Attackers abuse stolen Microsoft Entra ID and Azure DevOps credentials to reach 27 organisations
- Severity
- High
- Sources
- 1
What happened
Campaign abusing stolen Entra ID application credentials, an Azure DevOps federated workload identity and replayed user session tokens. No Microsoft vulnerability was involved and no CVE is assigned. The token sequence (Azure Resource Manager, then Key Vault, Graph and Storage) and 29 wildcard Graph searches followed by SharePoint downloads at about one file per second are useful hunting indicators; scripted clients made up 95% of sign-ins. Review service-principal and non-interactive sign-ins, including failed attempts, for 199.19.77.84 and block that exact address rather than its hosting network. Disable affected apps, remove compromised credentials, revoke sessions, rotate secrets in vaults, and deploy workload-specific Conditional Access.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- Review service-principal and non-interactive sign-ins, including failed attempts, for the source address 199.19.77.84.
- Block the exact address 199.19.77.84 rather than its entire hosting network.
- Disable affected applications where needed, remove compromised credentials and revoke user sessions.
- Rotate secrets held in accessible vaults and documents, and apply workload-specific Conditional Access.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Who and what is in it
Products