How Storm-2949 turned a compromised identity into a cloud-wide breach

Microsoft Security Blog posts (May 2026) highlight multiple high-risk operational and research topics: Storm‑2949 converted stolen credentials into a cloud‑wide breach and large‑scale data theft without using malware, demonstrating abuse of trusted systems and living‑off‑the‑land techniques; investigations describe stealthy intrusions via third‑party compromise; Dirty Frag — a newly disclosed Linux local privilege‑escalation vulnerability affecting kernel networking/memory fragmentation (esp4/esp6/rxrpc) — is being monitored in‑the‑wild and increases post‑compromise risk; Kazuar is documentedm