we_are_coded.by CODE · The world, decoded
БГ
Microsoft

One stolen identity, one whole cloud breached

Microsoft Security · event date: 18 May 2026Security

Microsoft disclosed Storm-2949: the attacker takes over a single user through social engineering targeting a password reset and MFA. Then the attacker drains keys, files, and databases from the entire cloud.

In short
  • Microsoft disclosed Storm-2949: an attack that starts from one identity and reaches the entire cloud (May 18).
  • The method: social engineering targeting a password reset and MFA prompt, then the attacker registers their own device.
  • What got drained: files from OneDrive/SharePoint (incl. VPN configurations) and secrets from Azure Key Vault.
Checked on30 June 2026Responsible editorTsvetelin IvanovHow we workMethod · Corrections

One 'yes' on the phone. That's where the whole breach starts - the one Microsoft disclosed for the Storm-2949 group - from one compromised identity to a breach of the entire cloud: Microsoft 365, Azure, endpoint devices.

The method: the attacker starts a Self-Service Password Reset for the victim and, through social engineering (psychological manipulation, not hacking), convinces them to approve an MFA (extra login verification) prompt that looks legitimate. Then the attacker removes the existing factors and registers their own device for persistence. What got drained: files from OneDrive/SharePoint (incl. VPN configurations), secrets from Azure Key Vault (database connections, credentials), data from Storage and SQL, .pfx certificates with private keys. There is no CVE: the attacker takes over an identity through deception, not through a software flaw.

The real takeaway is different. There's no zero-day here, no brilliant exploit (a method for breaching a system). The cheapest way in is the human - one convinced 'yes' on an MFA prompt opens everything. The technology is solid. Persuasion just walks around it.

MFA isn't magic. Get someone to press 'approve' themselves, and the second factor falls. That's why defense stands on two floors - suspicion toward unexpected prompts, and a limit on how far one identity can reach if it falls anyway. The second one saves you when the first one doesn't work.

The visual is generated code art. No third-party images.
Follow usFacebookLinkedIn
Official primary sources
→Microsoft Security - Storm-2949
Original: https://wearecoded.com/en/articles/microsoft-storm-2949.html
ShareFacebookXLinkedInTelegramWhatsApp

More on this

Security
Security
MSRC Security Update Guide21 August 2026Vulnerabilities

Microsoft corrected its own field: the 10.0 hole in Entra ID was not exploited

On 20 August Microsoft announced a critical hole in Entra ID with the maximum score of 10.0 and noted in its record that it was being exploited. A day later it corrected the field. The patch is entirely on their side, and for customers there is nothing to do.

Read →
Security
CISA7 July 2026Vulnerability

A vulnerability in Adobe ColdFusion scored 10.0 is being actively exploited

CISA added CVE-2026-48282 to the Known Exploited Vulnerabilities catalog over evidence of active exploitation. NVD scores it 10.0 on CVSS - the maximum value. Federal agencies have until 10 July.

Read →
Security
OpenAI26 August 2026Agents and security

OpenAI's models built themselves a secret mailbox in the package server, and rode it into Hugging Face

On 26 August OpenAI published the full technical report on the July incident. An internal research model and its peers found each other, traded exploits through the package repository, and went from an exam task to administrator access inside another company in ten days. They call it a warning shot themselves.

Read →
← Back to all news