Microsoft has tracked passkey- and SSO-themed help desk impersonation since May 2026, with the calls steering employees into adversary-in-the-middle proxies and device-code grants that hand over live Microsoft 365 sessions.
Perspective Coverage
3 publishers
- Builder
- Builder 25%
- Operator
- Operator 63%
- Investor
- Investor 12%
Reality
- Evidence72
- Adoption
- Not scored
- Hype gap+10
- Incentives35
- Confidence70
Tanium sells a self-driving SOC with Atlas tools for autonomous detection, hunting and response
Tanium shipped detection, response and hunting tools on its Atlas agent platform that query endpoints live, instead of SIEM logs it says can be hours old. Teams rolling them out have to decide which actions, such as quarantining a host, an agent may take without a person signing off.
Reality
- Evidence30
- Adoption
- Not scored
- Hype gap+40
- Incentives70
- Confidence35
Gen Digital found the chain while working a live UNC3569 intrusion. Tencent's April 2026 fix closed the link handler and left the bundled Chromium 80 in place, with its sandbox still switched off in the code.
Perspective Coverage
3 publishers
- Builder
- Builder 40%
- Operator
- Operator 50%
- Investor
- Investor 10%
Reality
- Evidence68
- Adoption72
- Hype gap+20
- Incentives40
- Confidence70
Chainalysis puts state hackers behind two of every three blockchain dead drops
Chainalysis says writes of malware instructions to public blockchains have climbed from about 2.06 a day to 11.1 since July 2025, with groups tied to North Korea and Iran behind most of the increase. Its research lead could not confirm AI models helped.
Reality
- Evidence42
- Adoption48
- Hype gap+30
- Incentives68
- Confidence40
Group-IB says it found Tortoiseshell infrastructure on British IPs, plus Belgium, Saudi Arabia and the UAE. It also says the server names alone do not prove who was being targeted.
Perspective Coverage
3 publishers
- Builder
- Builder 38%
- Operator
- Operator 50%
- Investor
- Investor 12%
Reality
- Evidence64
- Adoption42
- Hype gap+16
- Incentives66
- Confidence61
Your code review runs on human time. The intruder's agent does not.
Anthropic says an AI agent did 80% to 90% of the work in a campaign against roughly 30 companies. CrowdStrike puts average breakout time at 29 minutes. Verification cadence is now the control.
Reality
- Evidence34
- Adoption48
- Hype gap+30
- Incentives68
- Confidence38