aviatrix logoAviatrix
Under Active Attack

Executive Summary

Between May and September 2026, threat actors including Storm-3121 and Storm-3032 conducted sophisticated social engineering campaigns targeting Microsoft cloud environments. The attacks involved AI-assisted executive impersonation for invoice fraud, sending over one million scam emails in August 2026, and passkey-themed phishing operations. Attackers impersonated IT help desk personnel to trick employees into updating authentication methods through fraudulent websites, enabling adversary-in-the-middle attacks and device code authentication bypasses. Once successful, threat actors established persistent access by registering their own MFA methods and conducted extensive data exfiltration through Microsoft Graph API abuse, SharePoint downloads, and mailbox collection. This incident demonstrates the evolution of identity-focused attacks targeting cloud infrastructure and the increasing sophistication of social engineering tactics combined with legitimate cloud service abuse.

Why This Matters Now

This attack pattern represents a critical shift toward identity-focused cloud compromise at scale, exploiting the widespread adoption of passkey authentication and remote work dependencies on cloud services, requiring immediate reassessment of identity verification processes.

Attack Path Analysis

MITRE ATT&CK® Techniques

Potential Compliance Exposure

Sector Implications

Sources

Frequently Asked Questions

Attackers used social engineering to trick users into granting access through device code authentication flows and then registered their own phone numbers or authenticator apps as additional MFA methods.

Cloud Native Security Fabric Mitigations and ControlsCNSF

Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.

Aviatrix Zero Trust CNSF would likely constrain the Microsoft cloud breach by enforcing segmented access controls and restricting lateral movement paths. The attack's blast radius across SharePoint, OneDrive, and Exchange services would likely be reduced through identity-aware access controls and controlled egress enforcement.

Initial Compromise

Control: Cloud Native Security Fabric (CNSF)

Mitigation: Zero Trust CNSF may constrain the scope of initial cloud service access by enforcing identity-aware routing and workload isolation, potentially limiting which Microsoft cloud resources become immediately available to compromised credentials.

Privilege Escalation

Control: Zero Trust Segmentation

Mitigation: Zero Trust segmentation could limit the privileges and access scope available to compromised accounts, potentially constraining the attacker's ability to expand permissions across multiple Microsoft cloud services and administrative functions.

Lateral Movement

Control: East-West Traffic Security

Mitigation: East-west traffic controls would likely constrain lateral movement between Microsoft cloud services by restricting cross-service API communications and limiting the reachability of Graph API enumeration across SharePoint, OneDrive, and Exchange resources.

Command & Control

Control: Multicloud Visibility & Control

Mitigation: Multicloud visibility controls may constrain command and control communications by providing enhanced monitoring of Graph API usage patterns and restricting the network paths available for rotating infrastructure across authentication and reconnaissance activities.

Exfiltration

Control: Egress Security & Policy Enforcement

Mitigation: Egress security controls would likely constrain high-volume data exfiltration by enforcing controlled outbound paths and data transfer policies that limit the scope and rate of REST API data collection activities across Microsoft cloud services.

Impact (Mitigations)

The overall impact scope would likely be reduced through constrained access paths and limited blast radius, though some exposure of accessible data within segmented boundaries may still occur despite Zero Trust controls.

Impact at a Glance

Affected Business Functions

  • Email Communications
  • Financial Operations
  • Data Management
  • Identity and Access Management
Operational Disruption

Estimated downtime: 3 days

Financial Impact

Estimated loss: $250,000

Data Exposure

Compromise of Microsoft cloud accounts leading to exfiltration of SharePoint and OneDrive business documents, Exchange mailbox contents including emails and attachments, and potential access to sensitive corporate communications and financial records across multiple enterprise organizations

Recommended Actions

  • • Implement Zero Trust Segmentation with identity-based policies to prevent unauthorized cross-service access even with compromised credentials
  • • Deploy Multicloud Visibility & Control capabilities to detect anomalous Microsoft Graph API usage patterns and high-volume data access behaviors
  • • Establish Egress Security & Policy Enforcement to monitor and control outbound data transfers from cloud services to unauthorized destinations
  • • Enable Threat Detection & Anomaly Response systems to baseline normal user behavior and alert on suspicious authentication patterns and MFA enrollment activities
  • • Strengthen Cloud Native Security Fabric (CNSF) controls to provide real-time inspection and policy enforcement across all cloud service interactions and API calls

Secure the Paths Between Cloud Workloads

A cloud-native security fabric that enforces Zero Trust across workload communication—reducing attack paths, compliance risk, and operational complexity.

Stop Advanced ThreatsGet a Free Workload Attack Path AssessmentUnder Active Attack?
Cta pattren Image