Storm-3119: App-Based Tenant Takeover
| Attack type | Cloud tenant takeover, persistence |
| Threat actors | Storm-3119 (YAM Store), an access broker reselling hijacked Microsoft 365 tenants |
| Coverage since | October 19, 2026 — five days after Microsoft's disclosure |
| Platforms | Microsoft Entra ID |
Resetting the admin's password doesn't end it. With one compromised Global Administrator, an attacker can plant an app that holds its own keys to the tenant. The app keeps working after the admin's password is reset and their sessions are revoked — because it never used them.
The threat
Storm-3119, also known as YAM Store, is an access broker that sells hijacked Microsoft 365 tenants to phishing operators. With a compromised Global Administrator, it provisions an app — the PnP Management Shell service principal — grants it broad Microsoft Graph and SharePoint permissions such as AppCatalog.ReadWrite.All, and adds a client secret. From then on the app works with no user signed in: it resets passwords without forcing a change, assigns licenses and grants privileges.
Microsoft disclosed the operation on October 14, 2026, the day Microsoft and Health-ISAC seized the group's domains. Fluency's detection was running on customer instances on October 19.
Why it gets past defenses
- Every step is routine. Registering an app, granting it permissions, adding a secret, resetting a password — admins do each of these every week.
- No user is signed in. The app authenticates with its own secret, so sign-in monitoring, MFA and Conditional Access for users never see it.
- The usual playbook fails. Reset the admin's password, revoke their sessions — and the app carries on.
How Fluency catches it
Fluency follows one app through the whole chain, for 72 hours — creation, permission grants, new secrets, and what the app does next — and alerts once per app at the level the evidence supports:
- Critical — an app holding a high-risk permission resets passwords, changes roles or assigns licenses.
- High — a new or newly keyed app does.
- Medium — an app gets a high-risk permission and a new secret.
App creation, new secrets, password resets and role and license changes go on the timeline without raising alerts of their own, so routine app administration stays quiet and the takeover does not.
Detections included
| Detection | What it catches |
|---|---|
EntraID_App_Takeover | One app's high-risk permission, new secret and actions on users, roles or licenses within 72 hours. Critical, high or medium. |
EntraID_High_Risk_App_Permission | An app granted a high-risk Microsoft Graph or Exchange permission, such as User.ReadWrite.All, User-PasswordProfile.ReadWrite.All or AppCatalog.ReadWrite.All. Medium. |
MITRE ATT&CK
| Tactic | Technique |
|---|---|
| Initial Access | T1078.004 Valid Accounts: Cloud Accounts (the compromised admin) |
| Persistence | T1136.003 Create Account: Cloud Account |
| Persistence | T1098.001 Additional Cloud Credentials |
| Persistence, Privilege Escalation | T1098.003 Additional Cloud Roles |
| Persistence | T1098 Account Manipulation |
Get this coverage
The detections are on every Fluency instance and need the Entra ID audit logs, collected through Azure Event Hubs or Microsoft Graph. If you run PnP or other automation apps yourself, expect a medium alert you can close as expected.
Not a customer yet? Start a free trial or book a demo.
Related
- Identity persistence and privilege abuse — the other ways attackers keep access in Entra ID.
- Entra ID Detection Update — the full release, with triage guidance for each alert.