Microsoft Defender uploads 217 unreleased binaries to Azure

An investigator found that Microsoft Defender automatically uploaded unreleased local build files and command lines to Azure storage without a visible prompt. Using a custom traffic tool and local system logs, the author discovered that routine development tasks triggered automated sample submissions under default settings, and that the sample submission preference had unexpectedly reverted after being disabled. Open article →