eSentire's Threat Response Unit (TRU) compiles the following weekly intelligence overview, providing cybersecurity leaders with expert analysis and insights on the most important events of the past week along with important security tips.
Recent Threat Intelligence Advisories
Noteworthy News
How Storm-2949 Turned a Compromised Identity into a Cloud-Wide Breach
Bottom Line: Storm-2949 used social engineering tactics and abuse of legitimate Microsoft features to compromise an organization’s cloud environment, leading to the exfiltration of sensitive data.
On May 18th, 2026, Microsoft published a detailed breakdown of a multi-stage attack by Storm-2949, a threat actor that escalated a single identity compromise into a full breach of a target organization’s cloud infrastructure across Microsoft 365, Azure, and hosted production environments. The Storm-2949 campaign consisted of two main phases: identity compromise and cloud infrastructure exploitation.
The attack began with targeted social engineering campaigns designed to compromise Microsoft Entra ID accounts. The threat actor abused the Self-Service Password Reset (SSPR) process by initiating password reset requests and convincing users to approve Multifactor Authentication (MFA) prompts under false pretenses, such as impersonating IT support personnel. Once users approved these requests, the attackers reset passwords, removed legitimate authentication methods, and registered their own MFA devices. The threat actor specifically targeted high-value individuals, including IT administrators and senior leadership.
After obtaining access to initial accounts, the attackers conducted extensive directory reconnaissance using the Microsoft Graph API. They employed automated scripts to enumerate users, roles, and applications within the tenant, allowing them to identify additional privileged accounts and expand their foothold. The attackers leveraged compromised accounts to access Microsoft 365 services such as OneDrive and SharePoint. They searched for sensitive files, particularly those related to IT infrastructure and remote access configurations.
With a foothold established in Microsoft 365, Storm-2949 shifted its focus to Azure environments. The campaign targeted a broader ecosystem of interconnected resources such as Azure App Services web applications, Azure Key Vaults, Azure Storage accounts, and SQL databases. To maintain persistent access, the threat actor deployed the ScreenConnect remote management tool across compromised virtual machines. The attackers also attempted to disable Microsoft Defender Antivirus protections, clear logs, and remove forensic artifacts to hinder detection and investigation.
eSentire Threat Intelligence Analysis:
The Storm-2949 campaign highlights that identity compromise has become the most critical entry point and dominant attack vector in cloud environments. In this case, the threat actor did not rely on traditional malware or exploitation techniques but instead leveraged social engineering and weaknesses in authentication workflows, to gain persistent access to user identities. As organizations increasingly scale their adoption of cloud infrastructure, threat actors are shifting their focus away from individual endpoints and toward targeting identities and control-plane access. Once a cloud identity is compromised, attackers can exploit legitimate administrative tools and functions to perform malicious activity. Microsoft did not explicitly attribute a definitive motive to the Storm-2949 campaign; however, based on the observed tradecraft and scale of data exfiltration, it can be reasonably assessed that the activity was likely driven by either espionage objectives or financial gain.
To combat these increasingly stealthy tactics, it is critical that organizations employ a Defence-in-Depth approach to security, that includes Network, Endpoint, and Log monitoring. Organizations should deploy a robust Endpoint Detection and Response (EDR) solution to effectively identify and contain any malicious activity across their assets within the environment. Conditional Access policies should be used to restrict access based on risk factors such as device compliance and location.
Based on the tradecrafts outlined in this report, eSentire’s Threat Intelligence team has observed similar social engineering activity in the wild, particularly involving IT support impersonation to deceive users into initiating credential reset workflows and approving malicious authentication requests. These campaigns often serve as the precursor to the deployment of Remote Monitoring and Management (RMM) tools, which are then used to establish persistence. Organizations should restrict the usage of RMM tools that are not legitimately used within their environments, as threat actors are known to abuse these tools to establish persistent access and perform lateral movement. Organizations should also restrict external messages and calls within Microsoft Teams, if not required for legitimate business operations, to prevent threat actors from being able to contact users via this method.
GitHub Discloses Breach
Bottom Line: GitHub disclosed a breach of internal repositories, stemming from a Visual Studio Code supply-chain attack, resulting in the compromise of GitHub’s internal repositories. TeamPCP claimed responsibility for the attack, threatening to sell stolen data.
On May 20th, 2026, GitHub published a blog, confirming a compromise of the company’s internal repositories. The compromise stemmed from a malicious Visual Studio (VS) Code extension that was installed by an employee, which led to the exfiltration of approximately 3,800 internal GitHub repositories. GitHub has stated that there is “no evidence” of impact to customer information stored outside of these repositories, but that some of them may contain information from customers, such as excerpts of support interactions; if any impact is discovered, GitHub states that customers will be notified.
GitHub pointed to the Initial Access Vector (IAV) being a “poisoned” version of the Nx Console extension. StepSecurity identified that a malicious version of Nx Console, specifically version 18.95.0, was published to the Visual Studio Code Marketplace on May 18th. The extension contained a “multi-stage credential stealer and supply chain poisoning tool”, which harvested and exfiltrated tokens and secrets from GitHub, npm, AWS, HashiCorp, Kubernetes, and 1Password. The payload also installed a Python-based backdoor on macOS devices that uses the GitHub Search API as a dead-drop for receiving Command-and-Control (C2) instructions.
On May 19th, the financially motivated threat actor TeamPCP claimed responsibility for the GitHub breach, via a post on the BreachForums cybercrime forum. TeamPCP stated that they were planning on selling the exfiltrated data to one buyer and then would “shred the data”. If no buyer was found, TeamPCP indicated that they would leak the data for free. In response to the incident, GitHub began incident response and suggested that a more in-depth report on the activity will be published once their investigation is complete.
eSentire Threat Intelligence Analysis:
Over the past year, supply chain attacks targeting npm, GitHub, and VS Code extensions have become a widely adopted technique by threat actors, due to the down-stream impacts that they have. GitHub’s incident was linked to the Nx Console breach, which was traced back to TeamPCP’s compromise of TanStack npm packages via the Mini Shai-Hulud worm on May 11th. It is unclear what initially led to the TanStack incident, but the compromise chain illustrates the cascading impact of supply chain attacks, where the compromise of one package or extension can subsequently lead to larger incidents. Nx CEO Jeff Cross stated that there were over 6000 installs of the malicious Nx Console version while it was live, highlighting the ongoing risk.
TeamPCP was first identified in 2025, and have conducted notable supply chain attacks within 2026 that include Aqua Security’s Trivy scanner, Checkmarx’s KICS, Telnyx, and LiteLLM. In May 2026, TeamPCP also published their own source-code to GitHub, which has already enabled copycat attacks. Based on the inherent success that these supply chain attacks have, and availability of TeamPCP’s open-source code, eSentire’s Threat Intelligence team assesses with high confidence that similar supply chain attacks will continue into the future.
To protect against the threat posed by these supply chain attacks, organizations should implement lock files and version pinning to prevent any automatic updates for npm packages and VS Code extensions. If a malicious package or extension that is part of a supply chain attack is identified, organizations should remove the impacted item immediately, rotate all credentials and secrets on any impacted devices, and audit all packages and extensions associated with impacted developer accounts. eSentire published advisories on Shai-Hulud’s first and second waves in 2025, and covered recent Shai-Hulud infections in the April 27th - May 1st Weekly Threat Briefing. eSentire’s Threat Intelligence team continues to track TeamPCP, Shai-Hulud, and these ongoing supply chain attacks for additional information and detection opportunities.
Microsoft Disrupts Fox Tempest’s MSaaS Operation
Bottom Line: Microsoft announced a disruption of Fox Tempest’s Malware-Signing-as-a-Service operation that abused Microsoft’s Artifact Signing system to issue fraudulent, short-lived code-signing certificates for malicious software.
Microsoft’s Threat Intelligence and the Digital Crimes Unit (DCU), with support from industry partners, have disrupted the operations of Fox Tempest, a financially motivated threat actor operating a Malware-Signing-as-a-Service (MSaaS) platform, active since May 2025. Malware signing operations generate and sell short-lived, fraudulent code-signing certificates. Threat actors can purchase and use these certificates to sign their malware, making it appear to be trusted, and allowing it to execute on victim machines.
Microsoft has tracked Fox Tempest since September 2025. During this period, over 1,000 fraudulent certificates were identified. Various threat actor groups made use of the service, including Vanilla Tempest, Storm-0501, Storm-2561, Storm-0249, and multiple ransomware affiliates for operations including INC, Qilin, and Akira. Fox Tempest enabled the deployment of various payloads depending on the group, including ransomware, backdoors, and information stealers.
Microsoft unsealed a legal case in the US District Court for the Southern District of New York and seized the Fox Tempest service website as part of the disruption action. Microsoft was also able to revoke all identified certificates and take hundreds of virtual machines supporting the operation offline.
eSentire Threat Intelligence Analysis:
This disruption directly impacts not only Fox Tempest, but also all of their downstream customers. These actions will force threat actors to either pivot to alternative MSaaS platforms or invest time and money into obtaining their own certificates. This in turn will result in the disruptions of various ongoing malware campaigns and impose financial costs on threat actors that have had certificates revoked.
While Microsoft’s disruption will impact multiple groups in the short term, long-term impacts are expected to be minimal. No arrests have been made; as such it is probable that Fox Tempest will re-establish their operations in the future. Similar resurgences have been seen in the past following the disruption of other cybercrime operations, such as Lumma Stealer in May 2025, which resurfaced only two months later.
Fox Tempest demonstrated that certificates can be fraudulently obtained at scale and rapidly rotated, making certificate-based trust alone an unreliable gating control. Organizations should not treat a valid code-signing certificate as a sufficient indicator of software safety. It was noted that malware delivery associated with the fraudulent certificates occurred via malvertising, SEO poisoning, and legitimate purchased advertisements, meaning initial access vectors extend beyond email-based controls. It is important that visibility and detections are verified across these initial access vectors.
This is the first report on a major MSaaS disruption, but it is not the first time research has been done into these groups and services. In 2024, eSentire’s Threat Response Unit (TRU) performed in depth research on code signing abuse. Findings were discussed at the SecTor conference and the November 2024 TRU Intelligence Briefing. eSentire’s TRU team regularly reports these certificates as they are discovered, to allow for their revocation by issuers.
About the threat briefings:
The threat briefing is a weekly intelligence overview for non-technical users. The Threat Intelligence team at eSentire investigates, analyzes, and organizes the most important events of the past week along with important security tips and redistributes the findings for quick reading. The main goal of this briefing is to improve the overall awareness of readers regarding cyber security.
