security: Storm-3168: Agentic-driven cloud attacks using compromised service principals
Microsoft Security Blog
2026-09-25
Microsoft describes Azure attacks linked to Storm-3168 using compromised service principals, including reconnaissance, resource deletion, and credential access. The post links the activity to JADEPUFFER and includes defender guidance.