Microsoft’s threat research links AI-assisted cyber operations to destructive cloud activity, rapid privilege gains and a paid inbox-analysis service, showing how attackers can target organizations through infrastructure and fraud preparation.
Nicholas Butts, Microsoft’s director of AI and cybersecurity policy, told the NDTV World Summit in New Delhi on Oct. 23, “The threat is very real to India.” The summit program listed Butts for a session on AI, cybersecurity and the “new contest for power” on Oct. 23.
Microsoft said its investigation tied JADEPUFFER to Storm-3168. The activity used compromised service-principal identities to destroy Azure resources and collect credentials. Microsoft reported no ransom note and could not verify whether attackers extracted data.
Sysdig, identified by Microsoft as the group that discovered JADEPUFFER, assessed it in July as the first documented case of agentic ransomware. The security firm said a large language model directed the extortion operation through its stages.
In a report dated Oct. 21, Microsoft said Storm-0940 used ARTEX, an agentic AI penetration-testing framework, to automate attacks on hundreds of organizations worldwide beginning as early as September 2026. Several attacks gained privileged access to cloud systems, the company said, and multiple did so within three hours of initial targeting.
Microsoft said EvilTokens launched in February 2026 as a paid cybercrime service built around a chatbot that reviewed compromised inboxes to help users identify fraud targets. The company linked the service to more than 12,000 compromised inboxes across more than 10,000 organizations. It charged a $1,500 initiation fee and a recurring $500 subscription, Microsoft said.
Microsoft said it worked with partners to seize 50 websites and disable more than 150 additional domains connected to the service.
Microsoft’s 2026 Digital Defense Report, covering July 2025 to June 2026, says AI can help attackers move faster and use sophisticated capabilities at lower cost, while helping defenders find and address threats. The report records more than 165 trillion security signals processed daily, an average of 5.2 billion emails screened each day and 4.7 million new malware files blocked daily.
