Hackers Use Stolen Microsoft Entra ID App Credentials to Breach 27 Organizations
Original title: Hackers Use Stolen Microsoft Entra ID App Credentials to Breach 27 Organizations and Steal Sensitive Data
Attackers authenticated as legitimate applications using stolen secrets to hit 27 organizations via MSPs.
Hackers exploited stolen Microsoft Entra ID application credentials to infiltrate Microsoft 365 and Azure environments. The campaign targeted about 45 app registrations across 18 organizations since November 1, 2026. Todyl detected successful authentication into more than 33 environments and 2,279 mailbox items.
Unconfirmed: Attribution and original credential theft mechanism remain unresolved.
- No Microsoft vulnerabilities were exploited.
- Victims span government, energy, and education sectors.
- Operator used VPS with address 199.19.77.84.
- Attackers issued Azure Resource Manager and Key Vault tokens.
- Conditional Access blocked all token replays observed.
Impact: infiltration of Microsoft 365 and Azure environments
| Product | Affected |
|---|---|
| Microsoft Entra ID | — |
- 1.Investigate successful service-principal sign-ins
- 2.Rotate exposed application credentials
- 3.Preserve audit logs
- Vendors
- Microsoft
- Products
- Entra ID
- Victims
- 27 organizations
- Organizations
- Todyl
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 199.19.77.84 | ish resource consumption. The confirmed operator address is 199.19.77.84. Distinctive user agents include task177-f2267/1.0 and sait |
From the original article
2 min read at gbhackers.com
Hackers are exploiting stolen Microsoft Entra ID application credentials to infiltrate Microsoft 365 and Azure environments, impacting 27 organizations via managed service providers (MSPs) and their downstream clients. Todyl’s MXDR team is monitoring this ongoing campaign, referred to as Key Eater. Since November 1, 2026, the attackers have targeted approximately 45 app registrations across about […]
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.