Microsoft's May 2026 research into Storm-2949 describes an attack chain that began with targeted social engineering and moved into Microsoft Entra ID, Microsoft 365 and Azure resources.
The important lesson is that attackers do not always need to break through a technical perimeter.
They can start by convincing a legitimate user to complete an authentication action.
The investigation described abuse of the Self-Service Password Reset process and social engineering around multifactor authentication.
Once the identity was compromised, the attackers could move into cloud services and search for additional information and access.
This is why account recovery mechanisms deserve the same security attention as passwords.
Users should be suspicious of unexpected password-reset requests and MFA prompts. Organisations should monitor unusual password-reset activity and authentication changes.
A secure cloud environment is ultimately dependent on secure identities.