Microsoft Self-Service Password Reset abused in Azure data theft attacks

Microsoft reports that the actor Storm-2949 used social engineering to hijack privileged Microsoft Entra accounts, abused SSPR/MFA flows and enrolled authenticators, then used Microsoft Graph, custom Python scripts, and Azure RBAC abuse to enumerate resources, exfiltrate OneDrive/SharePoint data, steal Key Vault secrets and storage credentials, and deploy remote access tooling to persist and remove evidence.