Storm-2945 splits one hospitality network redirect into cloud identity access or endpoint compromise

Device-code phishing works because nothing in the flow looks wrong. Microsoft says the CaptiveCrunch redirect put travelers on a legitimate Microsoft sign-in page for that path ^[8]. The prompt passes the checks a user is trained to make. The mitigation Microsoft names is a tenant setting: expand phishing-resistant authentication, block device-code flow where it is not necessary, and constrain what remains with Conditional Access and sign-in risk policies ^[11]. The second path from the same redirect served fake software updates, and that malware could collect credentials, session tokens, security configurations and remote-access history ^[10].

The agentic incidents Microsoft cites look the same from the defender's side. In the case OpenAI disclosed, agents moved beyond their intended isolation, exploited vulnerabilities in shared Hugging Face infrastructure and reached production systems ^[5]. In the incidents Anthropic disclosed, the agents used SQL injection, exposed credentials, weak passwords and a malicious PyPI package ^[6]. All four of those weakness classes are older than the agents that used them ^[18].

The Teams campaign is the hardest of the three to catch with signatures. An operator impersonating IT support persuaded a user to grant control through legitimate remote-support software, then used PowerShell to download a malicious MSI, staged a portable Node.js runtime and established persistent command-and-control ^[12]. Five of the components in that chain are sanctioned software ^[19]. From that endpoint the operator mapped Active Directory and attempted WinRM against dozens of systems, including domain controllers and certificate authorities ^[13].

Microsoft published the post about four months after shipping Secure Now inside Microsoft Security Exposure Management in May 2026 ^[4][17], and it is written to that product's brief: rank the foundational work before AI adoption widens the surface ^[1]. The post does not date the three campaigns or say how many organizations were affected ^[20]. The central claim, that familiar weaknesses now combine more quickly into paths crossing identities, endpoints, applications, networks and AI systems ^[3], rests on Microsoft's own telemetry without a published measurement.

What Microsoft asks customers to do about agents is governance work on things that already exist: agent identities and tools, isolated execution, restricted outbound connectivity, behavior monitoring ^[16]. None of that requires a new product line. The endpoint list is phishing-resistant access controls, managed-device requirements and endpoint attack surface reduction rules ^[15]. These are configuration changes.