# One actor signed in as Entra ID apps with stolen secrets and reached 27 organizations, Todyl says

Source: https://startwithidentity.com/blog/2026-11-03-actor-signs-in-as-entra-id-apps-with-stolen-secrets-across-27-organizations/
Last updated: 2026-11-03
License: content by Start with Identity. Cite the source URL.

---

Security firm Todyl reported on November 3 an ongoing campaign in which one operator signs in to [Microsoft Entra ID](https://startwithidentity.com/vendors/iam/microsoft-entra/) as applications, using stolen client secrets for app registrations. The actor tried about 45 app registrations at roughly 18 organizations, authenticated to more than 33 and has reached 27 organizations, including downstream clients of managed service providers. From November 1 it requested Azure Resource Manager and Key Vault tokens, then Graph, Storage and Cognitive Services tokens, ran Graph searches across about 25 tenants, downloaded 81 files and accessed about 2,279 mailbox items. It also used an Azure DevOps federated workload identity and replayed two users' DevOps session tokens. Scripted clients made 95% of sign-ins. Todyl says no Microsoft vulnerability is involved, how the secrets were obtained is unknown, and its counts are a floor.

## Why it matters

Todyl's summary is blunt: "If the credential is valid, the app is in." A [service principal](https://startwithidentity.com/glossary/service-principal/) signing in with a client secret has no MFA prompt to fail, and MSP multi-tenant and GDAP relationships turn one provider's app into a route to its customers. Todyl assesses the activity as unrelated to [Storm-0940's ConnectWise campaign](https://startwithidentity.com/blog/2026-10-21-storm-0940-used-connectwise-app-identities-to-reach-2250-microsoft-365-tenants/), but the shape is the same: a trusted app identity used from the wrong place.

Check service principal and non-interactive sign-in logs for 199.19.77.84, the operator address Todyl names, and block that single IP for workload identities in conditional access. Remove unknown secrets, certificates and federated credentials, then rotate anything in Key Vaults those apps could read. Longer term, retire client secrets in favor of certificates or [workload identity federation](https://startwithidentity.com/glossary/workload-identity-federation/). The technique page is [static API key abuse](https://startwithidentity.com/techniques/static-api-key-abuse/).

Source: [Todyl](https://www.todyl.com/blog/stolen-app-credentials-real-access-an-actor-is-signing-into-entra-id-and-azure-devops-as-your-workloads)