Storm-2139 used stolen customer API keys to abuse Azure OpenAI and resell access
Microsoft says a network it tracks as Storm-2139 used customer credentials scraped from public sources to get into generative AI accounts, including Azure OpenAI, changed what the services would do, and resold access with guides for making harmful images, including non-consensual intimate images of celebrities. Microsoft's complaint says it found the abuse in late July 2024. A court order let Microsoft seize a website central to the scheme.
Sources
- Primary: https://blogs.microsoft.com/on-the-issues/2025/02/27/disrupting-cybercrime-abusing-gen-ai/
- Upstream: Editorial
- Entered by the cybermap.lol editors, with sources on the entry
Defenses for this class of incident
all categoriesAn AI-era incident sits in these classes of the AI-security landscape. The companies below work on that class of problem. This is a taxonomy, not a claim that any of them would have changed this incident.
Vendor data: AI Security Startups Map by Prompt Security (CC BY 4.0), synced daily. startups.prompt.security. Paid placements are labelled Sponsored; HeimWall, which runs this site, is labelled Operator. 451 companies in the directory.
Wrong or missing? Email founders@heimwall.ai. Corrections are logged here, in place. How corrections and takedowns work.