Microsoft warns hackers are exploiting password resets to gain access to user accounts - here's how to stay safe

A phone sitting on a laptop keyboard with the Microsoft Outlook logo on the screen.

• Microsoft researchers warn Storm‑2949 is abusing the Self‑Service Password Reset flow to hijack accounts
• Attackers trick victims into approving MFA prompts via phone calls, then reset passwords and exfiltrate sensitive data
• The campaign targets Microsoft 365 and Azure environments, with Microsoft urging tighter RBAC controls and monitoring of high‑risk operations

A hacking group known as Storm-2949 is abusing the password reset feature in Microsoft’s services to steal people's login credentials, access their accounts, and exfiltrate as much sensitive data as possible.