Hackers Use Stolen Microsoft Entra ID App Credentials to Breach 27 Organizations and Steal Sensitive Data

Hackers are exploiting stolen Microsoft Entra ID application credentials to infiltrate Microsoft 365 and Azure environments, impacting 27 organizations via managed service providers (MSPs) and their downstream clients.

Todyl’s MXDR team is monitoring this ongoing campaign, referred to as Key Eater. Since November 1, 2026, the attackers have targeted approximately 45 app registrations across about 18 organizations, successfully authenticating into more than 33 of them.

Investigators noted that attackers downloaded 81 files and accessed about 2,279 mailbox items. No vulnerabilities in Microsoft’s systems were exploited during these breaches.

According to Todyl’s investigation, victims span government, energy, agriculture, transportation, engineering, legal, education, and nonprofit organizations. The figures represent only environments visible through its telemetry.

Hackers Use Stolen Microsoft Entra ID App Credentials

Rather than compromising individual accounts first, the attacker authenticates as legitimate applications using valid secrets. Investigators also identified abuse of an Azure DevOps federated workload identity and replay of a user’s Azure DevOps session token.

For nearly every credential, the operator requests an Azure Resource Manager token followed by a Key Vault token. Requests for Microsoft Graph, Storage, and Cognitive Services tokens frequently follow within seconds.

Previously unused applications then begin authenticating within minutes. This suggests harvested secrets enable additional access, although Key Vault audit logs are required to confirm the source. Related Entra ID attacks illustrate why cloud identities and accessible secret stores require scrutiny.

The attacker executed 29 single-wildcard Microsoft Graph searches across approximately 25 tenants before downloading SharePoint files at roughly one per second.

Collected material included password lists, private keys, VPN profiles, MFA and remote monitoring API keys, backup credentials, firewall configurations, and service-account maps. Such information could enable follow-on intrusions beyond Microsoft 365.

MSP integrations amplified exposure. One multi-tenant application swept 15 customer tenants in approximately 10-second loops.

Despite its speed, Todyl says the activity is not a worm. Evidence indicates one operator controlling scripted tooling from a VPS, using previously stolen credentials and expanding within MSP customer groups. Scripted clients accounted for 95% of sign-ins. AI assistance remains a low-confidence possibility, not a confirmed finding.

After detections triggered on November 3, the attacker replaced curl and Python signatures with spoofed browser user agents. Later attempts replayed multiple users’ refresh tokens; Conditional Access blocked every observed replay that day. Similar Microsoft 365 token replay attacks demonstrate the importance of investigating stolen sessions alongside application credentials.

Four AI-service tokens were issued across two MSPs. This fits possible LLMjacking, but token issuance alone does not establish resource consumption.

The confirmed operator address is 199.19.77.84. Distinctive user agents include task177-f2267/1.0 and sait-tenant-deep/37346.

Administrators should investigate both successful and failed service-principal sign-ins, preserve audit logs, turn off any compromised applications, and rotate any exposed application and downstream credentials. User-focused Conditional Access does not replace the need for controls related to app-only authentication.

We have observed no signs of persistence or compromise of the vendor platform. The attribution and the original mechanism behind the credential theft remain unresolved, and there may be additional victims outside of monitored environments.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.