Attacker uses stolen Entra ID app credentials to sign into multiple MSPs at machine speed, reaching 27 organizations via delegated access

Security firm Todyl says that since Nov 1 an attacker has been using stolen, still-valid credentials to sign in to MSPs' Microsoft 365 and Azure environments as their own applications, targeting about 45 app registrations at roughly 18 organizations with more than 33 authenticating successfully ^[1][2]. Todyl says the actor has reached 27 organizations, including MSPs' downstream clients in government, energy, transportation, education and other sectors, ran searches across about 25 tenants, downloaded 81 files and accessed around 2,279 mailbox items ^[1][2]. MSPs and affected organizations should fully clean abused apps by removing their secrets, certificates and federated credentials, rotate the Key Vaults they could read and restrict sign-ins with Conditional Access, because rotation alone is not enough ^[1][2].

Industries mainly affected: Government, Education, Energy, Transportation & logistics, Professional services