// UNCLASSIFIED // CLEARED FOR PUBLIC RELEASE //
FILE BRC-wedgDTG 0600Z
ColdRecon / Breach Radar / Microsoft
Breach Record

Microsoft

DISCLOSED 2026-07-02 · STOLEN CREDS

In a real-world incident, attackers disabled Windows Defender, Sysmon, and a web application firewall on a compromised IIS server before using Mimikatz to dump credentials. The attack highlights how adversaries systematically neutralize endpoint defenses to enable credential theft.

The record

What we know

Disclosed
2026-07-02
Attack vector
Stolen Creds
Sources

Cited reporting

↗ cybersecuritynews.com (2026-07-02)
Similar vector · recent

Other stolen creds breaches on file

Amgen Inc. · 2026-08-04 SplitVPN · 2026-07-21 Fluke · 2026-07-01 Workday · 2026-06-25 Houston City College · 2026-06-16 Sysco · 2026-06-15 Glendale Community College · 2026-06-15 June 2026 Stealer Logs · 2026-06-15

This page is the permanent ColdRecon entry for the Microsoft disclosure. It updates if new public reporting emerges. All tracked breaches →

Microsoft just lived through this. Your next prospect doesn't have to.

ColdRecon turns every disclosed breach into a daily intelligence brief from the seller's seat — normalized to the factors that move a deal, written in the Handler's voice. Request clearance and the first lands tomorrow at 0600.

Request Clearance →