Azure Cross-Subscription Storage Container Hijacking via Delete and Recreate

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•3

Detects a potential storage container hijacking attack in Azure, where a container is deleted in one subscription and subsequently recreated with the same name in a different subscription within the same tenant. This sequence can be used to redirect data streams or intercept access to containerized resources.