Content by Microsoft Security Research (3)

Microsoft Security Research analyzes a malicious Claude Code-branded extension distributed through Cursor’s marketplace, detailing its attempted SSH backdoor and cross-platform persistence. The article provides Microsoft Defender detections, hunting queries, and remediation steps, explaining why removing the extension alone does not eliminate unauthorized keys and startup artifacts.

Microsoft Security Research explains why post-quantum readiness needs to cover authentication as well as encryption, and why organizations should start testing their certificate ecosystems now. The article outlines common PKI dependencies, operational risks from larger certificates and chains, and how Microsoft’s PQC TLS Pilot Program supports controlled interoperability testing.

Microsoft Security Research breaks down a large-scale business email compromise campaign that used AI-assisted executive impersonation and fake invoices to push finance teams into fraudulent ACH payments, and maps practical mitigations using Microsoft Defender for Office 365, Defender XDR, and Security Copilot.