The appeal of the cloud is undeniable: flexibility, scalability, and global access. But these same strengths are now being exploited by cybercriminals. In recent months, Microsoft has uncovered an advanced campaign using Azure’s elasticity to launch distributed attacks, erase tracks, and quickly scale within corporate environments.
This phenomenon, dubbed Cloud Shadows by experts, shows how a single misconfiguration or compromised credential can trigger a massive attack chain.
Modern cloud environments are constantly changing: multiple services, containers, ephemeral virtual machines, and dynamically assigned permissions. While this enables business agility, it also makes monitoring harder and exposes invisible gaps.
Microsoft Defender detected a campaign starting in June 2025, where attackers infiltrated poorly configured or weakly protected Azure environments.
They began by exploiting educational and Pay-As-You-Go accounts—the most vulnerable due to lacking secure passwords, multi-factor authentication (MFA), or active monitoring.
This technique doesn’t rely on sophisticated malware, but rather abuses Azure’s native tools.
Once attackers gain access—via brute force or adversary-in-the-middle techniques—they create new resource groups and temporary VMs that operate only for a few hours.
These ephemeral machines, running within Azure’s legitimate ecosystem, bypass traditional security systems. From there, they launch password spraying attacks against thousands of Azure tenants.
“Their infrastructure was so volatile it disappeared before leaving a trace,” said Microsoft researchers. “At a glance, it looked like legitimate traffic.”
Learn more: What is a hybrid cloud backup and how does it work?
A key to the campaign’s success was its multi-tenant, multi-hop design:
Every compromised account became a launchpad, and each tenant—an attack front.
With access secured, attackers used Azure resources to send mass spam, phishing, and financial scam campaigns.
They deployed VMs to send millions of spoofed emails from seemingly legitimate addresses, redirecting users to fraudulent sites (e.g., via rebrand.ly links) posing as surveys or app downloads.
A dangerous tactic was distributing fake Android apps, like modified versions of WhatsApp (FM WhatsApp or Yo WhatsApp). These apps stole contacts, files, and messages while mimicking communication with legitimate WhatsApp servers.
Even sextortion and digital blackmail incidents were reported using stolen data.
Password Spray and Fraud Campaign (Source: Microsoft)
Attackers didn’t settle for temporary access—they aimed to maintain long-term control, even if anomalies were detected.
They used three advanced techniques:
The result: a highly automated, elastic, and resilient attack ecosystem—nearly invisible within a legitimate environment.
You might also be interested in: What is a cloud backup?
In just days, a single attacker instance managed to:
All using Microsoft Azure’s legitimate infrastructure, which made detection far more difficult.
Quota Abuse and ML service usage and Oauth Backdoors (Source: Microsoft)
These attacks are a clear warning: cybercriminals now move within the cloud as fluidly as legitimate services. At TecnetOne, we recommend:
The cloud offers speed, scale, and flexibility—but as this campaign shows, those same strengths can be weaponized.
Modern attackers don’t rely on traditional malware. They use your infrastructure against you.
At TecnetOne, we believe visibility, education, and smart automation are the keys to cloud defense. The future is cloud-based—but security must evolve with it.