercrime team arrested two men, aged 32 and 38, on suspicion of offenses connected with the alleged operation of EvilTokens.

press report (acknowledged): Microsoft on Tuesday announced the takedown of the EvilTokens device code phishing service

press report (press_reported): The researchers tracked the campaign between July 14 and September 22, 2026

press report (acknowledged): Microsoft notified affected customers, helped them remediate compromised accounts and shared intelligence to support further investigation.

press report (press_reported): Huntress said the same IP address engaged in password spraying against four law firm tenants on October 13 and 14, 2026

press report (press_reported): It was used to obtain Microsoft Graph tokens in customer tenants from 144.172.64[.]128 on October 15, between 06:13 and 08:34 UTC.

press report (press_reported): ConnectWise first identified suspicious activity in its network on October 15

press report (press_reported): discovering unauthorized access to application identities within its Cloud Backup environment on October 17

press report (acknowledged): In an update published on October 21, ConnectWise acknowledged Microsoft’s findings and the extensive use of AI to compromise its Microsoft365 tenants.

Ransomware leak-site claim (ransomware_live)

press report (press_reported): Microsoft has disclosed details of two campaigns in which threat actors are abusing third-party email delivery infrastructure to blast financial fraud scam messages and using passkey-themed social engineering to breach cloud environments.