Researchers Report Application Identity Abuse Targeting MSPs and Customers
Summary
Researchers report an active campaign using valid application credentials to access Microsoft Entra ID and Azure DevOps environments, with MSPs and their customers a primary focus. The credential source remains under investigation.
Key points
- Researchers observed the activity from November 1 to November 3, 2026; the source of the abused application credentials remains under investigation.
- The actor used trusted applications, MSP multi-tenant applications and Partner Center tokens to access customer environments.
- After authenticating, the operator retrieved stored secrets and credentials, then searched mailboxes and file stores across multiple tenants for credentials and configuration details.
- Researchers observed attempts involving Granular Delegated Admin Privileges applications and replayed user refresh tokens; Conditional Access blocked every observed token replay on November 3.
- The article says application sign-ins can evade user-focused MFA and Conditional Access policies, while broadly permissioned applications may expose credentials for VPNs, RMM tools, backups and firewalls.
- Recommended actions include reviewing service-principal sign-in logs and permissions, rotating exposed credentials, revoking affected sessions and tokens, and restricting access to Key Vault and Storage.
Article Details
- Event Type
- Ongoing intrusion campaign abusing valid application credentials to access Microsoft Entra ID and Azure DevOps environments, including MSP and customer tenants.
- Impact
- The operator accessed application-held secrets and credentials, searched and accessed mailboxes and file stores across multiple tenants, and collected files containing credentials and configuration details for VPNs, RMM tools, backups, and firewalls. The article says these exposures could enable access beyond cloud environments, but the ultimate impact depends on what the applications could access and whether exposed credentials remain valid. Conditional Access blocked every token replay observed on November 3, 2026.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 199[.]19[.]77[.]84 | Source-identified address from which all confirmed malicious activity originated; researchers recommend blocking it. |
Vendors
MicrosoftThreat actors are authenticating directly to Microsoft Entra ID and Azure DevOps using valid application credentials, allowing them to operate as trusted applications rather than compromised users.TodylIntegration applications for security tools, including Todyl's own integration applications in two MSP tenants, were among the credentials abused, with no sign of a vendor platform compromise.
Products
Azure DevOpsThreat actors are authenticating directly to Microsoft Entra ID and Azure DevOps using valid application credentials, allowing them to operate as trusted applications rather than compromised users.Key Vaultapplication registrations and multi-tenant applications to identify which can reach multiple tenants, Key Vault, storage and administrative services, and remove unused applications and excess permissions.Microsoft Entra IDThreat actors are authenticating directly to Microsoft Entra ID and Azure DevOps using valid application credentials, allowing them to operate as trusted applications rather than compromised users.Microsoft Partner CenterThe operator used MSP multi-tenant applications and Partner Center tokens to access customer environments.