Tag · 1 article

SSPR

Oct 1, 2026 · 6 min read

Storm-3068: How SSPR Abuse Turns One Azure AD Account Into Kubernetes Credential Theft

Microsoft's Storm-3068 campaign chains self-service password reset abuse, MFA method hijacking, and Azure DevOps pipeline manipulation to steal Kubernetes kubeconfig files. Here's the exact attack chain and the SSPR, Conditional Access, and RBAC controls that stop it.