Todyl’s latest investigation update describes an ongoing campaign that has used stolen Microsoft Entra ID application credentials and Azure DevOps identities to reach Microsoft 365 and Azure environments. The activity has affected at least 27 organizations, and it has targeted managed service providers, or MSPs, and their customers since November 1, 2026.
Attack paths across cloud tenants
The operator targeted about 45 app registrations across roughly 18 organizations, and more than 33 of those authenticated successfully. Downstream access expanded the victim list to government, energy, agriculture, transportation, construction, legal, education, and nonprofit organizations. Those figures apply only to environments that send logs to Todyl, so the full reach could be larger.
Investigators recorded searches across about 25 tenants, downloads of 81 files, and access to approximately 2,279 mailbox items. The latest reported attempt, at 21:31 UTC on November 3, was blocked. No Microsoft vulnerability was involved, and the attacker relied on valid credentials to operate as trusted applications.
Why app identities changed the exposure
Application identities can operate without a user signing in. Their permissions can allow access without an MFA prompt, and user-focused Conditional Access policies do not govern app-only authentication. Cybersecurity News previously covered how stolen credentials and excessive permissions can turn limited access into broader exposure.
The attacker also used an Azure DevOps federated workload identity and replayed user session tokens. Todyl has not determined how the original credentials were stolen. It found no evidence that a vendor platform was compromised, even though credentials belonging to trusted security integrations were among those abused.
What the attacker did in cloud environments
According to Todyl’s investigation, the operator usually requested an Azure Resource Manager token first, then tokens for Key Vault, Microsoft Graph, and Storage. That sequence gives defenders a pattern to look for, especially when previously unused applications begin authenticating soon afterward.
The latest update described 29 wildcard Microsoft Graph searches followed by SharePoint downloads at about one file per second. The collected material included password lists, private keys, VPN profiles, backup credentials, and remote access settings. Those files could support further attacks beyond Microsoft 365, where Todyl’s cloud logs provide only limited visibility.
MSP relationships increased the impact. One multi-tenant application reached 15 customer tenants in repeated loops of about 10 seconds. The broader risk resembles earlier reporting on compromised accounts reaching Azure DevOps and cloud resources, although that case involved a different intrusion.
Signs defenders can use
Scripted clients accounted for 95% of observed sign-ins, and bursts reached 24 attempts in 10 seconds. Long pauses and changing browser signatures point to human control. Todyl describes automation, not confirmed self-spreading malware, and AI involvement remains a low-confidence possibility.
Defenders should review service-principal sign-ins and non-interactive user logs for 199.19.77.84, the confirmed source address. Failed attempts matter alongside successful ones. Todyl recommends blocking the exact address rather than its entire hosting network, where unrelated activity exists.
Response steps and customer limits
Response should include disabling affected applications where needed, removing compromised credentials, revoking user sessions, and rotating secrets in accessible vaults and documents. Workload-specific Conditional Access has licensing and coverage limits, so user policies alone are insufficient.
MSPs should also review delegated customer access, preserve audit logs, and notify affected clients. The operator has not been identified.
Licensed under CC BY-ND 4.0 International