Storm-3068 Exploits Azure DevOps for Kubernetes Credential Theft

• •Storm-3068 exploited Azure DevOps to gain Kubernetes credentials.
• •The attack involved modifying pipeline scripts to deploy malicious tools.
• •DART provided rapid response and remediation recommendations.

On September 29, 2026, Microsoft reported an intrusion by the threat actor Storm-3068, which gained access to a user account via a self-service password reset. The attacker then took control of the identity and targeted Azure DevOps to enumerate repositories and deployment environments. A malicious pipeline was created to harvest Kubernetes credentials at scale, deploying a kube agent and modifying scripts to install remote management tools. The investigation revealed that seven stolen kubeconfig files were added to a repository, facilitating access to Kubernetes clusters. Microsoft’s Detection and Response Team (DART) responded swiftly to contain the intrusion and provided guidance for remediation. The attack highlights the vulnerabilities in developer environments and the potential for supply chain attacks to escalate into broader cloud breaches.