Hackers abuse stolen Entra ID and Azure DevOps credentials to hit 27 organizations
Original title: Hackers Use Stolen Microsoft Entra ID and Azure DevOps Credentials to Access 27 Organizations
Attackers abused stolen Microsoft Entra ID app credentials and Azure DevOps federated identities to reach 27 MSPs and their customers since November 1, 2026.
Hackers abused stolen Microsoft Entra ID application credentials and Azure DevOps identities to access Microsoft 365 and Azure environments, reaching at least 27 organizations. Todyl’s investigation describes an ongoing campaign targeting managed service providers and their customers since November 1, 2026. The operator targeted about 45 app registrations across roughly 18 organizations, with more than 33 authenticating successfully. Downstream access expanded the victim count to government, energy, agriculture, transportation, construction, legal, education, and nonprofit organizations. No Microsoft vulnerability was involved; the attacker used valid credentials to act as trusted applications. The latest reported attempt at 21:31 UTC on November 3 was blocked.
Unconfirmed: AI involvement remains a low-confidence possibility; the operator has not been identified.
- Targeted 45 app registrations across 18 organizations
- More than 33 applications authenticated successfully
- Expanded to 27 organizations total
- Recorded 25 tenant searches, 81 file downloads, 2,279 mailbox items accessed
- 95% of sign-ins from scripted clients
Impact: Access to Microsoft 365 and Azure environments via valid app credentials
- 1.Disable affected applications
- 2.Revoke user sessions
- 3.Rotate secrets in vaults and documents
- Vendors
- Microsoft
- Products
- Entra IDAzure DevOps
- Victims
- 27 organizations
- Organizations
- Todyl
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 199.19.77.84 | ervice-principal sign-ins and non-interactive user logs for 199.19.77.84, the confirmed source address. Failed attempts matter along |
From the original article
2 min read at cybersecuritynews.com
Hackers are abusing stolen Microsoft Entra ID application credentials and Azure DevOps identities to access Microsoft 365 and Azure environments, reaching at least 27 organizations. Todyl’s latest investigation update describes an ongoing campaign targeting managed service providers (MSPs) and their customers since November 1, 2026. The operator targeted about 45 app registrations across roughly 18 […]
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.