JadePuffer AI attacks target Azure tenants, wipe cloud resources

🚨 ACTIVE EXPLOITATION

• JadePuffer agentic AI attacks target Azure tenants, wipe storage and cloud resources
  Microsoft observed the JadePuffer ransomware actor (Storm-3168) using compromised Azure service principals to conduct AI-driven reconnaissance and destructive attacks on Azure cloud resources.
  • Applies to Azure customers; targeted resources include Storage accounts, Key Vaults, Function Apps, VMs, App Services, and Azure SQL databases.
  • Two compromised service principals in one tenant were abused: one for reconnaissance (15+ hours, 300+ read operations), the other for destruction and credential collection.
  • Destructive stage lasted seven minutes with 100+ attempts to delete storage accounts, plus removal of Azure Site Recovery locks to hinder restoration.
  • A service principal's client ID, secret, and tenant ID were exposed in plaintext in a public GitHub issue; initial access method unconfirmed.
  • JadePuffer-linked infrastructure has been probing Azure App Services via WordPress admin, PHP-CGI, and LangFlow's /api/v1/validate/code endpoint since the start of the year.
  Sources 📎 Coverage: darkreading.com · 👁 via BleepingComputer, Dark Reading

💥 BREACHES & INCIDENTS

• Chrome Web Store 'Poper Blocker' Extension Is Spyware With Millions of Users
  Researchers found the popular Chrome ad-blocker 'Poper Blocker' is spyware that exfiltrates sensitive user data while carrying Google's Featured badge.
  • Affects Chrome users: Poper Blocker claims 2 million+ active users, a 4.8-star rating from 81,000+ reviewers, and a 'Featured' badge plus 'Established Publisher' status on the Chrome Web Store.
  • The extension exfiltrates full browsing histories, page screenshots, approximate locations, cross-device IDs, and Claude, ChatGPT, and Gemini chat histories including prompts, answers, and model/subscription details.
  • It sells user data to third parties and uses deceptive design patterns to discourage opting out of data sharing.
  • It hides malicious functionality by downloading instructions from a C2 server, waits 24 hours before activating, obfuscates and encodes payloads, detects sandboxes, and can rotate its C2 domain — despite Manifest V3 restrictions.
  • Developer Big Star Labs was flagged for spyware in 2018; three of its apps — Poper Blocker, CrxMouse, and BlockSite — remain live with nearly 4 million combined Chrome users, and Google reportedly took no action after a May 2026 report.
  Sources 📎 Coverage: darkreading.com · 👁 via Dark Reading

🔓 CVEs & KEV

• CVE-2026-88804 — SUSE Rancher — CVSS 9.6 — Unauthenticated update of public UI settings leading to stored cross-site scr...

• CVE-2026-12342 — SailPoint Technologies IdentityIQ — CVSS 9.6 — SailPoint IdentityIQ Improper Form Validation VulnerabilityThis vulnerability...

• CVE-2026-86102 — WatchGuard AP — CVSS 9.3 — WatchGuard AP Command Injection in Internal Management API Allows Command Exe...

• CVE-2026-101891 — WatchGuard AP — CVSS 9.3 — WatchGuard AP Improper Access Control in API Service Allows Unauthenticated A...

• CVE-2026-101894 — XhmikosR decompress — CVSS 9.1 — @xhmikosr/decompress: Path traversal via symlink chainThe decompress package ...

• CVE-2026-87969 — WatchGuard AP — CVSS 8.6 — WatchGuard AP Authenticated Command Injection in Diagnostic CLIAn OS command ...

• CVE-2026-88805 — SUSE Rancher — CVSS 8.1 — Session Not Revoked Server-Side on Logout in RancherIncorrect credential clea...

📋 ADVISORIES

• 📄 Source for Microsoft uncovers NeedyMantis, modular post-compromise malware enabling covert network access — microsoft.com