[ctx]ctxseccontext security: attacks on the harness and context layer of AI agents, plus exploited-now news, hunting and playbooks.

← Threat Hunting · markdown

official (Microsoft Threat Intelligence, Nov 10, 2026); Microsoft says no single IP, domain or lure should be treated as conclusive attribution

Hunt: Storm-3350 resets passwords through self-service reset, passes the victim's SMS MFA, registers its own Authenticator, then mass-pulls SharePoint and Azure keys

  • Hunt the sequence, not single events: SSPR password reset, then an immediate sign-in satisfying existing SMS/voice MFA, then a new authentication method registered, then anomalous token acquisition and Graph/Azure control-plane enumeration, then SharePoint, OneDrive and mailbox discovery and high-volume download.
  • Tooling seen: browser access mixed with Python- and Node-style automation, OAuth-authenticated curl, and Azure CLI enumeration; Microsoft lists mass SharePoint/OneDrive access via python-httpx as a detection.
  • Secret hunting: SharePoint searches for AKIA (AWS access key prefix), access to .key, .pem and .ppk files, and Azure requests for storage-account keys (List Keys) and app publishing profiles.
  • Microsoft detections named: suspicious Azure List Keys activity; anomalous token acquisition followed by high-volume SharePoint file activity; Graph API activity from a Microsoft threat-intelligence IP; mass SharePoint or OneDrive file access after an MFA method change; suspicious mass download from a risky or unusual session.
  • See the tip on hardening SSPR and security-info registration.

Sources: Microsoft Threat Intelligence on X: Storm-3350 (Nov 10, 2026)