A recent cybersecurity incident has come to light where attackers are exploiting stolen Microsoft Entra ID application credentials and Azure DevOps identities. This breach has impacted at least 27 organizations, allowing unauthorized access to Microsoft 365 and Azure environments.
Ongoing Campaign Targets Multiple Sectors
According to a Todyl investigation, the intrusion campaign began on November 1, 2026, primarily targeting managed service providers (MSPs) and their clients. Hackers have attempted to register around 45 applications within 18 organizations, with over 33 achieving successful authentication. The attack has expanded its reach, affecting sectors such as government, energy, agriculture, transportation, construction, legal, education, and nonprofits. Todyl notes that these figures represent only the environments that reported logs to them, suggesting a potentially broader impact.
Investigators have identified activity across approximately 25 tenants, including 81 file downloads and unauthorized access to around 2,279 mailbox items. The most recent thwarted attempt occurred at 21:31 UTC on November 3. The intruders did not exploit any Microsoft vulnerabilities but rather used legitimate credentials to infiltrate the systems as trusted applications.
Understanding the Attack Methodology
This attack differs from others, as it leverages application identities that do not require user sign-in, bypassing typical Multi-Factor Authentication (MFA) prompts. Conditional Access policies focused on user accounts do not apply to app-only authentications, allowing hackers to exploit these loopholes. Previous reports have highlighted how stolen credentials and excessive permissions can lead to extensive data exposure.
The attackers utilized an Azure DevOps federated workload identity and replayed session tokens. The method of acquiring original credentials remains unknown, but Todyl’s investigation found no compromise of vendor platforms, despite the misuse of credentials tied to trusted security integrations.
Implications and Countermeasures
The investigation reveals that attackers typically request Azure Resource Manager tokens, followed by tokens for Key Vault, Microsoft Graph, and Storage, creating a recognizable pattern for future threat detection. Recently, 29 wildcard Microsoft Graph searches were followed by SharePoint downloads at a rapid pace, extracting sensitive data like password lists, private keys, VPN profiles, and backup credentials, potentially enabling further attacks beyond Microsoft 365’s scope.
MSP relationships have exacerbated the impact, with a single multi-tenant application affecting 15 customer tenants in rapid succession. Scripted clients account for 95% of observed sign-ins, indicating a mix of automation and human control.
Todyl advises reviewing service-principal sign-ins and non-interactive user logs for specific IP addresses linked to the breach. Mitigation steps include disabling compromised applications, removing affected credentials, revoking user sessions, and rotating secrets in accessible vaults. It’s important to implement workload-specific Conditional Access policies to mitigate such risks.
Organizations should also preserve audit logs and inform affected clients promptly to contain the threat effectively. Integrating threat intelligence from multiple security operations centers (SOCs) can enhance incident response capabilities.
