Windows Defender stopped a massive malware distribution campaign that attempted to infect over 400,000 users with a cryptocurrency miner during a 12-hour period on March 6, 2018. Microsoft attributes the detections to computers infected with the Dofoil malware, a popular malware downloader. Windows Defender AV blocked more than 80,000 instances of several sophisticated trojans that exhibited advanced cross-process injection techniques, persistence mechanisms, and evasion methods. Microsoft credits the immediate discovery of this trojan to its behavior-based and cloud-powered machine learning models included with Windows Defender.
Source: https://www.bleepingcomputer.com/news/security/microsoft-stops-malware-campaign-that-tried-to-infect-400-000-users-in-12-hours/