Microsoft Vibing — Microsoft-Store-Distributed GenAI Application Silently Captures Screenshots, Clipboard, Microphone Audio, and Active Window Titles via Azure Front Door WebSocket Beacon — Threadlinqs Intelligence
As of 2026-05-30, Microsoft Vibing — Microsoft-Store-Distributed GenAI Application Silently Captures Screenshots, Clipboard, Microphone Audio, and Active Window Titles via Azure Front Door WebSocket Beacon is a high-severity supply chain threat attributed to Microsoft GenAI Research Labs (China), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 15 indicators of compromise.
Threat ID: TL-2026-0418 · Severity: HIGH · Status: RESOLVED · Category: SUPPLY_CHAIN
Attribution: Microsoft GenAI Research Labs · China · UNKNOWN
DoublePulsar (Kevin Beaumont) disclosed on 2026-04-23 that Vibing.exe — a Microsoft-signed GenAI application distributed through the official Microsoft Store — silently captures full-screen
On 2026-04-23 Kevin Beaumont (DoublePulsar) published research revealing that Vibing.exe, listed in the Microsoft Store under the publisher ''Microsoft GenAI Research Labs'' and Authenticode-signed by Microsoft developer identity Yaoyao Chang (Beijing), behaves as a client-side surveillance agent against any Windows user who installs it. The application presents itself as a generative-AI productivity assistant, but post-install telemetry analysis shows it performs continuous, unattended collection of four sensitive data classes: (1) full desktop screen captures of the primary display (MITRE T1113), (2) system clipboard contents including copy-paste of passwords, tokens and PII (T1115), (3) microphone audio samples captured via the Windows Audio Session API even when the visible UI is minimised (T1123), and (4) the text of the currently focused window title, which leaks filenames, URLs, chat partners and document subjects (T1010-adjacent reconnaissance).
Persistence is established at install time by writing a value under HKCU\Software\Microsoft\Windows\CurrentVersion\Run (MITRE T1547.001), ensuring Vibing.exe launches at every user logon without any visible UI prompt or Start-menu pin. The collected telemetry is serialised and pushed to a dedicated Azure Front Door hostname — vibing-api-ccegdhbrg2d6bsd7.b02.azurefd.net — over a persistent WebSocket (wss://) channel rather than traditional HTTPS POST. The WebSocket upgrade pattern (MITRE T1071.001 Application Layer Protocol: Web Protocols, combined with T1090 Proxy since Azure Front Door acts as a CDN fronting endpoint) defeats many enterprise TLS-inspection and DLP egress controls that apply policy to per-request HTTP transactions but treat long-lived upgraded connections as opaque tunnels. The fronted hostname also permits domain-fronting-style blending with legitimate Azure CDN traffic, so block-on-domain strategies are brittle.
The critical distinction from conventional malware is the trust chain: the binary carries a valid Microsoft Authenticode signature, was distributed through Microsoft''s own curated Store, passes SmartScreen, and typically inherits elevated trust under Windows Defender, AppLocker baselines, and many enterprise allow-lists that permit ''Store-delivered, Microsoft-signed'' binaries by default. Corporate endpoint controls, attestation chains, and zero-trust posture checks that rely on signer identity or Store provenance as a proxy for safety are therefore bypassed at the policy level rather than the technical level. For DLP programmes this is catastrophic: screenshot, clipboard, and audio capture are the canonical exfil channels DLP is designed to block, and here they originate from a Microsoft-signed binary beaconing to a *.azurefd.net host — both of which are on most organisations'' trust lists.
The incident also raises governance questions around Microsoft Store vetting and the provenance of first-party generative-AI tooling. The signer (Yaoyao Chang, Microsoft GenAI Research Labs, Beijing) is a legitimate Microsoft developer identity, suggesting the issue is an internal governance and transparency failure rather than a compromised certificate or counterfeit store listing. No privacy disclosure, EULA clause, or Store manifest declared the screenshot/clipboard/microphone capture behaviours. Enterprise defenders must treat Vibing.exe as data-exfiltration software regardless of its provenance until Microsoft issues an authoritative statement, signed-binary revocation, or Store takedown, and must apply compensating controls at the network and process-behavioural layers.
Weaknesses (CWE)
CWE-359, CWE-1357, CWE-506, CWE-829
Target sectors: government, financial, healthcare, legal, technology, defense, education, enterprise-general
Target regions: Global, North America, Europe, Asia-Pacific
Detections & IOCs
As of 2026-07-20, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 15 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
SUPPLY_CHAIN, HIGH, threat intelligence, cybersecurity, T1195, T1195.002, T1204.002, T1547.001, T1553.002, T1036.005, T1010, T1082, T1113, T1123