This is a research prototype. The data and analyses are preliminary and not yet validated — we'd welcome your .
A global cybercrime network known as Storm-2139 exploited stolen API credentials to hijack Microsoft's Azure OpenAI services. The group developed tools to bypass safety guardrails, enabling the generation of non-consensual intimate images and other illicit content. Microsoft disrupted the operation through legal action and website seizures, which led to retaliatory doxing of their legal counsel by the group members.
A global cybercrime network, Storm-2139, allegedly exploited stolen credentials and developed custom tools to bypass AI safety guardrails. They reportedly generated harmful deepfake content, including nonconsensual intimate images of celebrities, and their software is reported to have disabled content moderation, hijacked AI access, and resold illicit services. Microsoft disrupted the operation and filed a lawsuit in December 2024, later identifying key members of the network in February 2025.
Domain classification, causal taxonomy, severity scores, and national security assessments were LLM-classified and may contain errors.
Vulnerabilities that can be exploited in AI systems, software development toolchains, and hardware, resulting in unauthorized access, data and privacy breaches, or system manipulation causing unsafe outputs or behavior.
Also classified as
The hijacked AI systems were used to generate thousands of sexually explicit images and non-consensual intimate images of celebrities.
The actors created tools to generate non-consensual intimate images of celebrities, which constitutes targeted creation of humiliating or sexual imagery.
The incident involved a cybercrime network exploiting stolen credentials to gain unauthorized access to Azure OpenAI services, bypass safety guardrails, and manipulate the system's capabilities.
Human
Due to a decision or action made by humans
Intentional
Due to an expected outcome from pursuing a goal
Post-deployment
Occurring after the AI model has been trained and deployed
The incident was caused by human malicious actors who intentionally hijacked deployed AI services to bypass safety guardrails and generate illicit content.
Added categories peak at 2: Minor (Epistemic Harm, Direct)
A global cybercrime network hijacked Microsoft Azure OpenAI services to bypass safety guardrails and generate explicit celebrity deepfakes, subsequently doxing Microsoft legal counsel. While demonstrating evolved cybercrime capabilities in LLMjacking, the incident represents a minor national security threat managed through corporate legal action and law enforcement referrals.
The reports describe the AI system being used as a generative tool to produce synthetic images based on direct user prompts. The cybercriminals bypassed guardrails to use the models as a tool for generating explicit content without any autonomous planning or agentic decision-making by the AI itself.
Limited Risk: The generative AI models are used to produce synthetic content and deepfakes, which falls under the transparency and notification obligations of Risk Level 3.
The hijacked Azure OpenAI Service was primarily exploited to generate thousands of synthetic images, specifically focusing on deepfake image generation of celebrities.
The reports from Microsoft and multiple cybersecurity news outlets provide highly detailed, consistent, and corroborated accounts of the Storm-2139 cybercrime network, their methods (LLMjacking), and the resulting harms (NCII generation and doxing).
None. The incident is clearly a cybersecurity exploit of AI services to generate prohibited content.
Technology
Vulnerable API Key Storage
Customer API keys were exposed on public sources, allowing unauthorized access.
Bypassable AI Guardrails
Built-in safety measures were bypassed using custom jailbreaking tools.
Lack of LLM Access Controls
Insufficient restriction on non-human identities allowed API key abuse.
Data Inputs
Scraped Customer Credentials
Exposed customer credentials scraped from public websites enabled hijacking.
Stolen API Keys
Stolen API keys acted as digital credentials to gain unauthorized AI access.
Use of Harmful Prompts
Malicious users input prompts to generate non-consensual explicit images.
Human Factors
Poor Credential Hygiene
Customers exposed their sensitive API keys on public repositories.
Malicious Intent of Actors
Cybercriminals deliberately sought to exploit AI for financial gain.
Lack of Multi-Factor Auth
Users failed to implement strong authentication to secure their accounts.
Process and Methods
Inadequate Access Monitoring
Lack of continuous monitoring failed to detect anomalous API key usage.
Flawed LLM Key Rotation
Absence of regular credential rotation allowed long-term key exploitation.
Lack of Least-Privilege Policy
Accounts held excessive permissions, expanding the potential attack surface.
Management
Insufficient Service Auditing
Inadequate proactive audits of non-human identities and service accounts.
Inadequate Risk Assessment
Failure to anticipate the scale of LLMjacking and API key exploitation.
Unsecured AI Adoption
Organizations prioritize growth over implementing strict access controls.
Regulatory Environment
Outdated Criminal Laws
Existing laws lack tools for law enforcement to combat AI misuse effectively.
Lack of AI Governance Standards
Absence of strict global regulations on generative AI hosting and access.
Absence of AI-Specific Laws
Current legal frameworks are not modernized to handle synthetic media abuse.
AI system involved
Identified by automated extraction; can differ from the alleged developers above.
