microsoft.com Domain Breach Exposure Report

The telemetry indicates a significant exposure event impacting microsoft.com, with over 25 million client records compromised in data breaches and over 600,000 infostealer logs detected. The majority of the exposure, 97.6%, stems from historical data breaches, while 2.4% is attributed to active infostealer activity. The timeline shows a surge in client compromises during November 2025, alongside a notable increase in employee compromises in January 2026. Key malware families involved include Redline, LummaC2, and Rhadamanthys, suggesting a focus on credential harvesting. The high volume of compromised client data and the presence of active infostealer logs elevate the risk to critical levels. The primary remediation focus should be on identifying and securing the compromised client accounts, investigating the root cause of the historical data breaches, and enhancing defenses against the identified infostealer malware. Given the nature of the domain and the services targeted, such as Microsoft 365 sign-up and developer profiles, the primary affected sector is Technology & SaaS.