Actor signs in to Entra ID as applications with stolen client secrets
Todyl reported on November 3, 2026 that from November 1 one operator signed in to Microsoft Entra ID as applications using stolen client secrets, targeting about 45 app registrations at roughly 18 organizations, authenticating to more than 33 and reaching 27 organizations, including MSP clients through multi-tenant and GDAP apps. The actor requested Azure Resource Manager, Key Vault, Graph and Storage tokens, searched about 25 tenants and later replayed refresh tokens. Todyl says no Microsoft vulnerability is involved and how the secrets were obtained is unknown.
- Victim
- Multiple: 27 organizations, including downstream clients of managed service providers
- Industry
- Cross-industry
- Country
- Global
- Intrusion began
- Nov 1, 2026
- First disclosed
- Nov 3, 2026
- Actor
- Unattributed
- Initial access
- Stolen credentials
- Identity control that failed
- Non-human identity
- MFA
- Not applicable (no interactive login)
- Abused identity
- Non-human (service account, token, key or app)
- Records affected
- Not disclosed
- Disclosed cost
- Not disclosed
The identity lesson
An app registration that signs in with a client secret has no MFA step to fail, so a valid secret is the app. Retiring client secrets for managed identities or workload identity federation, and conditional access for workload identities that blocks sign-ins from unexpected networks, would have contained it.
Go deeper on SWI
- Product involved: Microsoft Entra ID
- SWI coverage: actor signs in as entra id apps with stolen secrets across 27 organizations
Sources
- Stolen App Credentials, Real Access: An Actor Is Signing Into Entra ID and Azure DevOps as Your Workloads, Todyl, Nov 3, 2026
Record verified Nov 5, 2026 against the sources above. Corrections: contact us.
Related incidents
- Snowflake customer tenant extortion campaign (UNC5537) 2024 · Stolen credentials
- Dropbox Sign production breach via a compromised service account 2024 · Stolen credentials
- Cloudflare Atlassian intrusion with credentials left unrotated after the Okta breach 2024 · Stolen credentials
- GitHub repositories cloned with a compromised machine-account token 2023 · Stolen credentials
Cite this record
SWI Community Team. (2026). Actor signs in to Entra ID as applications with stolen client secrets. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/incidents/2026-entra-id-stolen-app-secrets-27-orgs/
Part of the Identity Breach Database, free to reuse under CC BY 4.0. Analysis across every record: Identity Breach Report 2026.