An ongoing campaign using stolen Microsoft Entra ID application credentials has reached at least 27 organizations through managed service providers (MSPs), exposing Microsoft 365 and Azure environments to unauthorized access, according to Todyl’s November 3 investigation update.
Since November 1, the operator has signed in as service principals with valid client secrets and, in one case, an Azure DevOps federated workload identity. Todyl said about 45 app registrations across roughly 18 organizations were targeted, with more than 33 authenticating successfully. The activity reached government, energy, food and agriculture, transportation, construction, legal, education and nonprofit organizations.
The investigation recorded searches across about 25 tenants, downloads of 81 files and access to around 2,279 mailbox items. The latest attempt, at 21:31 UTC on November 3, was blocked. Todyl said these figures cover only environments that send it logs, so the campaign’s actual reach could be larger. No Microsoft vulnerability was involved.
The operator typically requested Azure Resource Manager tokens before accessing Key Vault, Microsoft Graph and Storage. One multi-tenant application reached 15 customer tenants in roughly 10-second loops. Collected files included password lists, private keys, VPN profiles and backup credentials. Todyl said the original source of the stolen credentials remains unknown and it has not observed persistence being established in affected tenants.
Todyl said the activity is unrelated to the October ConnectWise Cloud Backup compromise, which also involved abuse of application identities in Microsoft 365. The current campaign also differs from the earlier Microsoft 365 token-spraying attack that compromised 97 accounts across 79 organizations.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
