🕵️ RESEARCH & DEEP DIVES
JADEPUFFER (Storm-3168) Used Compromised Azure Service Principals to Delete Cloud Resources
Microsoft tracked the JADEPUFFER threat actor (Storm-3168) using compromised Azure service principals to carry out destructive, ransomware-aligned deletion of Azure resources.- Applies to Microsoft Azure customers; targeted resources included Storage Accounts, SQL databases, Key Vaults, Function Apps, VMs, App Services, and recovery protection locks.
- Attack occurred in early June 2026 over ~18 hours; one service principal performed reconnaissance (~300 read operations over 16 hours), the second executed destruction and credential collection.
- The destructive phase lasted ~7 minutes with over 100 storage account deletion attempts, most of which succeeded; Azure SQL deletions failed due to an unsupported API version.
- The service principal credentials (client ID, secret, tenant ID) had been exposed in plaintext in a public GitHub issue and remained accessible via edit history; activity is likely automated.
- Microsoft assesses the goal was ransomware-aligned, impairing recovery by deleting backups, though no ransom note or data exfiltration was observed.
New RSA signature forgery attack bypasses factoring, cutting 1024-bit key security to 2^65
Researchers demonstrated a practical RSA signature forgery attack that works without factoring the key, drastically lowering RSA's estimated security levels.- Affects RSA digital signatures, particularly blind-signature (textbook) RSA implementations such as Privacy Pass, used by Apple and Cloudflare; RSA with PKCS or PSS padding is not practically threatened.
- The attack forges signatures without recovering the private key, using a variant of the 2007 special number field sieve algorithm combined with an oracle.
- Forging a 1024-bit RSA signature took 1,380 CPU core-years (about five real-world months) and 2^65 operations, versus an estimated 2^80 operations and 500,000 to 1 million core-years for factoring.
- The attack drops estimated security to 2^65, 2^90, and 2^119 for 1024-, 2048-, and 4096-bit keys respectively, below the required 128-bit level.
- An attack on Privacy Pass would require requesting 2^43 tokens from a provider like Cloudflare or Apple; regular key rotation reduces but doesn't eliminate the risk.
Wiz: Infostealers harvest cloud, code, and AI credentials to bypass hardened perimeters
Wiz reports infostealer malware is stealing cloud, source-control, and AI credentials from developer devices to give attackers direct access to corporate cloud environments.- Applies to organizations using AWS, Azure, Google Cloud, GitHub/GitLab, and AI platforms whose developers' endpoints hold credentials and session tokens.
- AWS secrets made up 46% of compromised secrets, Google Cloud 13%, GitHub tokens ~10%, and AI platform secrets 5%, per Wiz's analysis of infected systems.
- Lumma C2, RedLine, and Vidar accounted for 85.7% of detected infostealer incidents.
- Infection arrives via phishing, deceptive downloads, or poisoned software dependencies; stolen browser session tokens can be replayed to bypass MFA.
- Attackers target local credential stores like ~/.aws/credentials, Azure msal caches, gcloud token databases, SSH keys, and GitHub session cookies; access is resold by initial-access brokers.
- IOCs include abused files vbc.exe, Roblox.exe, and SkinChanger.exe, plus targeted paths ~/.aws/sso/cache/, .azure/accessTokens.json, and ~/.config/gcloud/.
Sources 📄 Source: wiz.io · 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News, cryptika.com (discovered)
🔓 CVEs & KEV
- CVE-2026-32740 — Struktur Libheif — CVSS 8.8 — RCE in a PIE Next.js sharp/libheif Stack