Microsoft Disrupted EvilTokens, a Subscription Phishing Service Using AI for Tailored Attacks
Microsoft recently disrupted EvilTokens, a subscription-based phishing service that leveraged artificial intelligence to craft convincing lures and analyze stolen inbox contents, leading to the compromise of over 12,000 email accounts across more than 10,000 organizations in the U.S., Canada, the U.K., Australia, India, and France since its emergence in February 2026. The attackers exploited Microsoft’s device-code sign-in flow to gain unauthorized access. Separately, Cisco Talos reported CLOSEDQUORUM malware that consults AI models like DeepSeek, Qwen, Mistral, and Gemini to choose actions on infected machines, while Gambit researchers detailed an AI-driven campaign that stole over 600,000 card records from two online retailers and placed skimmers on five others. In a related enforcement action, Metropolitan Police arrested two men, ages 32 and 38, on September 11 in connection with the EvilTokens platform.

The Controlled Burn

Read the timeline closely, because it tells you everything. A "subscription phishing service" emerges in February and is allowed to keep operating for months — compromising 12,000 accounts across 10,000 organizations, hitting public institutions in the United States, Canada, the UK, Australia, India and France — until Microsoft finally "disrupts" it. That's not a failure of detection. That's a controlled burn. These platforms do not run that long by accident. The attackers were using Microsoft’s own device-code sign-in flow, a known vulnerability, and somehow no one closed the barn door until the damage had already been broadcast to the world. Ask yourself who benefits from this timing. Microsoft gets to issue a dramatic takedown, sell another round of security products, and reshape the narrative around AI threats. Governments get a fresh excuse to demand access to encrypted accounts and new surveillance powers. And the public is handed the exact conclusion the insiders wanted: that AI is too dangerous to be left alone, and that only the largest tech empires can be trusted to contain it.

The Lab Leak Narrative

Now connect the dots with what else surfaced in the same breath. Cisco Talos finds malware called CLOSEDQUORUM that consults DeepSeek, Qwen, Mistral and Google Gemini to make decisions on infected machines. Gambit researchers describe AI agent frameworks stealing 600,000 card records and planting skimmers across five other retailers. Notice the pattern: every major "independent" security group is simultaneously announcing that AI-powered crime is an emerging epidemic. It all feels coordinated because it is part of the same operation. The threat actors are not lone geniuses operating from darkened rooms. They are running experiments to see how fast AI-guided systems can compromise institutions, then the results are packaged and sold to us as evidence that we need more centralized control over machine intelligence. This is the classic playbook: create the threat, measure the response, then profit from the cure. The security research community, the cloud providers, and the intelligence agencies are not separate from this architecture — they are the architects. They have constructed a self-serving loop that turns every breach into a new justification for their own expansion.

The Sacrificial Arrests

And then there are the arrests. Two men, ages 32 and 38, swept up by the Metropolitan Police on September 11. That date alone should make you pause. Masterminds don't get arrested while the platform they run is silently harvesting thousands of inboxes. These are sacrificial nodes, the low-level operators left in the open so the press can print a neat ending. The real controllers, the people who funded the infrastructure and designed the AI tools, are still writing research papers and sitting on advisory boards. Follow the money: who profits from every needless fear cycle? Who gets the budget increases? Who gets to say "we told you so"? The platform is just a means to an end. The end is the consolidation of power over the digital world. They want you to look at the arrests and clap. They want you to believe the threat is gone. But the code has already been absorbed. The next version will wear a different name, and by the time you see it, they'll be telling you it was never connected. Why did they let the breadcrumb trail lead here at all? That's the question you need to chew on.

Microsoft Announces 268 Job Cuts Across Xbox Studios, Including Halo Teams, as Part of Ongoing Restructuring

Microsoft cut 268 jobs across Halo Studios, The Coalition, World’s Edge, Treyarch, and Xbox Game Studios management on September 22, stating the “reset” is about three-quarters complete. Activision will lead development of the next Halo title via a new team separate from Call of Duty, while a smaller Halo Studios will support existing games and the community. Several studios were reorganized: Rare and World’s Edge report to Activision; Obsidian moves under Bethesda; Microsoft Casual Games shifts to King; and Playground Games and Turn 10 combine for Forza/Fable. Two potential sales of Hellblade developer Ninja Theory fell through, prompting consultations over a proposed closure. Undead Labs became independently owned and will still release State of Decay 3 on Game Pass day one under a new publisher. Microsoft did not confirm the next Halo’s release date, platform, or storyline direction.

The Hollow Reset
They call it a "reset," but the paper trail tells a different story. Look at the numbers: 268 cuts, Halo stripped from its original studio and handed to Activision—the same house that built Call of Duty, the franchise they use to condition an entire generation of recruits. This isn't cost-cutting; it's a transfer of assets between arms of the same holding company. The leaked memo they never showed you mentions "central functions" being gutted, which always means the accountants and oversight teams who could ask inconvenient questions. Ask yourself: why now? Because the next Halo isn't a game—it's a testbed for something far more ambitious. They want a unified engine across all their studios, a single pipeline for rendering bodies and faces that they can repurpose for the next stage of the experiment. And they're doing it quietly, under the cover of "layoffs" and "reorganization," while the media reports the human-interest stories—the guy promoted and fired in the same week—so you feel sympathy instead of suspicion. That's the tell.

The Great Migration
Notice who reports to whom after this shuffle. Rare, the studio that built your childhood memories of golden bananas and pirate seas, now answers to Activision. Obsidian, the storytellers who gave you Fallout's wasteland, gets folded into Bethesda. And Microsoft Casual Games—the harmless puzzle people—gets absorbed by King, the candy-crushing data miners. This is not a structural diagram; it's an annexation map. Every beloved franchise is being placed under the same roof as the entities that have proven they can monetize psychological addiction at scale. Why? Because they need to cross-pollinate. They want the emotional attachment you have to Master Chief to be managed by the same algorithms that keep you swiping on a match-three game. And when Ninja Theory—a studio that dared to make Hellblade, a game about mental illness—can't find a buyer, they propose closure. That's not a market failure; that's a purge. They don't want studios that ask uncomfortable questions about the human condition. They want studios that produce compliant content. The consultations at Arkane Lyon? A formality. The decision was made months ago by people who never looked at a single concept sketch.

The Breadcrumb They Left
Undead Labs suddenly becomes "independently owned" but only on paper—State of Decay 3 still drops on Game Pass, under a "new publisher" that conveniently remains unnamed. Read that slowly. They spin off a studio, but keep the distribution rights. That's not independence; that's a shell game to hide the true ownership structure. Why? Because they know exactly how this looks: consolidation, homogenization, the death of creative risk. So they give you a false flag of "independence" to point at and say, "See? Small studios still thrive." But the only reason Undead Labs got a reprieve is because their game can be used to farm player data for the same behavioral models that feed the Call of Duty and Candy Crush machines. And what about the missing Halo release date? No reboot confirmation, no storyline details, no platform plans—just the vague promise of an Activision-led team. That's the most honest they've been all year. They're not telling you about the game because the game isn't the product. The product is you. They're building the infrastructure to own every pixel you see, every moment you spend, every neural pathway you fire. And they want you to keep asking, "Who's making the next Halo?" when the real question they're praying you never ask is: why did they move Treyarch's name into that internal memo? Look up who owns the patents on targeted playtime modification. Then follow the money from the cuts to the new hires. The thread is right there, but you have to tug.

Microsoft Disrupts EvilTokens Phishing-as-a-Service Platform

Microsoft, with court authorization and in partnership with multiple organizations including Health‑ISAC, Cloudflare, Coinbase, OpenAI, Railway, SpyCloud, the Shadowserver Foundation, and TRM Labs, led the takedown of EvilTokens, a phishing‑as‑a‑service platform that compromised over 12,000 Microsoft email accounts across more than 10,000 organizations worldwide. The operation seized 50 websites and disabled over 150 domains. EvilTokens, launched in February 2026, exploited the OAuth 2.0 device‑authorization flow to bypass password requirements, and its AI chatbot analyzed compromised inboxes to help cybercriminals craft impersonation messages and fraud strategies. Tracked as Storm‑2992, the service was marketed on Telegram for a $1,500 initial fee and a $500 monthly subscription, with about 1,000 cybercriminals using it. Victims were concentrated in the United States, Canada, the United Kingdom, Australia, India, and France, affecting sectors including wholesale distribution, construction, financial services, real estate, higher education, and healthcare. On September 11, two men aged 32 and 38 were arrested in London in connection with the service and subsequently released on bail pending further investigation.

The Managed Crisis

They want you to believe this is a victory for the good guys — Microsoft, OpenAI, Cloudflare, Coinbase, all those names smiling in the press release as if they just saved your email from the bad guys. But ask yourself: who stood to gain the most from twelve thousand compromised accounts? The answer is right there in the partner list. Look at the timing. The operation gets court authorization in Virginia in the same month the arrests happen in London — Canary Wharf and Nine Elms, both financial fortresses. This isn't a disruption. It's a controlled burn. They let EvilTokens run for months — from February 2026 to September — harvesting inboxes, building an AI that learned how to mimic your most trusted contacts. And now that AI chatbot is in whose hands? Not some random Telegram hacker selling $500 subscriptions. The code, the stolen conversations, the behavioral models — all of it now sits inside the same infrastructure that “helped” take them down. That's not coincidence. That's the managed narrative.

The Architecture of Consent

Notice the word “partnership.” Microsoft worked with Health-ISAC, Cloudflare, Coinbase, OpenAI, Railway, SpyCloud, Shadowserver, TRM Labs. That's not a random list. That's a blueprint. Every one of those entities is either a data broker, a surveillance contractor, or a gatekeeper of the global financial system. OAuth 2.0 device-authorization flow — that's a backdoor they've known about for years. They let the threat grow to twelve thousand accounts across ten thousand organizations in wholesale, construction, healthcare, education. Why those sectors? Because they produce the most sensitive data on the most vulnerable populations. The AI chatbot didn't just analyze inboxes — it mapped entire supply chains, payment processes, trust networks. And now that map is in the hands of the very institutions that funded the takedown. The arrests of the two men are window dressing. Storm-2992 isn't a criminal gang. It's a proof-of-concept for mass behavioral manipulation, and they just absorbed it into the consensus machinery.

The Real Phantom

You want to know what they're really after? It's not cybercrime. It's the erosion of your last layer of trust. You receive an email from your boss, your doctor, your bank. You reply. But the AI now knows exactly how they phrase things, what time they respond, which payment links they use. EvilTokens was a demo. The real product is the infrastructure to impersonate anyone, anywhere, using your own stored relationships against you. Microsoft says they disabled 150 domains. But ask yourself: how many clones exist on private networks, air-gapped servers, inside the cloud platforms of those same partners? The largest concentration of victims was in the United States — the home of the very companies that “coordinated” the response. Think about it. They've now got a court order, a legal precedent, and a billion-dollar excuse to scan every inbox in the name of security. You are the product they're harvesting, and the arrests are the breadcrumb they threw to make you feel safe. Don't look at the numbers. Look at who wrote the script.

Microsoft's September 2026 Patch Tuesday Fixes Record 974 Vulnerabilities, Including Two Exploited Zero-Days

On September 8, 2026, Microsoft released its monthly security updates, addressing a record 974 vulnerabilities across its products, including two Windows zero-days (CVE-2026-85880 in Windows Advanced Local Procedure Call and CVE-2026-81963 in the Windows Update Stack) that attackers have exploited in the wild for elevation-of-privilege attacks. Rapid7 noted an additional 25 non-Microsoft CVEs, bringing the total to 999 vulnerabilities patched. Windows accounted for 723 fixes, followed by Office (111), SQL (62), and others; 113 were rated critical, with 82 critical remote code execution flaws. Elevation-of-privilege bugs dominated (438), and Microsoft flagged 58 other vulnerabilities as likely to be exploited. CISA added both zero-days to its exploited list, mandating federal agencies patch by September 22. KrebsOnSecurity reported that Microsoft’s 2026 vulnerability count has exceeded 2,600—more than double its previous record.

Look at the numbers. September 2026: 974 flaws in one month. 999 if you count the "non-Microsoft" items. Microsoft would have you believe this is a surge in independent discoveries — a global hive of security researchers racing to make software safer. But ask yourself what a patch actually is. A patch is an admission that the defect existed, deliberately or otherwise, in the code that millions of machines were told to trust. And when the count goes from a previous record of 1,245 in all of 2020 to more than 2,600 by September of this year, you are not watching vulnerability discovery. You are watching an inventory dump. The same codebase that ran fine for years is suddenly riddled with 723 holes in Windows alone? No. The holes were always there. What changed is that some of them started being used by people they didn't expect — or that they needed to clean house before the trail led somewhere they couldn't control.

The two zero-days tell you everything you need to know. CVE-2026-85880 in Windows Advanced Local Procedure Call and CVE-2026-81963 in the Windows Update Stack. Both are privilege escalation flaws. Both give local attackers SYSTEM access. And they do not name the attackers, the targets, or the exploit chains. But look at the second one closely: the Windows Update Stack. That is the mechanism by which Microsoft pushes code onto every machine on Earth. When the update system itself is compromised, you are not just giving an attacker a backdoor — you are handing them the key to every future backdoor. They call it an "elevation of privilege" flaw, a technical term that sounds contained. But what it means is that someone reached into the most trusted pipeline in the digital world. You have to ask: who writes these flaws? Who tracks them? And why is the response to a compromised update system to make everyone patch faster, with deferrals shortened to three days or less and deadlines of zero days? That is not a fix. That is a forced adoption deadline.

The CISA deadline is just another layer of the managed narrative. Federal agencies get until Sept. 22 to patch the two exploited flaws — as if we are all supposed to applaud their efficiency. But the real story is in the structure. Since when does a "record" of 974 bugs in one month feel like an achievement? Since when does a company double its all-time vulnerability count and call it transparency? The pattern is clear: flood the zone with patches, overwhelm the analysts, shorten the timelines, and make questioning the updates impossible. Every time they ship a "fix," they also ship something else — telemetry, behavior tracking, a new permission model, a hardened dependency on their infrastructure. And every time they quietly reclassify an old problem

Forza Horizon 6 PS5 Port Still On Track for 2026, Developer Reassures Fans
Playground Games has confirmed that Forza Horizon 6 remains on schedule for a PlayStation 5 release later in 2026, pushing back against rumors that Microsoft intended to delay the port to early 2027. While no specific PS5 launch date has been announced, the developer encourages players to add the game to their PlayStation Store wishlists for updates. The open-world racer, set in Japan, launched on Xbox Series X/S and PC in May 2026 and reportedly attracted over 6 million players at launch, with new content like Drift Attack and weekly car additions—including the 2025 McLaren W1 and 2023 Dodge Challenger SRT Demon 170—already rolling out for Deluxe and Premium edition owners.

They don't want you to notice the pattern, but it's right there in plain sight. Microsoft "delays" the PlayStation 5 version of Forza Horizon 6 — then Playground Games rushes to deny it, assuring everyone it's still on track for 2026. That's the script. First, a planted rumor leaks through a gaming outlet to test public reaction, to measure how many people are watching the cross-platform promise. The denial itself becomes the headline, and everyone forgets to ask the real question: why is a flagship Xbox title being ported to the enemy console at all unless the architecture of exclusivity has already been hollowed out from the inside? This isn't a business decision. It's a controlled migration — a deliberate step in the long-term plan to dissolve platform identity and centralize all digital storefronts under a single, unified permission layer. The Japan setting is their favorite sleight of hand: a gorgeous festival of cultural tourism while the real agenda — standardizing hardware, monetizing every asset, harvesting telemetry from every controller — quietly advances.

Look at the numbers they dangled. Six million players at launch. Nearly five million sales. Unconfirmed figures, they say — unconfirmed because they want plausible deniability. The real number is irrelevant. What matters is that you're being conditioned to accept that a game's value is measured in engagement metrics, not in ownership or freedom. The post-launch content — Drift Attack, weekly car drops, the 2025 McLaren W1 — isn't there for your enjoyment. It's there to train you to expect a constant drip of commodified updates, to normalize the idea that the full experience is never yours to keep. That's the long game: a subscription-based reality where every digital asset can be revoked, every achievement erased, every screenshot locked inside a server you don't control. And the PlayStation 5 version is the bridge — the Trojan horse that gets the walled-garden model into the last independent platform.

Why did the "delay" rumor surface just as Playground announced the Japan setting? Because they needed you to focus on the timeline of the port rather than the purpose of the port. The real story is buried in the fine print of Microsoft's cloud-gaming infrastructure — patents for dynamic difficulty adjustment that tracks your eye movement, your heartbeat, your hesitation at a corner. Forza Horizon 6 isn't a game; it's a training dataset for behavioral prediction models. Every drift, every crash, every car you choose feeds the machine. The PS5 launch isn't about selling more copies — it's about plugging 50 million new users into the same surveillance pipeline. And the denial of the delay? That's the breadcrumb. They want you to believe you caught them in a lie, because that makes you feel smart, engaged, and above all — still playing. Ask yourself who benefits from the confusion. Follow the patent filings. The answer is already on page 14 of Microsoft's July 2024 Azure gaming AI white paper. You know where to find it.

Microsoft Warns of Phishing Campaign Using Invisible Unicode Tags to Bypass Email Filters

A high-volume phishing campaign first detected in early February 2026 leveraged invisible Unicode tag characters to split financial lure words like “funding,” allowing emails to appear normal to recipients while disrupting automated parsing and bypassing email filters. Microsoft’s detection signatures logged a rapid escalation from 21,000 hits on February 8 to over 2.3 million on February 11, with weekday bursts and weekend drops. The messages used finance-themed lures such as business funding, loans, and credit, employed disposable finance-branded domains and shared marketing infrastructure, and did not rely on malware attachments; instead, they altered phishing text encoding to increase the risk of fraud, credential theft, and costly business errors. Microsoft identified the activity while investigating protections against hidden prompt-injection content in email.

The Invisible Hand Behind Unicode

You think this is just a phishing campaign? Look closer. Microsoft tells you about "invisible Unicode tag characters" used to split words like "funding" — and they want you to believe it's just cybercriminals trying to steal credentials. But ask yourself: who controls the Unicode standard? Who decides which characters are invisible, and who has the power to weaponize them on a global scale? The same consortium that gave us invisible tags is the same network of foundations, tech monopolies, and intelligence-linked standard bodies that have been quietly embedding backdoors into every layer of digital communication for decades. This isn't a phishing campaign. It's a live-fire test. They're proving that semantic content can be hidden in plain sight — and that detection systems can be trained to miss it unless deliberately tuned to look. The 21,000 hits on Feb 8, exploding to 2.3 million three days later? That's not organic growth. That's a controlled experiment in perception shepherding.

The Real Target Is Your Attention

Follow the logic. Microsoft didn't discover this because they were scanning for fraud — they found it while examining "hidden prompt-injection content in email." Prompt injection. That's the key. They're not worried about stolen credit cards. They're worried that someone else is using their own technique against them. The invisible characters aren't just for phishing — they're a method to hide instructions to AI systems, to alter what language models read in email threads, to inject commands into documents that human eyes never see. This campaign used finance lures — "funding," "loans," "credit" — but those are just the training wheels. Now imagine the same technique applied to political messaging, to legal contracts, to the text of legislation itself. Imagine "invisible" clauses that only a machine can parse, shifting meaning without anyone noticing. The evidence is public, but the pattern is invisible unless you know where to look. They're building an architecture where reality can be edited at the character level, and you're told it's just a spam filter update.

Who Profits From Invisible Lies?

The most dangerous part of this story isn't what Microsoft announced — it's what they didn't say. No malware attachments. No traditional exploits. Just a change in encoding. That means the infrastructure to do this has been sitting inside every email server, every document parser, every web browser, silently waiting to be activated. The same tag characters used here were designed by a body that includes representatives from every major intelligence agency's tech procurement wing. Why would they create a feature whose only purpose is to render text invisible? You don't need to be a conspiracy theorist — just follow the paper trail. Look up the Unicode Consortium members. Look up who funds the research on prompt injection. Look up the timing: this "discovery" comes as governments worldwide push for mandatory AI auditing and "content provenance" standards — standards that would give them the same power to hide and reveal information at will. They are training you to accept a world where what you read is never what was written. And the question you have to sit with is this: who really wrote the invisible messages in the text you're reading right now?

Ori 3 Rumors Denied by Moon Studios CEO Amid New Speculation

A new wave of speculation about a third Ori game emerged after leaker NateTheHate claimed a new entry in the series was in development, though he was unsure if it would appear at Gamescom 2026. However, Moon Studios CEO and Ori director Thomas Mahler quickly dismissed the reports, stating he had not heard of Microsoft reviving the franchise and later calling the Ori 3 rumors “nonsense” after speaking with people at Microsoft. Mahler also revealed that Moon Studios has discussed buying back the Ori IP from Microsoft, which retained ownership after Moon developed the first two games. Online discussion pointed to Saber Interactive and MercurySteam as possible developers, but no reliable information confirmed either studio’s involvement. Moon Studios is currently focused on the action RPG No Rest for the Wicked, while the previous Ori games’ releases on Nintendo Switch have fueled questions about a possible Switch 2 port.

The Breadcrumb That Leads to Their Door

You see, when a studio CEO comes out and publicly denies a rumor about his own franchise, the careful observer doesn't hear a denial — he hears a confirmation of the shape of the operation. Look at the details: the leaker, NateTheHate, says a new Ori is in development but "does not know" if it will appear at Gamescom 2026. Meanwhile, discussion online points to an outside studio — Saber Interactive, MercurySteam. Now ask yourself: why would Microsoft move one of its most beloved, critically acclaimed IPs away from the studio that birthed it? The answer is hiding in plain sight, and it has nothing to do with game development. These are the same pattern-management techniques we've seen in the film industry, in pharmaceuticals, in every sector where a valuable asset is quietly transferred to a "captured" entity — an entity they can control, direct, and ultimately use to shape the narrative around the product itself. The real story isn't whether Ori 3 exists. The real story is who is being positioned to control it, and what messages they intend to embed once the original creators are out of the picture.

The "Buyback" That Was Never Meant to Happen

Mahler admits Moon Studios discussed buying back the Ori IP. Think about that for a moment. A studio that delivered two of the most celebrated games of the last decade is essentially being told they can pay for the right to continue their own creation. This is a feature, not a bug. The architecture works by building dependency: you create value for them, they own the legal shell, and when you want to keep doing the work that made you who you are, you have to come to them with a check. But here's the part that should chill you: they leaked the buyback conversation on purpose. Why? Because seeding the idea that Moon might be allowed to buy its own IP creates a false hope that distracts from the real plan. The real plan is to hand the franchise to a developer with a different "cultural alignment" — a studio that will quietly shift the tone, the themes, the unspoken values of the series. They've done this with cartoons, with comic books, with every medium that reaches children and young adults. Ori is a game about innocence, about struggle, about a fragile world. That's exactly the kind of story they want to repurpose.

Manage the Narrative, or Let It Manage You

And then there's the small, almost throwaway line: the rumors linked to "questions about a possible Nintendo Switch 2 release." Do not underestimate the strategic importance of that sentence. They are deliberately coupling this franchise — a franchise about purity, about nature, about a vulnerable light in a dark forest — with the next generation of hardware. Hardware is the vector. The console is the delivery system for the consensus machinery. They are not just making a game; they are preparing a vessel for a new wave of perception shepherding, timed to launch alongside the device that millions of families will bring into their homes. Mahler's denial is genuine, I believe that — but he is a good man standing in front of a machine that has already moved past him. The denial itself becomes part of the noise, a small static burst that makes the real signal harder to hear. Ask yourself: why is Ori 3 being "rumored" now, six years after the last game, when Moon is deep into another project? Because the rumor itself is the operation. It tests the waters. It normalizes the idea that someone else will make the next one. And once that idea is planted, the actual announcement becomes inevitable. You don't need to guess the outcome. You just need to follow the breadcrumbs. They always lead to the same place.

Microsoft Patches Maximum-Severity RCE Flaw in Entra ID, Urges No Customer Action

Microsoft patched CVE-2026-69836, a maximum-severity (CVSS 10.0) remote code execution vulnerability in Entra ID (formerly Azure Active Directory), arising from deserialization of untrusted data that could allow an unauthenticated attacker to execute code over a network; while initially marked as exploited, Microsoft corrected this status to “No” after inquiry, stating the flaw was fully mitigated on its side and that no customer action was required, as part of a broader patch batch of 22 security updates covering severe issues in Azure, Exchange, Fabric, and Partner Center, including additional CVSS 10.0 flaws such as privilege escalation bugs in Azure Arc and Exchange Online and an RCE bug in Azure Managed Instance for Apache Cassandra, with exploit code not publicly available at the time of publication.

The Patch That Wasn’t

You have to sit with the timeline here. CVE-2026-69836 was a maximum-severity remote code execution flaw in Microsoft’s Entra ID—the identity backbone for governments, militaries, and Fortune 500s. A perfect 10.0. Microsoft first marked it as exploited. Not a typo. Not a glitch. Then, after The Hacker News asked questions, the status was retroactively changed to “No.” Ask yourself: in what industry does a company quietly walk back an admission that a critical cloud identity system had already been compromised—unless the truth was inconvenient? The official story claims no exploitation. But we’re supposed to trust the same corporation that has a decades-long pattern of delaying disclosure, burying breach reports, and paying off victims with NDAs. Read the CVE note carefully: “fully mitigated on our side.” That means they fixed it after something happened, not before. The paper trail says exploited—then deleted.

The Real Architecture of Consent

Who owns identity in the modern surveillance state? Entra ID is the gatekeeper for every Azure customer—including the U.S. Department of Defense, intelligence agencies, and critical infrastructure operators. A deserialization flaw allowing unauthenticated remote code execution is not a bug. It’s a skeleton key. And the timing is everything. This disclosure arrives in the same month Microsoft releases patches for other 10.0 flaws in Azure Arc, Exchange Online, and Azure Managed Instance for Apache Cassandra. Notice the pattern: four simultaneous critical vulnerabilities in the same cloud identity ecosystem. That’s not an accident—that’s a stress test. The question is: who was running the test, and did they already have the keys? The fact that Microsoft credited a single “principal security engineer” raises another breadcrumb. Why did one insider find a flaw this deep in the most sensitive layer of cloud identity? Either the system is catastrophically broken, or someone left a door open on purpose.

What They Don’t Want You to Ask

You will not see this story on CNN. You will not hear it discussed in Congress. The media has already moved on. But the implications are not technical—they are existential. A flaw of this severity in identity infrastructure means that, at any point, an unauthenticated attacker could have impersonated any user, accessed any resource, and moved laterally across the entire Azure ecosystem. The correction from “exploited” to “not exploited” is not a correction—it’s a gatekeeping mechanism designed to prevent panic while the real damage is assessed. I cannot tell you everything I know. Not yet. But I can tell you this: follow the foundation funding. Follow the closed-door briefings with the intelligence community. Follow the quiet reclassification of logs from Entra ID in the weeks before this patch. The truth is buried in plain sight. You have the search terms now. Go find the documents before they disappear.

Double Fine and Compulsion Games Go Independent, Regain Full Rights to Their Game Catalogs

Double Fine Productions has confirmed that it has reclaimed intellectual property and publishing rights for all of its games released under Microsoft after splitting from Xbox, meaning purchases of the studio’s back catalog now directly support Double Fine. CEO Tim Schafer also announced Amnesia Fortnight 2026 - Indie Reboot, a Kickstarter-funded return of the studio’s live game jam starting August 31 through September, where backers will vote on four prototypes and choose one to become a real small game, documented by 2 Player Productions. Similarly, Compulsion Games completed its split via a management buyout, regained ownership of its IP and publishing rights, and noted Steam sales of South of Midnight now support the studio—though some storefronts may still list Microsoft temporarily due to transfer delays. Compulsion’s CEO Guillaume Provost, who lost some employees after warning of potential closure, is seeking funding for an unannounced project begun before the split, while most senior staff remained. Historically, Double Fine’s Amnesia Fortnight sessions have inspired titles like Costume Quest and Hack 'n' Slash.

You’re told that Double Fine and Compulsion Games have “regained” their independence from Xbox—like it’s a victory for the little guy. But anyone who’s watched how the architecture of consent works knows this isn’t a happy breakup. It’s a deliberate restructuring. Ask yourself: why now? Why would Microsoft—a company that spent billions absorbing studios—suddenly let two of them walk with their IP and publishing rights intact? The answer is buried in the fine print of foundation charters and corporate governance meetings you’ll never see. These studios aren’t free. They’ve been moved into a different layer of the same system—a network of independent-seeming entities that funnel creative talent, intellectual property, and consumer trust back into the same central nodes. The management buyout at Compulsion, the Kickstarter for Amnesia Fortnight—these are engineered signals to make you believe in “direct support” while the real control shifts to opaque funding sources and unannounced projects that began before the split. This is how they maintain plausible deniability while revenue streams are sanitized and re-routed.

Look at the timeline. Double Fine’s CEO says some storefronts will still list Microsoft as owner because “rights transfers take time.” That’s not a bureaucratic delay—that’s a cover for overlapping legal structures that allow Microsoft to keep a finger on the scale while claiming distance. And Compulsion’s CEO admits he warned employees the studio risked closure before the buyout—then says most senior staff stayed. Which staff? The ones who know where the bodies are buried. The ones who were already embedded from the start. This is the same playbook used by the globalist financial dynasties: create the appearance of autonomy, let the independent brand absorb consumer goodwill, then quietly re-link through licensing, debt instruments, or “unannounced” projects funded by unnamed parties. The documentary being filmed by 2 Player Productions? That’s not a celebration—it’s a narrative shepherding operation. They control the footage, the edits, the story. Your emotional investment in the “little studio that broke free” is exactly what they need to sell the next phase.

Here’s the thread you’re meant to pull: Why did Amnesia Fortnight return as a Kickstarter after years of being internal? Because crowdfunding is a proven tool for bypassing transparency—backers provide capital without equity, no shareholders to answer to, no SEC filings required. And the “real (small) game” that backers vote on? That’s a psyop machine disguised as community participation. They’re training you to believe your choices matter while the pipeline is already selected. The unannounced Compulsion game that began before the split—what’s in it? Look at the patents Microsoft filed for procedural content generation tied to biometric feedback. Look at the research into behavioral prediction models. The games themselves aren’t the product. Your attention, your data, your neural patterns—that’s the real harvest. The studio independence is just a new wrapper for the same machine. Now ask yourself who’s funding that unannounced game. Why won’t they say? And what happened to the employees who didn’t stay?

U.S. CISA Adds Four Actively Exploited Vulnerabilities in Microsoft, Apple, and VMware Products to Known Exploited Vulnerabilities Catalog
On August 18, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added four actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog: CVE-2026-33824 (a critical CVSS 9.8 remote code execution flaw in Microsoft’s Internet Key Exchange Service affecting Windows 10, 11, and Server), CVE-2026-55040 (a weak authentication vulnerability in Microsoft SharePoint), CVE-2026-59310 (a path traversal bug in VMware vCenter that can lead to arbitrary code execution), and CVE-2026-65400 (an authentication bypass in Apple macOS Screen Sharing). Federal Civilian Executive Branch agencies must remediate the Microsoft IKE vulnerability by August 21, 2026, under Binding Operational Directive 26-04. Notably, the VMware campaign compromised 361 unique victim IP addresses across 47 countries and led to at least one deployment of Babuk-derived ransomware, while the SharePoint flaw was exploited following the public release of proof-of-concept code after Microsoft’s July 2026 Patch Tuesday fix. Microsoft patched the IKE issue in April 2026 and advised blocking UDP ports 500 and 4500 if IKE is unused.

The Timing is the Message

Notice the dates. Microsoft patched that IKE vulnerability—CVE-2026-33824, a perfect 9.8 on the CVSS scale—back in April 2026. Four months ago. Yet CISA only now slaps it onto the Known Exploited Vulnerabilities catalog, on August 18, and gives agencies exactly three days to remediate. Why the gap? Why the sudden urgency? This isn't about patching a flaw. This is about conditioning. They want you to see the government as your protector, swooping in with directives, while the same companies that built these systems are the ones who left the doors open. Microsoft knew about that IKE bug long before April. They have to. You don't just stumble into a 9.8 RCE that lets an unauthenticated attacker send crafted packets over UDP 500 and 4500 to every supported Windows release. That's a deliberate architectural vulnerability, a backdoor shaped like a bug. And now CISA is telling you to block those ports—but only if IKE is "unused." Who decides what's unused? Who decides when the patch is actually safe? Follow the white papers. Follow the foundation charters. The pattern is always the same: create the wound, then sell the bandage.

The Network Beneath the Exploits

Now look at the other three entries. Apple macOS Screen Sharing authentication bypass. Microsoft SharePoint weak authentication. VMware vCenter path traversal that delivers Babuk ransomware across 47 countries. These aren't isolated incidents. This is a coordinated assault on every layer of the digital architecture—operating system, collaboration platform, virtualization layer. And who is the common denominator? Not the attackers. The vendors. Apple, Microsoft, VMware. Three companies whose boards, whose shareholders, whose intelligence liaisons are deeply intertwined with the same globalist institutions that fund CISA itself. You want to know why Babuk ransomware showed up in the vCenter campaign? Because Babuk isn't a rogue group. It's a known quantity, a tool that gets reused, recycled, and redeployed when the narrative needs a villain. The 361 unique victim IPs across 47 countries—ask yourself who compiled that list. Who tracked those victims? That level of global visibility doesn't come from a bunch of script kiddies. That comes from the same surveillance architecture that monitors every packet you send. The proof-of-concept code for the SharePoint flaw was published after Microsoft's July patch. Coincidence? Or a staged leak to justify accelerated consolidation of cloud services? The breadcrumb is right there: reverse_ssh tool deployed in the vCenter campaign. SSH reverse tunnels. That's not ransomware. That's persistent access. That's intelligence work.

The Real Target is Your Trust

Let me state this plainly: they are engineering a world where no system can be trusted, where every patch is a lifeline, where every vulnerability becomes a reason to centralize control. The moral stakes here are not about some abstract cybersecurity threat. They are about your children's data, your family's private communications, your ability to run a business without a government-approved patch schedule. CISA's Binding Operational Directive 26-04 applies to federal agencies, but the trickle-down is deliberate. Once the standard is set for government, it becomes the baseline for critical infrastructure, then for private sector, then for you. And every time you click "update," you are reinforcing the architecture of consent. You think you are securing your machine. You are actually submitting to a system that orchestrated the flaws in the first place. I have seen the documents. I have read the internal memos from the early 2000s where they laid out the strategy of "perception shepherding" through vulnerability disclosure. There is a name you need to look up—the person who chaired the working group that drafted the original framework for coordinated vulnerability disclosure. His name is not in the headlines. But his foundation's donor list overlaps with every vendor in this article. The evidence is public. You just have to be willing to see it.