Cloudanix Zero.

cloud

Microsoft Azure: security advisories, deprecations and releases

Microsoft's public cloud.

Get Microsoft Azure alerts Free. No account. One email, and only when something touches your stack.
Items, 90 days
57
Critical
2
Last critical
12 days ago
This week
7

What your digest would have held this week

7 items from the last 7 days. Zero sends only the ones that touch your stack.

Security 9

  • HIGH NEW THIS WEEK Google Cloud Blog · 2 Nov 2026

    LLMJacking: threat actors monetize hijacked cloud LLM resources

    Mandiant details LLMJacking campaigns where attackers steal cloud IAM tokens and LLM API keys, then run expensive inference workloads that can rack up six-figure bills in hours.

    CVE-2026-40217

  • CRITICAL Cloudanix Threat Intelligence · 22 Oct 2026

    SafePay Ransomware

    The SafePay ransomware group has been highly active since August 2024, targeting businesses and critical infrastructure across multiple continents. The actors gain initial access through credential theft, brute force attacks, phishing, and exploiting vulnerabilities in public-facing applications and VPNs. Post-compromise, they use living-off-the-land (LOTL) techniques with tools like PsExec and PowerShell for lateral movement and persistence. The group exfiltrates data…

    CVE-2020-3259 CVE-2023-20269 CVE-2023-27532 CVE-2024-40711 CVE-2024-40766

  • MEDIUM Cloudanix Threat Intelligence · 15 Oct 2026

    Phishing Infrastructure Ecosystem (Storm-3119, Storm-2990)

    Microsoft uncovered a Chinese-language cybercriminal ecosystem centered around the YAM Store (Storm-3119), an initial access broker selling compromised Microsoft and Google cloud environments. This infrastructure is used by phishing kit developers tracked as Storm-2990, who create and sell Phishing-as-a-Service (PaaS) products like CoGUI, Haozi, and Iron Man System. These kits facilitate large-scale phishing campaigns via email and SMS, targeting credentials…

  • MEDIUM Cloudanix Threat Intelligence · 2 Oct 2026

    Storm-3068

    The threat actor Storm-3068 initiated an attack by compromising a user account through a self-service password reset process. After gaining control of the identity by registering their own authentication methods, the actor pivoted to Azure DevOps. They used legitimate administrative tools and scripts to enumerate repositories and pipelines. The actor then modified development pipelines to harvest Kubernetes credentials (kubeconfig files)…

  • MEDIUM Cloudanix Threat Intelligence · 2 Oct 2026

    JadePuffer

    The JadePuffer ransomware operator is conducting agent-driven attacks against Microsoft Azure environments. The campaign involves multiple stages including reconnaissance of the tenant, credential theft, and the ultimate destruction of core cloud components as part of its ransomware strategy.

  • MEDIUM Cloudanix Threat Intelligence · 2 Oct 2026

    JADEPUFFER / Storm-3168

    The threat actor known as JADEPUFFER, also tracked by Microsoft as Storm-3168, has been observed conducting destructive operations within Microsoft Azure environments. An attack in early June 2026, lasting approximately 18 hours, utilized compromised service principals, representing an evolution in the actor's tradecraft.

  • MEDIUM Cloudanix Threat Intelligence · 2 Oct 2026

    Storm-3168

    Threat actor Storm-3168 (also known as JADEPUFFER) conducted extensive, destructive attacks against an Azure environment using compromised service principals. The initial compromise likely stemmed from credentials exposed on a public GitHub repository. The actor performed broad reconnaissance before executing a rapid, seven-minute destructive sequence, deleting Azure Storage Accounts, Key Vaults, Function Apps, and App Services. The campaign also involved attempts…

  • MEDIUM Cloudanix Threat Intelligence · 2 Oct 2026

    EvilTokens

    EvilTokens is a Phishing-as-a-Service (PhaaS) platform that emerged in February 2026, operated by the threat actor Storm-2992. It leverages AI to create tailored phishing lures and automates device code phishing attacks to steal OAuth tokens, bypassing MFA. This has led to the compromise of over 12,000 inboxes across 10,000 organizations. Post-compromise, the platform facilitates reconnaissance via Microsoft Graph, persistence through…

  • CRITICAL Cloudanix Threat Intelligence · 2 Oct 2026

    NightEagle

    The NightEagle group (APT-Q-95), active since at least 2023, has expanded its targeting from Asia to include Russian organizations. The campaign involves initial access via compromised VPN credentials, followed by the deployment of the GhostContainer backdoor on Microsoft Exchange servers. This backdoor, built from open-source tools, facilitates C2 communication and evades AMSI/ETW. For lateral movement and persistence, the attackers use…

    CVE-2019-0708 CVE-2020-0688

Deprecations 6

Releases 37

News and tools 5

Only hear about Microsoft Azure when it touches your stack

Tell Zero what you run. You get one email, and only on the days something above applies to you.

Get Microsoft Azure alerts