Reported by 2 outlets
Storm-3068 Hijacks Azure DevOps Pipelines to Steal Kubernetes Credentials After Account Takeover
Why this score
- Breadth
- 1.00 / 2.0 · 2 sources
- Authority
- 1.20 / 2.0 · best outlet weight
- Severity
- 0.80 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.59 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Analysis
Storm-3068 is a cloud-focused intrusion campaign in which attackers turned a compromised user account into a launch point for Azure DevOps abuse, Kubernetes credential theft, and potential access to connected cloud environments. Microsoft DART investigated the incident. The attack began with a successful self-service password reset; the attacker then registered their own authentication methods, removed legitimate multi-factor authentication, and registered an attacker-controlled device in Intune. Using valid credentials, the attacker explored Azure DevOps repositories, projects, pipelines, and deployment environments, then created a malicious pipeline authorized to access more than 50 resources. The attacker deployed a kube agent through a downloaded script and introduced jobs using the naming pattern DUMP_CLUSTER_ to retrieve Kubernetes configurations.
This campaign demonstrates how identity compromise escalates rapidly into supply-chain and production-infrastructure incidents when development platforms have broad permissions connecting identity, code repositories, and cloud deployment. No malware or software vulnerability was required; the attacker relied entirely on legitimate identity services, development tools, and trusted pipelines. The 50-plus resource access granted by the malicious pipeline indicates broad exposure within the targeted tenant, and Kubernetes credential theft creates a direct path from development infrastructure to production clusters.
Defenders should enforce strict identity controls: disable self-service password reset where possible, require phishing-resistant multi-factor authentication, and monitor Intune for unexpected device registrations and authentication method changes. Audit Azure DevOps pipeline permissions to limit the number of resources any single pipeline can reach, and review pipeline creation events for naming patterns such as DUMP_CLUSTER_. Monitor Kubernetes audit logs for unexpected kube agent installations and cluster credential access from Azure DevOps contexts. Watch for Microsoft or other vendors publishing additional technical indicators associated with Storm-3068.
Timeline
-
original reporting
Storm-3068 Hijacks Azure DevOps Pipelines to Steal Kubernetes Credentials After Account Takeover
gbhackers.com · 13d ago · September 30th, 2026
Microsoft has detailed a cloud-focused intrusion attributed to Storm-3068, in which attackers turned a compromised user account into a launch point for Azure DevOps abuse, Kubernetes credential theft, and potential access to connected cloud environments. The campaign demonstrates how identity compromise can quickly escalate into a software supply-chain and production-infrastructure incident when development platforms have […] The post Storm-3068 Hijacks Azure DevOps Pipelines to Steal Kubernetes Credentials After Account Takeover appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
update from cyberpress.org
Storm-3068 Uses Azure DevOps Pipelines to Harvest Kubeconfig Credentials and Reach Kubernetes
cyberpress.org · 13d ago · September 30th, 2026
The attacker abused legitimate identity services, development tools, and trusted pipelines rather than relying on malware or software vulnerabilities. Microsoft’s Detection and Response Team, known as DART , investigated the incident. Its findings show how access to a development platform can expose cloud credentials and deployment infrastructure when permissions connect these systems too closely. The attack began with a successful self-service password reset. Storm-3068 then registered its own authentication methods to maintain control of the account. Microsoft’s attack timeline also recorded the removal of legitimate multifactor authentication methods and registration of an attacker-controlled device in Intune. Storm-3068 Steals Kubernetes Credentials Using valid account credentials, Storm-3068 explored Azure DevOps repositories, projects, pipelines, and deployment environments. Automated scripts and administrative tools helped the attacker identify connected resources and trusted deployment paths. These details provided a map for moving beyond the initial account. The attacker created a malicious pipeline using permissions available to the compromised identity. That pipeline was authorized to access more than 50 resources, giving the actor a broad collection opportunity within the development environment. Storm-3068 deployed a kube agent by downloading and running a third-party script. It introduced multiple jobs using the naming pattern DUMP_CLUSTER_ . These jobs retrieve