A single operator has used stolen Microsoft cloud credentials to break into at least 27 organisations through their IT providers, security researchers say — without exploiting any flaw in Microsoft's software at all.

Disclosed on 3 November by cybersecurity firm Todyl, the campaign began on 1 November and was still active at the firm's last update. The attacker targeted managed service providers (MSPs) and then reached downstream customers across government, energy, transport, legal, education and other sectors.

Trusted app identities, not stolen passwords

Instead of phishing employees, the attacker signed in as the organisations' own software. Microsoft Entra ID lets applications sign in with their own credentials, known as client secrets. It held valid secrets for about 45 application registrations across roughly 18 organisations and authenticated with more than 33.

Once inside, the operator requested Azure Resource Manager tokens, then moved on to Key Vault, Microsoft Graph and Storage. It also used an Azure DevOps federated workload identity in one case. Todyl says Conditional Access blocked every observed session-token replay on 3 November.

What was accessed

Within Todyl's telemetry, the attacker searched about 25 tenants, downloaded 81 files and accessed around 2,279 mailbox items. Those figures are a floor: they cover only environments that send logs to Todyl.

Todyl stresses no Microsoft vulnerability was involved. The source of the stolen credentials is unknown, and the firm assesses the activity as unrelated to the October ConnectWise Cloud Backup compromise attributed to Storm-0940. No persistence was seen in affected tenants.

For defenders, the warning is practical: application credentials do not trigger user multi-factor authentication, so a stolen client secret can walk straight past the controls that stop password attacks. Todyl advises reviewing service-principal sign-ins and has published the confirmed source address, 199.19.77.84, for defenders to check.

Sources: Todyl Threat Research, Stolen App Credentials, Real Access: An Actor Is Signing Into Entra ID and Azure DevOps as Your Workloads, 3 November 2026; Cybersecurity Dive, 4 November 2026; CyberSecurityNews, 4 November 2026.