Hackers Use Stolen Microsoft Entra ID and Azure DevOps Credentials to Access 27 Organizations
The most important technical takeaway is not the single indicator or even the stolen credentials themselves, but the identity model being abused. App registrations, service principals and federated workload identities often sit outside the controls many teams rely on for workforce access. If these identities hold broad Graph, Key Vault, Storage or ARM permissions, an attacker can pivot through cloud control planes and data planes without triggering the same scrutiny as an end-user compromise.
That makes this an architecture problem as much as an incident-response problem. MSP and multi-tenant designs are especially exposed because one trusted application can become a cross-tenant access channel. IT teams should review which applications are allowed to span customer environments, whether permissions are truly scoped to operational need, and whether credential material for those apps is stored in places that are themselves reachable through Graph, SharePoint or vault access.
Detection strategy also needs to change. User-centric sign-in monitoring is insufficient if the attacker behaves like a workload. Security teams should correlate first-time or rarely used application authentications with rapid token acquisition across ARM, Key Vault, Graph and Storage, then look for bursts of scripted access followed by human-paced exploration. Azure DevOps federated identities deserve equal attention because CI/CD trust paths can quietly bridge source control, secrets and cloud administration.
Practically, this is a strong case for reducing standing app permissions, preferring managed identities where possible, shortening secret lifetimes, segmenting customer access paths, and treating service-principal inventories as production attack surface. Many organizations maintain better governance for human admins than for non-human identities; this campaign shows why that gap is now operationally risky.
Hackers are abusing stolen Microsoft Entra ID application credentials and Azure DevOps identities to access Microsoft 365 and Azure environments, reaching at least 27 organizations.
Todyl’s latest investigation update describes an ongoing campaign targeting managed service providers (MSPs) and their customers since November 1, 2026.
The operator targeted about 45 app registrations across roughly 18 organizations, with more than 33 authenticating successfully. Downstream access expanded the victim count to government, energy, agriculture, transportation, construction, legal, education, and nonprofit organizations. These figures cover only environments sending logs to Todyl, so the actual reach could be wider.
Investigators recorded searches across about 25 tenants, downloads of 81 files, and access to approximately 2,279 mailbox items. The latest reported attempt, at 21:31 UTC on November 3, was blocked. No Microsoft vulnerability was involved. Instead, the attacker used valid credentials to act as trusted applications.
Attack Chain (Source: Todyl)
This distinction matters because application identities operate without a user signing in. Their existing permissions can allow access without an MFA prompt, while user-focused Conditional Access policies do not govern app-only authentication. Cybersecurity News previously covered how stolen credentials and excessive permissions can turn limited access into broader exposure.
The attacker also used an Azure DevOps federated workload identity and replayed user session tokens. How the attacker stole the original credentials remains unknown. Todyl found no evidence that a vendor platform was compromised, even though credentials belonging to trusted security integrations were among those abused.
Attack Moves Through Cloud Environments
According to Todyl’s investigation, the operator typically requests an Azure Resource Manager token, followed by tokens for Key Vault, Microsoft Graph, and Storage. This sequence gives investigators a useful pattern to hunt, particularly when previously unused applications begin authenticating shortly afterward.
The latest update describes 29 wildcard Microsoft Graph searches followed by SharePoint downloads at roughly one file per second. Collected material included password lists, private keys, VPN profiles, backup credentials, and remote access settings. Such files could enable further attacks beyond Microsoft 365, where Todyl’s cloud logs provide limited visibility.
MSP relationships increased the damage. One multi-tenant application reached 15 customer tenants in repeated loops of about 10 seconds. The broader risk resembles earlier reporting on compromised accounts reaching Azure DevOps and cloud resources, although that case involved a different intrusion.
Scripted clients accounted for 95% of observed sign-ins, with bursts reaching 24 attempts in 10 seconds. However, long pauses and changing browser signatures suggest human control.
Todyl describes automation, not confirmed self-spreading malware. AI involvement remains a low-confidence possibility, and the operator has not been identified.
Defenders should review service-principal sign-ins and non-interactive user logs for 199.19.77.84, the confirmed source address. Failed attempts matter alongside successful ones. Todyl recommends blocking the exact address rather than its entire hosting network, where unrelated activity exists.
Response should include disabling affected applications where needed, removing compromised credentials, revoking user sessions, and rotating secrets in accessible vaults and documents.
Workload-specific Conditional Access has licensing and coverage limits, so user policies alone are insufficient. MSPs should also review delegated customer access, preserve audit logs, and notify affected clients.
Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.
Enjoyed this article? Sign up for our newsletter to receive regular insights and stay connected.