Microsoft Threat Intelligence Podcast Unpacking the Latest Threats Targeting the Financial Services Industry
Feb 11, 2026
Anna Seitz, a Microsoft researcher tracking financial‑services threats, and Megan Stalling, a researcher focused on intrusion tradecraft, unpack actor tactics. They describe Storm‑0727’s use of maldocs, credential theft and living‑off‑the‑land scripts. The conversation covers BEC, ransomware with data extortion, phishing‑as‑a‑service, social engineering, and why simple techniques remain effective.
AI Snips
Chapters
Transcript
Episode notes
Low-Noise Attacks Win Big
- Storm-0727 uses ordinary-looking financial lures and macro-enabled documents to gain quiet footholds.
- They rely on simple, low-noise techniques like VBScript and browser credential theft to maintain persistence.
Credential Theft For Stealthy Persistence
- After macros run, Storm-0727 stays quiet and uses VBScript to steal browser credentials.
- This lets them blend with normal admin activity and avoid noisy detections.
Odd Domain Choices Reveal Actor Habits
- Storm-0727 consistently registers domains with Namecheap using TLDs like .site, .store, and .lol.
- The chosen names often look unrelated or random, making attribution and intent guesses harder.