Multifactor authentication (MFA) manipulation in compromised tenants can be hard to detect, as some changes can be dismissed as part of standard helpdesk processes. Microsoft shares guidance for hunting for MFA anomalies using Kusto Query Language (KQL): msft.it/6016YUu1I

The macOS cryptocurrency wallet stealer malware known as Activator, which we first observed in December 2023, remains a very active threat. Microsoft data shows a surge in network activity associated with the Activator in March 2024 and has remained elevated.