[ctx]ctxseccontext security: attacks on the harness and context layer of AI agents, plus exploited-now news, hunting and playbooks.

← Threat Hunting · markdown

official (Microsoft Threat Intelligence, Nov 5)

Hunt: Microsoft's Q3 email threats: 7.3 billion phishing detections, CAPTCHA-gated phishing back via SVG attachments, and spoofed mail delivered because of allow-list exceptions

  • Audit transport rules, allow lists and spoof-intelligence overrides that let mail failing SPF/DKIM/DMARC through; scope any you need to specific senders and IPs.
  • Hunt for inbound .svg attachments and links to pages that show a CAPTCHA before a sign-in form.
  • Restrict external Teams chat to allowed domains and warn users that 'IT support' may arrive under an ordinary name.
  • Microsoft's post has Defender hunting queries you can run as-is.

Sources: Microsoft Security Blog: Email threat landscape: Q3 2026 trends and insights (Nov 5)