Topic starter
22/06/2026 10:15 am
TL;DR: Storm-2949 used Entra ID SSPR and social engineering to take over privileged Microsoft accounts without malware or a zero-day, and MFA did not stop the reset flow, according to Bravura Security. The breach shows that user-held credential reset authority is itself the attack surface, because approval confirms interaction, not understanding.
Editorial analysis by NHI Mgmt Group, based on content published by Bravura Security: “As Long As Users Hold Passwords, They're Targets”.
Key questions
Q: What breaks when credential reset authority sits with the user?
A: The reset path becomes reachable through social engineering, because the attacker only needs to influence one human decision at the right moment.
Q: Why do MFA controls not stop socially engineered password resets?
A: MFA validates that a registered factor approved a prompt, but it does not validate caller legitimacy or the user’s understanding of the request.
Q: How should teams handle privileged account recovery after a reset attack?
A: They should treat privileged recovery as a separate governance path from normal self-service.
Practitioner guidance
- Separate privileged recovery from standard SSPR Create a distinct recovery process for admins, executives, and support staff that does not rely on the same user-driven approval path used for ordinary accounts.
- Require phishing-resistant MFA for high-risk identities Use FIDO2 security keys or passkeys for privileged accounts so a phone-based social engineering call cannot approve the reset prompt in the moment.
- Establish coordinated mass reset capability Make sure incident responders can scope and execute a tenant-wide or population-wide password reset without waiting for each user to re-enter the recovery flow.
Bottom line: Storm-2949 shows that the main weakness was not a broken product control but a recovery model that let social engineering reach credential reset authority.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
22/06/2026 11:04 am
Credential reset authority is the real attack surface: When an organisation places password recovery in the user’s hands, it creates a path that social engineering can reach even when authentication is otherwise strong. The problem is not whether SSPR works as designed. The problem is that the design makes user approval the decisive security event. Practitioner implication: identity teams need to evaluate reset authority as a control plane, not a convenience feature.
A few things that frame the scale:
- Password-related issues can represent 10–50% of service desk calls, many of which are avoidable.
A question worth separating out:
Q: What is the difference between self-service password reset and enterprise-managed recovery?
A: Self-service password reset places the user in the recovery loop, which makes the path socially engineerable. Enterprise-managed recovery keeps issuance and restoration under policy control, so the organisation can reset and reissue credentials without relying on a compromised person to act. The difference is who controls the last security decision.
👉 Read our full editorial: Storm-2949 shows credential reset governance is the real exposure