Follow the latest coverage, related explainers and connected technology stories.
Microsoft detected a campaign involving more than one million emails impersonating CEOs and ServiceNow to persuade accounts payable teams to transfer approximately $50,000 via ACH. The company says the campaign used third-party sending infrastructure and content showing indicators of development with AI assistance, with no evidence that the impersonated organizations were compromised.
Microsoft Threat Intelligence reviews the DeadLock ransomware, which first appeared in July 2025 and uses the Session network and Polygon blockchain-supported services to manage communication with victims and data leaks. By July 2026, data from more than 80 organizations had been published on the leak site, with more than half of the disclosed victims concentrated in Europe.