Attackers abuse stolen Microsoft Entra ID and Azure DevOps credentials to reach 27 organisations
BREACHMicrosoft 365redteam/daily · 1 source
- Severity
- High
- Sources
- 1
What happened
Hackers used stolen login details for Microsoft cloud applications to get into at least 27 organisations, including government, energy and education bodies. No flaw in Microsoft's software was involved; the attacker used valid credentials to act as trusted apps. The campaign has been running since 1 November 2026.
Like I’m new · Written by AI from 1 source · Wrong?
What to do
- Review service-principal and non-interactive sign-ins, including failed attempts, for the source address 199.19.77.84.
- Block the exact address 199.19.77.84 rather than its entire hosting network.
- Disable affected applications where needed, remove compromised credentials and revoke user sessions.
- Rotate secrets held in accessible vaults and documents, and apply workload-specific Conditional Access.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Cyber Security News
Who and what is in it
Products