JADEPUFFER-Linked Attackers Used Compromised Service Principals to Delete Azure Resources

The threat actor known as JADEPUFFER orchestrated destructive actions within a Microsoft Azure environment using compromised service principals, Microsoft said. Tracking the activity as Storm-3168, Microsoft called it an evolution of the actor's tradecraft. The attack occurred in early June 2026 over about 18 hours, with destructive operations detailed in the report.