Loading story…
Mandiant reported that attackers combined SIM swapping with abuse of the Microsoft Azure Serial Console to gain access to cloud-hosted environments. The activity showed how control of a victim’s phone number can be used to intercept authentication flows and support broader account takeover, while Azure’s serial console capability provided a path to interact directly with virtual machines and maintain access during the intrusion.
The incident highlights a blended attack chain that moved from telecom-layer compromise into cloud infrastructure abuse. By pairing identity takeover techniques with legitimate administrative features in Azure, the attackers were able to escalate the impact of SIM swapping beyond consumer account fraud and into enterprise cloud operations, underscoring the need to harden MFA recovery processes, tightly restrict serial console access, and monitor for unusual use of privileged cloud management functions.
Get the infrastructure and lures behind it.
1 event from the most recent confirmed update back to the earliest known activity.
Mandiant published research describing an attack chain involving SIM swapping and abuse of the Microsoft Azure Serial Console. The reference indicates public disclosure of the campaign and its techniques, but provides no additional dated milestones in the supplied content.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers documented multiple ways attackers can hide command-and-control and data theft inside legitimate Microsoft Azure services, highlighting how trusted cloud traffic can mask malicious activity. One proof-of-concept showed Azure DevOps REST APIs being used without exploiting any software flaw: Windows malware authenticated with a Personal Access Token, queried `dev.azure.com`, created work items, and stored host data in task fields over HTTPS. The technique requires no attacker-owned infrastructure, blends into normal enterprise traffic, and can leave exfiltrated data preserved in Azure DevOps records until removed; the sample also reportedly avoided detection in sandbox testing. A separate investigation tied the same cloud-abuse theme to real-world banking malware in Brazil, where a phishing campaign delivered the **AllaSenha** trojan through invoice-themed lures, malicious `.lnk` files, PowerShell and Python stages, and an in-memory Delphi loader. The malware used a DGA to reach Azure-hosted endpoints under `*.brazilsouth.cloudapp.azure[.]com` over raw TCP, then deployed a final payload that stole Brazilian banking credentials and 2FA material, including tokens and QR codes, while using operator-driven overlays to hijack authentication flows. The reporting underscores that Azure infrastructure is being used both experimentally and operationally as a stealthy channel for malware staging, C2, and exfiltration.
Aug 14, 2026
Microsoft reported that **Storm-2949** used social engineering and abuse of Microsoft **Self-Service Password Reset (SSPR)** to compromise multiple **Microsoft Entra ID** accounts, including accounts tied to IT staff and senior leadership, then expanded access across **Microsoft 365** and **Azure**. After the initial identity takeover, the actor conducted tenant discovery through the **Microsoft Graph API**, exfiltrated data from **OneDrive** and **SharePoint**, and sought persistence by re-registering MFA methods and attempting to abuse service principal credentials. The intrusion then moved deeper into Azure, where Storm-2949 relied on legitimate management-plane operations and privileged **Azure RBAC** roles to access **App Services**, **Key Vault**, **SQL databases**, **Storage accounts**, and **virtual machines**. Microsoft said the actor used publish profiles, Key Vault permission changes, SQL firewall rule modifications, storage key listing, **VMAccess**, and **Run Command** to harvest credentials, execute code, deploy **ScreenConnect** on VMs, weaken Microsoft Defender Antivirus, and exfiltrate large volumes of data while blending into normal administrative activity; the group also cleared event logs and deleted artifacts to hinder detection.
Jun 29, 2026
**Scattered Spider**—also tracked as `UNC3944`, `0ktapus`, `Muddled Libra`, and `Scatter Swine`—has broadened its operations from telecom-focused credential theft and SIM swapping into ransomware, extortion, and cloud-centric intrusions across hospitality, retail, media, financial services, BPOs, and parts of critical infrastructure. Reporting links the group to major incidents involving **Twilio**, **Okta** customers, **Coinbase**, **Reddit**, **Riot Games**, **Ubiquiti**, and **MGM Resorts**, where attackers used convincing phone calls, SMS phishing, MFA fatigue, and IT help-desk impersonation to steal credentials and gain privileged access. Researchers say the group routinely abuses legitimate remote administration tools including **AnyDesk**, **LogMeIn**, and **ConnectWise Control**, while also using malware such as **POORTRY** and **STONESTOP** to disable security controls and maintain access across **Azure**, **Microsoft 365**, **Google Workspace**, **AWS**, **Windows**, and **Linux** environments. Defenders have been urged to audit and restrict remote access software, review logs for unauthorized execution, harden MFA enrollment and help-desk identity verification, and monitor for in-memory loading, suspicious MFA registration, and data exfiltration activity tied to the group’s tradecraft.
Aug 15, 2026