Malwarebytes email access via abused Microsoft 365 application
Malwarebytes disclosed on January 19, 2021 that the actor behind the SolarWinds breach abused applications with privileged access to its Microsoft Office 365 and Azure environments. The attacker added a self-signed certificate with credentials to a service principal and used it to read a limited subset of internal email through Microsoft Graph. Microsoft alerted Malwarebytes on December 15, 2020; Malwarebytes does not use SolarWinds.
- Victim
- Malwarebytes
- Industry
- Technology
- Country
- United States
- Intrusion began
- Dec 2020
- First disclosed
- Jan 19, 2021
- Actor
- SolarWinds Orion threat actor (Nobelium) (Nation-state)
- Initial access
- OAuth token abuse
- Identity control that failed
- Non-human identity
- MFA
- Not applicable (no interactive login)
- Abused identity
- Non-human (service account, token, key or app)
- Records affected
- Not disclosed
- Disclosed cost
- Not disclosed
The identity lesson
Monitoring for new credentials added to service principals, and removing unneeded mail-read permissions from applications, would have flagged or blocked this path.
Go deeper on SWI
- Product involved: Microsoft Entra ID
Sources
- Malwarebytes targeted by Nation State Actor implicated in SolarWinds breach. Evidence suggests abuse of privileged access to Microsoft Office 365 and Azure environments, Malwarebytes, Jan 19, 2021
- Malwarebytes breached by SolarWinds hackers, TechTarget SearchSecurity, Jan 19, 2021
Record verified Oct 31, 2026 against the sources above. Corrections: contact us.
Related incidents
- GitHub private repositories accessed with stolen Heroku and Travis CI OAuth tokens 2022 · OAuth token abuse
- Mimecast Microsoft 365 connection certificate stolen by SolarWinds actor 2021 · Supply chain
- CrowdSec private repositories copied with a departing engineer's GitHub token 2026 · OAuth token abuse
- Gainsight-published Salesforce app tokens abused against customer instances 2025 · OAuth token abuse
Cite this record
SWI Community Team. (2026). Malwarebytes email access via abused Microsoft 365 application. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/incidents/2021-malwarebytes-service-principal-abuse/
Part of the Identity Breach Database, free to reuse under CC BY 4.0. Analysis across every record: Identity Breach Report 2026.