Case storm-3168-agentic-azure-attacksAI-assisted malwareWorldwide
Storm-3168 runs agentic Azure attacks via compromised service principals
Microsoft attributes agentic-driven Azure reconnaissance, resource deletion and credential access with compromised service principals to Storm-3168, linked to JADEPUFFER.
HighAttack using AIStatus: OngoingVerified case file
Open in the interactive mapCite this case
- Reported
- Oct 15, 2026
- Location
- Worldwide
- Target
- Azure cloud tenants
- Severity
- High
- Triggered by
- Storm-3168 (JADEPUFFER-linked)
- Actor type
- Unknown
- Sector
- Unknown
- Reported loss
- None reported
- CVE
- None
What happened
Microsoft attributes agentic-driven Azure reconnaissance, resource deletion and credential access with compromised service principals to Storm-3168, linked to JADEPUFFER.
Impact: Azure reconnaissance, resource deletion and credential access; victim count not stated.
Who triggered it
Actor: Storm-3168 (JADEPUFFER-linked)
Attribution: Microsoft identifies the activity as Storm-3168 and associates it with JADEPUFFER.
Motive: Unknown
How it happened
Attack vector: Compromised Azure service principals driving agentic reconnaissance and actions.
Root cause: Compromised service principal credentials; how they were obtained is not stated.
Timeline
- Reported by Microsoft Security Blog
Response
Microsoft published defender guidance.
Current status: Ongoing
Sources (open in a new tab)
- Microsoft Security Blog microsoft.com
Cite this case
Storm-3168 runs agentic Azure attacks via compromised service principals. AI Threat Watch, case storm-3168-agentic-azure-attacks, Oct 15, 2026. https://aithreat.io/cases/storm-3168-agentic-azure-attacks/
Permanent link: https://aithreat.io/cases/storm-3168-agentic-azure-attacks/