Security teams are sounding alarm over a recent cyber campaign that has used stolen Microsoft Entra ID application credentials and Azure DevOps identities to breach Microsoft 365 and Azure infrastructures. At least 27 organizations have been affected, spanning government, agriculture, legal, education, energy, transportation, construction, and nonprofit sectors.
The attack, tracked by cybersecurity firm Todyl, began on November 1, 2026. It primarily targets managed service providers (MSPs) and their clients. Initial data shows that roughly 45 app registrations were compromised across 18 MSP-connected organizations—with more than 33 of those registrations being used for successful authentications. The full impact is likely greater, as these figures only reflect data from environments that forward logs to Todyl.
Through these hijacked credentials, attackers were able to gain access without triggering multi-factor authentication (MFA). This is because the compromised identities involved applications rather than individual users. As non-user identities, these applications are often beyond the reach of user-focused conditional access policies.
The Attack Flow
The attackers leveraged Azure DevOps’ federated workload identity and replayed session tokens to assume trusted app status. Although how the credentials were stolen is still under investigation, it’s clear that app identities trusted by the environment were key. Once inside, the breach typically followed a consistent sequence: first requesting Azure Resource Manager tokens, then accessing Key Vault, Microsoft Graph, and storage services.
Once Apps were operational, Todyl observed extensive reconnaissance and data exfiltration. The attackers performed Microsoft Graph searches, followed by SharePoint file downloads—about one file per second. Among the extracted items were password lists, private keys, VPN credentials, remote access configurations, and backup data. Within mailbox stores alone, some 2,279 items were accessed.
Scale And Impact
MSP relationships magnified the reach of this operation. One application compromised through an MSP had access to 15 separate customer tenants, enabling rapid cycles of harmful activity—sometimes as quick as every 10 seconds. Scripted login tools were responsible for about 95% of the sign-in traffic, with bursts of attacks followed by delays and changes in browser characteristics—suggesting human-led management of the automated infrastructure.
One high-profile intrusion attempt was logged at 21:31 UTC on November 3, but security controls successfully blocked it. Importantly, no Microsoft vulnerability has been found; instead, attackers exploited valid credentials and existing permissions to move laterally.
Mitigation And Defense Measures
Todyl recommends organizations monitor non-interactive app sign-ins and service principal activity—particularly those that operate outside normal user conditional access controls. Watch for unusual authentication steps, especially when previously inactive applications begin requesting high-impact tokens.
Other steps include disabling affected applications, revoking all compromised credentials and sessions, and rotating secrets—particularly those stored in document repositories or vaults. MSPs are urged to audit their delegated customer access, ensure comprehensive logging, and proactively inform clients of potential exposure.
Given that workload-specific Conditional Access is not universally available or applied, relying only on policies meant for users won’t be enough. Security teams must ensure threat intelligence and audit logs are robust—and that operating procedures allow for rapid action once a breach is spotted.
Analytical Angle: This campaign highlights a growing weakness in cloud security: app-based identities, once trusted, can become powerful attack vectors. As organizations increasingly migrate services and automation into cloud environments, perimeter-defense approaches centered on users and MFA are no longer sufficient. The most serious breaches now arise from mismanaged app permissions, stale credentials, or weak governance over service principals. Defenders should treat all app and workload identities with the same scrutiny as user accounts—because attackers already do.
