The Storm-2949 campaign shows how identity recovery workflows can become an attack path when social engineering is added to the mix. According to the report, attackers abused Microsoft Entra ID Self-Service Password Reset by initiating a reset for targeted employees and then impersonating IT support to trick victims into approving MFA prompts. Once successful, they reset the password, removed MFA controls, enrolled Microsoft Authenticator on their own device, and took over the account.

This is especially dangerous because the targets included privileged users such as IT staff and senior leadership. After compromise, the attackers used Microsoft Graph API and custom Python scripts to enumerate users, roles, applications, service principals, and persistence opportunities. They then accessed OneDrive and SharePoint to search for VPN configurations, IT operational files, and other data useful for moving from Microsoft 365 into the wider enterprise environment. 

The attack did not stop at mailbox or file theft. Storm-2949 also pivoted into Azure production environments, targeting virtual machines, storage accounts, Key Vaults, App Services, and SQL databases. The report notes that attackers modified Key Vault access settings, stole secrets such as database credentials and connection strings, changed firewall rules, retrieved storage keys and SAS tokens, abused VM management features, and later deployed ScreenConnect while attempting to disable Microsoft Defender and wipe evidence. 

Organizations should treat SSPR and MFA enrollment as high-risk identity events, not routine helpdesk plumbing. Administrators should enforce phishing-resistant MFA for privileged users, restrict who can reset passwords and modify MFA methods, monitor MFA changes and SSPR activity, apply least privilege to Azure RBAC roles, protect Key Vault access, retain logs for investigation, and alert on suspicious Azure management operations. A password reset flow should recover accounts, not become a cloud takeover ceremony with better branding. 

The larger lesson is simple: identity is now the control plane for the enterprise. If attackers can manipulate users into approving recovery or MFA changes, they can bypass many traditional defenses without exploiting a software vulnerability. Security teams must harden not only login, but also account recovery, MFA registration, admin role assignment, SaaS access, and cloud resource permissions. Because apparently “forgot password” has evolved from a convenience feature into a board-level risk, which feels about right for 2026.

A threat actor targeting Microsoft 365 and Azure production environments is stealing data in attacks that abuse legitimate applications and administration features. [...]

Source: Microsoft Self-Service Password Reset abused in Azure data theft attacks via Bleeping Computer — published 19 May 2026.