One actor signed in as Entra ID apps with stolen secrets and reached 27 organizations, Todyl says
Todyl is tracking an ongoing campaign in which one operator uses stolen client secrets to sign in to Microsoft Entra ID as app registrations, reaching 27 organizations including MSP clients, searching mail and downloading files. No Microsoft vulnerability is involved.
Security firm Todyl reported on November 3 an ongoing campaign in which one operator signs in to Microsoft Entra ID as applications, using stolen client secrets for app registrations. The actor tried about 45 app registrations at roughly 18 organizations, authenticated to more than 33 and has reached 27 organizations, including downstream clients of managed service providers. From November 1 it requested Azure Resource Manager and Key Vault tokens, then Graph, Storage and Cognitive Services tokens, ran Graph searches across about 25 tenants, downloaded 81 files and accessed about 2,279 mailbox items. It also used an Azure DevOps federated workload identity and replayed two users' DevOps session tokens. Scripted clients made 95% of sign-ins. Todyl says no Microsoft vulnerability is involved, how the secrets were obtained is unknown, and its counts are a floor.
Why it matters
Todyl's summary is blunt: "If the credential is valid, the app is in." A service principal signing in with a client secret has no MFA prompt to fail, and MSP multi-tenant and GDAP relationships turn one provider's app into a route to its customers. Todyl assesses the activity as unrelated to Storm-0940's ConnectWise campaign, but the shape is the same: a trusted app identity used from the wrong place.
Check service principal and non-interactive sign-in logs for 199.19.77.84, the operator address Todyl names, and block that single IP for workload identities in conditional access. Remove unknown secrets, certificates and federated credentials, then rotate anything in Key Vaults those apps could read. Longer term, retire client secrets in favor of certificates or workload identity federation. The technique page is static API key abuse.
Source: Todyl
Related on Start with Identity
- BlogOne scanner posed as 32 AI bots to hunt for .env files and SSH keys, Cequence says
Cequence's CQ Prime research team said on October 28 that a single actor rotated through about 32 claimed AI crawler and assistant identities, from OpenAI to Pe
- BlogGoogle: LLMjacking starts with stolen cloud identities and has cost some companies $1 million
Google Threat Intelligence Group and Mandiant say LLMjacking intrusions ran up more than $100,000 in fraudulent AI charges in a day and $1 million in total at s
- BlogInfisical raises a $40 million Series B to build secrets and credential access for AI agents
Infisical announced a $40 million Series B on October 27 at a $600 million valuation, led by Elad Gil. The open-source secrets company says it will invest in se
- CVEtj-actions/changed-files tags repointed to dump CI secrets into logs
An attacker repointed tj-actions/changed-files version tags to a commit that read the GitHub Actions runner's memory and printed its secrets into workflow logs.
- CVECommvault Web Server zero-day that exposed Metallic Microsoft 365 app secrets
An authenticated webshell flaw in Commvault Web Server, used as a zero-day in Commvault's Azure environment, where the actor may have reached client secrets cus
- ReportIdentity Breach Report 2026: how attackers get in
120 identity breaches, 2021 to 2026: MFA was bypassed in 25 of the 40 with a known MFA status, and 45.8% of 2025-2026 cases had no login for MFA to protect.