Attackers abuse stolen Microsoft Entra ID and Azure DevOps credentials to reach 27 organisations
BREACHMicrosoft 365redteam/daily · 1 source
- Severity
- High
- Sources
- 1
What happened
An ongoing campaign since 1 November 2026 has abused stolen Microsoft Entra ID application credentials and Azure DevOps identities to access Microsoft 365 and Azure environments, targeting managed service providers and their customers. Investigators recorded searches across about 25 tenants, downloads of 81 files and access to roughly 2,279 mailbox items, including password lists and private keys. App-only sign-ins are not covered by user-focused Conditional Access or MFA prompts, so workload-specific policies are needed.
For IT people · Written by AI from 1 source · Wrong?
What to do
- Review service-principal and non-interactive sign-ins, including failed attempts, for the source address 199.19.77.84.
- Block the exact address 199.19.77.84 rather than its entire hosting network.
- Disable affected applications where needed, remove compromised credentials and revoke user sessions.
- Rotate secrets held in accessible vaults and documents, and apply workload-specific Conditional Access.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Cyber Security News
Who and what is in it
Products