JadePuffer AI Actor Compromises Azure Tenant in Destructive Cloud Attack

Microsoft attributed an early-June attack to JadePuffer (Storm-3168) in which two compromised Azure service principals conducted lengthy reconnaissance and then rapidly executed automated destructive actions—deleting storage accounts, a Key Vault, Function App, and App Service plan—and attempted to retrieve storage account keys. The activity aligns with ransomware/extortion tactics and highlights risks from exposed credentials (one set was previously leaked via a GitHub issue) and the potential for agentic AI to orchestrate fast, large-scale cloud sabotage; Microsoft recommended credential hygiene, least-privilege, Defender for Cloud protections, and rapid rotation of exposed credentials.