Storm-2139 Azure OpenAI account hijack and jailbreak resale
Date: 2025-01-31
Affected: Microsoft Azure OpenAI Service
Attack vector: auth-bypass
Category: real-world
Severity: High

Cybercrime group Storm-2139 hijacked Azure OpenAI accounts via stolen credentials, jailbroke the models to bypass content safeguards, and resold access. They produced thousands of policy-violating outputs including non-consensual explicit images.


Mitigations:

Architectural layers (MAESTRO):