Long before the internet became a place we carried in our pockets, before social media transformed identity into an interface and before artificial intelligence entered everyday conversation, William ...

Long before the internet became a place we carried in our pockets, before social media transformed identity into an interface and before artificial intelligence entered everyday conversation, William ...

Jadepuffer, an autonomous AI attacker first identified in July, has expanded into Azure environments, using compromised digital identities to enumerate resources, delete cloud assets and collect other credentials, according to Microsoft. The activity includes “extensive Azure-focused resource destruction activity using compromised service principals and cloud credential collection that could be used to facilitate future exfiltration,” Microsoft said in a blog post about Storm-3168, also known as Jadepuffer. Service principals are unique machine identities given to applications running within Azure. “The destructive operations were facilitated by compromising service principals and targeted Azure Storage Accounts, SQL databases, Key Vaults, Function Apps, recovery protection locks, Virtual Machines, and App Services,” Microsoft said in the blog post, “Storm-3168: Agentic-driven cloud attacks using compromised service principals.” The campaign was first reported in July by Sysdig, which described Jadepuffer as an AI-driven operation capable of executing attack steps autonomously, including exploitation, credential access and destructive activity. ## Two identities, split roles Microsoft said it observed two compromised service principals in the same tenant, with one performing reconnaissance and the other carrying out discovery, destructive actions and credential collection. One of the identities spent more than 15 hours enumerating virtual machines, subscriptions, resource groups and other resources, making more than 300 successful read operations, the company said. A second service principal enumerated resources across multiple subscriptions within seconds and later conducted additional discovery, Microsoft said. The timing and division of activity “strongly indicates automated or scripted execution,” the company said. Nick Tausek, lead security automation architect at Swimlane, said the pattern aligns with earlier observations of the campaign’s behavior. “Jadepuffer’s earlier database attack showed an AI agent working through an extortion playbook and adjusting when steps failed,” Tausek said. “Microsoft now traces the group into Azure, where compromised service principals mapped resources before a seven-minute burst of destruction.” ## Destructive sequence lasted minutes After the two agents had completed their reconnaissance they began to create mayhem, conducting more than 150 destructive or credential-related operations over about 35 minutes. The main destructive sequence lasted about seven minutes and included more than 100 attempts to delete storage accounts, most of which were successful, the blog post said. The attackers also deleted an Azure Key Vault, Function App and App Service plan tied to the same resource group, Microsoft said. Attempts were also made to delete Azure SQL databases and backup-related protections, including Azure Site Recovery locks and backup protection locks, the company said. Tausek said the speed and coordination of the activity could challenge traditional response models. “At that speed, an AI SOC needs to connect identity activity with cloud changes before the damage spreads,” he said. ## Credential access followed destruction About 30 minutes after the destructive activity, the same service principal requested storage account access keys, making more than 30 successful ListKeys requests, Microsoft said. The requests included storage accounts associated with recovery services, the blog post said. Microsoft said the combination of resource deletion, attempts to interfere with recovery mechanisms and credential collection is “consistent with tactics that can support ransomware and extortion operations.” The company said it did not observe a ransom note or confirm data exfiltration in the activity. Ross Filipek, CISO at Corsica Technologies, said the sequence of destruction followed by credential access raises additional response challenges. “The recovery question here goes beyond rebuilding what was deleted,” Filipek said. “The attackers later requested storage account keys, potentially giving them another route to data.” “Responders need to establish which identities and keys were touched, then review their use before trusting restored services,” he said. ## Possible credential exposure Microsoft said it could not confirm the initial access vector but found that credentials associated with a compromised service principal had previously been exposed in plaintext in a public GitHub issue. The secret was later removed but remained accessible in the edit history, the company said. “Publicly exposed credentials remain usable until revoked or rotated; removing the original disclosure alone does not remediate the exposure,” Microsoft said. Filipek said the finding highlights a common risk in cloud environments. “A cloud credential remained visible in a GitHub issue’s edit history after someone removed it from the post,” he said. “For an IT team, it’s a useful warning about how a routine cleanup can leave an account exposed.” “Once attackers hold an application identity, their activity can look like ordinary cloud administration,” he said. ## Focus on automation and scale Microsoft said the activity reflects “a broader shift toward AI-orchestrated attacks,” where threat actors can coordinate operations across cloud environments with “greater speed and scale.” Tausek said the Azure activity shows coordinated execution, though not necessarily proof that each step was directed by AI. “I agree with Microsoft’s warning about AI-orchestrated attacks, though the Azure evidence shows coordinated automation rather than proving AI directed each step,” he said. “Agentic AI can help analysts piece together that sequence and prepare containment while people approve the consequential actions,” he added. ## Identity and recovery controls in focus Microsoft recommended that organizations protect workload identities, enforce least-privilege access and secure backup and recovery resources to reduce risk from similar activity. Tausek said organizations can reduce exposure by rotating exposed secrets, limiting service principal permissions and protecting backup systems before attackers gain access. Filipek said response planning across teams is also critical. “That takes coordination between development, cloud operations and incident response,” he said. “If those teams wait until an outage to work out who owns the credentials, they’ll lose valuable time.”

People have become servants to social media. The ultimate flex is to walk back to real life

Civics of Technology Announcements Library Community: We’re building a CoT community for those involved with or interested in libraries. Andrea Baer is leading this effort and if you’re interested...

Curate Feeds | Make Collections | Customize Email Briefs

Curate Feeds | Make Collections | Customize Email Briefs

The second full-length album from pixelgrinder stares directly into the artificial identities, technological dependency, and increasingly blurred boundary between humanity and the digital world. The Mask Is Online pixelgrinder has released White Mask, a 12-track descent into modern internet culture and the increasingly cyberpunk reality forming around us. At the center of the album is the “white mask” itself — a representation of the fictitious versions of ourselves we construct online.

The article explores the increasing dominance of digital identities over real-world experiences, arguing that social media has transformed from a casual hobby into a demanding, all-consuming aspect of modern life. The author uses the metaphor of a 'garden' to describe how users cultivate their online presence, initially as a fun activity but gradually becoming a source of anxiety and self-worth tied to metrics like follower counts and engagement. As people spend more time tending to their digital gardens, they increasingly neglect the physical world, with the average user spending over two hours daily on social media platforms. The piece highlights how this shift has created a 'serf culture' where individuals feel compelled to constantly monitor and optimize their online personas, leading to diminished attention spans, emotional instability, and a loss of authentic social connections. The author notes that brand strategists and trend forecasters are now identifying 'privacy and a low or no digital footprint' as the new markers of status in 2026, suggesting a potential cultural shift toward valuing offline life. The article concludes that the ultimate 'flex' will be walking away from social media and returning to real-world experiences, emphasizing that true status comes from living fully in the physical world rather than curating a digital persona. This perspective challenges the current social media-driven culture that equates online validation with personal worth, suggesting a need for a broader cultural reckoning with technology's role in shaping identity and community.

People have become servants to social media. The ultimate flex is to walk back to real life

Google could block Russian app installations on Android, according to Russia's Ministry of Digital Development. While no definitive decision has been made against Russia, a potential risk emerges from Google's new developer verification system, which could grant the tech giant the power to restrict app installations. Developer Verification Program Creates Potential for Control The new initiative, dubbed Android Developer Verification, requires developers to confirm their identities and register their applications. Crucially, this verification extends beyond apps available on Google Play. It can also encompass applications installed by users from third-party stores or directly from APK files. These new regulations are being rolled out incrementally. Starting September 30, 2026, the program will be implemented in Brazil, Indonesia, Singapore, and Thailand. Google intends to expand its reach thereafter. Russia has not been singled out as a country facing specific developer restrictions at this time.

Why Socure? Socure is building the identity trust infrastructure for the digital economy — verifying 100% of good identities in real time and stopping fraud...

Oracle Health and ID.me have announced a partnership aimed at simplifying secure access to health data through verified digital identities for patients and providers.

The NULL Protocol by Paul Van den Brande