Microsoft Entra ID

Reported Context (64)

to post-exploitation activity involving the misuse of valid application credentials to access Microsoft Entra ID tenants of certain organizations and connected Azure and Microsoft 365 resources. The sign-in Chainalysis Says Attack Exposed All Users’ Credentials, Takes Services Offline
28, 2026, an agentic framework used valid leaked or stolen application credentials to access Microsoft Entra ID tenants of certain organizations and connected Azure and Microsoft 365 resources. Microsoft Details Agentic AI Attacks Using Exposed Secrets to Access Cloud Resources
Threat actors are authenticating directly to Microsoft Entra ID and Azure DevOps using valid application credentials, allowing them to operate as trusted applications rather than compromised users. Researchers Report Application Identity Abuse Targeting MSPs and Customers
In Microsoft Entra ID, a PRT supports single sign-on across integrated applications, so its compromise can extend beyond a single session and give persistent access to the victim’s identity and resources. LevelBlue Finds 70+ Instances of Device-Code Phishing Kit, Assesses Code as AI-Assisted
This retirement process applies only to Microsoft Entra ID workforce tenant authentication scenarios and not to Azure AD B2C or Microsoft Entra External ID customer identity scenarios. Microsoft Urges Entra ID Admins to Migrate Users From SMS and Voice Authentication

CVE (23)

Malware (27)

People (37)

Threat Actors (80)

MITRE ATT&CK (110)

Vendors (69)

Products (174)

Tools (56)

Industries (68)

Countries (38)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.