JadePuffer (Storm-3168): An AI Agent Wiped 100+ Azure Storage Accounts in Seven Minutes

In early June 2026, an AI-driven operator tracked as JadePuffer (Microsoft: Storm-3168) used two compromised Azure service principals to map a tenant, then made 100+ storage account deletion attempts in about seven minutes. Most succeeded. There was no malware and no exploit inside Azure. Every action was a normal Azure Resource Manager call, allowed by roles the identities already held. We walk the full chain — the 16-hour recon window, the inherited RBAC that gave it the blast radius, and the only control that actually held.

SlashID Team
Threat Intelligence

Read the analysis →