Stolen Entra ID credentials widened access to 27 organizations
Todyl’s latest investigation update describes an ongoing campaign that has used stolen Microsoft Entra ID application credentials and Azure DevOps identities to reach Microsoft 365 and Azure environments. The activity has affected at least 27 organizations, and it has targeted managed service providers, or MSPs, and their customers since November 1, 2026. Attack paths across cloud tenants The operator targeted about 45 app registrations across roughly 18 organizations, and more…