Black Hat 2026 Keynote Report — Cyber Defense Magazine By Dr. Arun Lakhotia
Black Hat 2026: The Supply-Chain Trust Series — Cyber Defense Magazine. Part of a series; start with the series introduction, or jump to the closing synthesis.
Speakers: Aarti Borkar, Corporate Vice President, Microsoft Security; and Tanmay Ganacharya, Vice President, Microsoft Security
Note: This is a report on a recorded keynote, not an interview. Quotations are drawn from the recording of the session.
Of everything I saw at Black Hat, the Microsoft keynote gave the clearest articulation of why software supply-chain attacks are a different animal from ordinary vulnerabilities. The framing was there in the opening line: attackers are “targeting something that’s trusted and then using that trust to reach victims down the stream.”
The economics have flipped
The VPs’ first argument was economic. In a traditional intrusion, an actor pays a cost for every victim. In a supply-chain attack, “they’re able to do it with one trusted entity,” and the ecosystem multiplies it: “a single package impacts hundreds of development organizations… a single dependency will get into tons of applications.” The result is that “most organizations that were never targeted end up impacted, and the actor may not even have had interest in them.”
That is precisely the distinction between a bug and a betrayal of trust — and it was reinforced by how the incident-response lead described the phone calls her team receives. Almost no one calls to say “we found a package.” They call to say “we installed something malicious, and we don’t know how far it’s headed.” Finding the package “is just another Tuesday”; the real work “starts after” that. Recovery can range “from a couple of days… to six to eight weeks,” and the difference, she stressed repeatedly, “is preparation.”
Three case studies, three techniques
The team deliberately chose three diverse attacks:
1. Sapphire Sleet vs. Mastra (a North Korean actor targeting an AI-agent framework). The actor compromised a maintainer account with permissions over the supply chain and injected a malicious package that ran as a post-install script on any npm run, dropping a cross-platform remote-access trojan tailored to Windows, macOS, or Linux.
2. The “Miasma” worm. The left side of the attack resembled Mastra, but the post-install script also harvested credentials from the dev platform and any machine npm ran on, then used them to find additional pipelines to publish more malicious packages — “a self-replicating worm.” The recovery insight was sharp: this becomes two incidents. The malware side is comparatively tractable — “you know what machines were infected.” The credential/access side has “no cleanup” in the same sense; you must follow every stolen identity from the developer’s laptop into cloud environments, build systems, and source repositories. And the worm “ensured that as we got past one environment and got to containment, it had replicated itself,” seeding the next incident.
3. Storm-2999 / “Team PCP” vs. Trivy (targeting the security tool itself). Rather than compromise a maintainer, this actor abused GitHub tags — which organizations use to pin specific versions — redirecting them to malicious packages. The chosen victim was a vulnerability scanner from Aqua Security. The point the VPs drew is one every defender should sit with: security tools “run with elevated privileges,” so compromising them hands the attacker those same privileges. Worse, “the scans coming from the tool… were obviously green, because the problem was in the tool.” The defense you installed became the blind spot. This is the live-campaign version of the scanner-as-attack-surface research ZeroPath presented elsewhere at the show.
The unifying pattern, in their words: “none of them wanted to go after the victim directly. Their goal was to compromise something the victims already trusted, take that upstream compromise, find a way to get it to a downstream impact, and then land this very widely with a lot of organizations that did nothing wrong.”
Signals, agents, and a human at the end
On the defensive research side, the story was about scale. There are “about 50,000 npm packages released on a daily basis,” and the broader ecosystem is far larger — “impossible for a manual process to scale.” Microsoft aggregates global signals from endpoints and cloud, then feeds a multi-agentic system that triages packages via static analysis, real-world endpoint behavior, and an “agentic binary analyzer” the team previously presented as Project Ire, classifying packages “within seconds.” Over the last 30 days the pipeline scanned “close to about a million packages,” finding “more than 100 detections” on a typical day — not all equally serious, ranging from genuinely malicious to merely “buggy written installers.” The stated design goal is to compress the picture so “decisions can be made by a human”: “the scale has fundamentally changed, but we’re still using the human to make that final decision.”
Three trends the VPs flagged for the road ahead
1. Vulnerability discovery is accelerating. By mid-year they had nearly matched the previous full year’s total of CVE-assigned vulnerabilities — and that
is only the ones that get a CVE. Their frontier model (“M-Dash”) was reported to find roughly 100 critical vulnerabilities per repository it scans. The scariest number, they said, is not the volume but the slope: the shrinking gap between a flaw being found and being exploited.
1. Attacker autonomy is rising. Six months ago threat actors used AI to automate a few steps (lures, exploit snippets). More recently they observed a
ransomware campaign largely directed by a model, and a “fully autonomous” campaign (tracked as Storm-3168) that found victims and executed end to end “without any human involvement,” even pausing to diagnose and fix its own failures. For responders, “we’re not racing against an operator… we’re racing against an AI loop.”
1. The attack surface now includes agents. With organizations rushing to deploy agentic systems, Microsoft reported an “18x increase in agents month over
month” in its M365 data. Agents behave unpredictably (their model or prompt can change), run 24×7, and act “on behalf of someone.” Investigations must now ask not only which users and machines were impacted, but “what agents were impacted” — a category most organizations cannot yet inventory.
The three takeaways
The keynote closed with three imperatives that map almost one-to-one onto the case studies:
· Treat your CI/CD tokens like production credentials — because in all three stories, that is what the dev and CI/CD tokens turned out to be.
· Know where your tooling can reach — the Trivy case was “a scanner that no one was actually inventorying” that “caused the biggest problem.”
· Get cyber resilient — know what you need to respond at speed and scale.
None of it was new advice, they admitted. “The difference is the ramifications of not doing it now are exponential to what they were even eight months ago.” The session also pointed the audience to a same-week blog on a fresh supply-chain campaign the responders called “Chain Drop.”
Why this matters to the SBOM/CVE debate
For readers following my argument that SBOM and CVE are a “duck and cover” against supply-chain attacks, the Microsoft keynote is important evidence on both sides. It strongly supports the core distinction: every headline case was an exploitation of trust, not a catalogued vulnerability, and the hardest, longest part of recovery was the stolen-access aftermath — “once that code hits your machines, you are done” made concrete. Yet it also shows CVE-tracked vulnerabilities exploding and time-to-exploit collapsing, and it leans on behavior, telemetry, and agentic analysis rather than name-matching — the very shift from names to behavior that my thesis calls for.
About the author
Dr. Arun Lakhotia is Professor of Computer Science at the University of Louisiana at Lafayette and co-Founder/CTO of Unknown Cyber Inc. He was on assignment with Cyber Defense Magazine for Black Hat 2026 to study the nuances of solutions offered for software supply chain defense. His expertise is in developing automated solutions for analyzing complex malware on a very large scale.
Reach him online at [email protected].
