Stolen Entra ID and Azure DevOps Credentials Fuel Expanding Cloud Intrusion Campaign

Researchers at Todyl's MXDR Team have reported an ongoing campaign in which threat actors are using stolen Microsoft Entra ID application credentials and Azure DevOps identities to gain unauthorized access to Microsoft 365 and Azure environments. As of November 3-4, 2026, the activity has impacted at least 27 organizations, including MSPs and their downstream customers across government, energy, transportation, education, legal, and nonprofit sectors.

• Attackers compromised valid application credentials rather than exploiting a Microsoft vulnerability.
• Approximately 45 application registrations across 18 organizations were targeted, with more than 33 successfully authenticated.
• The threat actor leveraged application identities, allowing them to bypass user-focused MFA and Conditional Access controls that do not apply to app-only authentication.
• Investigators observed:
  • Searches across roughly 25 Microsoft tenants.
  • Downloads of at least 81 files.
  • Access to approximately 2,279 mailbox items.

The Attack

The attackers typically:

1. Authenticate using stolen Entra ID application secrets or certificates.
2. Request Azure Resource Manager tokens.
3. Obtain tokens for:
   • Azure Key Vault
   • Microsoft Graph
   • Azure Storage
4. Enumerate Microsoft 365 and Azure environments.
5. Search and exfiltrate sensitive data from SharePoint, Exchange Online, and cloud storage.

Investigators also observed the use of:

• Federated workload identities in Azure DevOps.
• Stolen user session tokens.
• Automated tooling capable of rapidly expanding access throughout MSP-managed environments.

Data Targeted

Exfiltrated files reportedly included:

• Password repositories
• Private keys and certificates
• VPN configurations
• Backup credentials
• Remote access settings
• Administrative documentation

Security teams should investigate:

• Newly active service principals or applications.
• Application authentications occurring from unusual IP addresses.
• Unexpected token requests for Microsoft Graph, Key Vault, and Azure Resource Manager.
• High-volume SharePoint downloads.
• Azure DevOps workload identity sign-ins outside normal patterns.

Mitigation Recommendations

1. Immediately rotate all Entra ID application secrets and certificates.
2. Review Azure DevOps service connections and workload identities.
3. Audit privileged service principals and remove excessive permissions.
4. Enable logging and alerting for service principal sign-ins.
5. Review Microsoft Graph application permissions and revoke unnecessary access.
6. Search for abnormal token activity in Entra ID logs.
7. Consider implementing managed identities instead of long-lived application secrets where possible.