Microsoft Azure Tenant Compromised in Destructive Cloud Attack by Agentic AI Attacker
A devastating cloud attack, attributed to the agentic threat actor JadePuffer, has compromised a Microsoft Azure tenant and potentially left hundreds of organizations vulnerable. In what appears to be a ransomware or extortion operation, the attacker used exposed credentials to access resources and delete cloud-based storage, applications, and databases within minutes.
According to Microsoft’s Security Research team, JadePuffer compromised two legitimate service principals in early June, which are essentially digital identities that grant access to Azure resources. One of these principals spent over 15 hours mapping virtual machines, subscriptions, resource groups, and other resources, while the other handled destructive operations and credential collection. The attacker’s reconnaissance phase was surprisingly thorough, with over 300 successful read operations conducted before launching a highly automated destruction campaign.
The attack is consistent with tactics that support ransomware and extortion operations, but what sets it apart is its use of large language model (LLM)-driven technology to carry out the attacks. JadePuffer’s ability to map the victim’s environment in such detail raises concerns about the potential for similar attacks in the future.
Microsoft suspects that the attacker initially compromised the service principal by exploiting exposed credentials, which were previously stored in plaintext on a public GitHub issue. Although the employee who exposed the secret later edited the issue, the information remained accessible through its public edit history. This incident highlights the importance of secure credential management and the need for organizations to regularly review their cloud security configurations.
The attack has significant implications for Azure users, as it demonstrates the potential for even highly automated attacks to cause widespread destruction in a matter of minutes. “Once attackers hold an application identity, their activity can look like ordinary cloud administration,” observes Ross Filipek, chief information security officer at Corsica Technologies. This warning underscores the importance of robust cloud security measures and regular auditing to prevent similar incidents.
As a result of this attack, organizations using Azure are advised to review their cloud security configurations, ensure that sensitive credentials are stored securely, and regularly monitor their accounts for suspicious activity. Additionally, users should be aware of potential risks associated with exposed secrets in public repositories like GitHub and take steps to mitigate these vulnerabilities. By staying vigilant and proactive in securing their cloud environments, organizations can minimize the risk of falling victim to similar attacks in the future.
Source: Dark Reading — 2026-09-28