Attackers Leverage Stolen Microsoft Entra ID and Azure DevOps Credentials to Breach 27 Organizations
A sophisticated campaign is exploiting compromised Microsoft Entra ID application credentials and Azure DevOps identities to gain unauthorized access to at least 27 organizations, including managed service providers and their downstream clients.
Threat actors have been actively exploiting stolen Microsoft Entra ID application credentials and Azure DevOps identities to infiltrate cloud environments, successfully breaching at least 27 organizations since November 1, 2026. The ongoing campaign, detailed by Todyl, specifically targets managed service providers (MSPs) and their clientele, demonstrating a significant risk to the broader digital supply chain.
The attackers have focused on abusing trusted application identities, a tactic that bypasses multi-factor authentication (MFA) and user-centric Conditional Access policies. By compromising these application registrations, which operate without direct user sign-in, the threat actors can authenticate using existing permissions, effectively circumventing common security controls. This method allows for deeper access and persistence within cloud infrastructures, including Microsoft 365 and Azure environments.
Initial investigations revealed approximately 45 compromised app registrations across 18 organizations, with over 33 successfully authenticating. The impact has cascaded to downstream clients, extending the breach to organizations across various sectors, including government, energy, agriculture, transportation, construction, legal, education, and nonprofit industries. The full extent of the compromise is likely wider than observed, as Todyl's analysis is limited to environments that forward logs to their platform.
During their intrusions, the attackers have been observed performing extensive reconnaissance, including searching across 25 tenants, downloading 81 files, and accessing approximately 2,279 mailbox items. The downloaded files contained sensitive information such as password lists, private keys, VPN profiles, and backup credentials, which could be leveraged for further attacks beyond the immediate Microsoft 365 environment. The attackers also utilized an Azure DevOps federated workload identity and replayed user session tokens, indicating a multi-pronged approach to compromise.
The attack chain typically involves requesting an Azure Resource Manager token, followed by tokens for services like Key Vault, Microsoft Graph, and Storage. This pattern provides a potential hunting ground for defenders, especially when new or previously dormant applications begin authenticating. The campaign has seen rapid activity, with instances of 29 wildcard Microsoft Graph searches followed by rapid SharePoint downloads, suggesting automated or semi-automated exploitation.
While the campaign exhibits signs of automation, with scripted clients accounting for 95% of observed sign-ins, Todyl notes that pauses and changing browser signatures suggest human oversight. The exact method by which the initial credentials were stolen remains unknown, and there is no evidence to suggest a compromise of the vendors whose integration credentials were abused. The use of MSP relationships amplified the damage, with one multi-tenant application impacting 15 customer tenants.
To mitigate this threat, Todyl recommends that defenders review service principal sign-ins and non-interactive user logs for the confirmed source IP address 199.19.77.84. Blocking this specific IP address is advised, rather than broader network ranges, to avoid disrupting legitimate traffic. Organizations should also consider disabling affected applications, removing compromised credentials, revoking user sessions, and rotating secrets in accessible vaults and documents.
MSPs, in particular, are urged to review delegated customer access, preserve audit logs, and promptly notify affected clients. The incident underscores the critical need for robust identity and access management, especially for cloud-based applications and service principals, as traditional user-focused security policies may not adequately protect against these types of credential-based attacks.