HighSystem intrusionActiveUnconfirmed· updated Nov 10
Attacker uses stolen Entra ID app credentials to sign into multiple MSPs at machine speed, reaching 27 organizations via delegated access
Security firm Todyl says that since Nov 1 an attacker has been using stolen, still-valid credentials to sign in to MSPs' Microsoft 365 and Azure environments as their own applications, targeting about 45 app registrations at roughly 18 organizations with more than 33 authenticating successfully .