Hackers are using stolen Microsoft Entra ID credentials and Azure DevOps identities to gain access to Microsoft 365 and Azure environments, affecting at least 27 organizations This article explores attacks obtaining azure. . Todyl's latest investigation reveals an ongoing campaign targeting managed service providers (MSPs) and their customers since November 1, 2026.
The attack has expanded the victim base to include government, energy, agriculture, transportation, construction, legal, education, and nonprofit organizations.
Attack Chain (Source: Todyl) Their existing permissions can grant access without an MFA prompt, while user-centric Conditional Access policies do not dictate app-only authentication. Today's findings indicate no evidence of a vendor platform being compromised, even though credentials from trusted security integrations were used. Todyl's investigation reveals that attackers often initiate their cloud environment attacks by obtaining Azure Resource Manager tokens, followed by access tokens for Key Vault, Microsoft Graph, and Storage.
This sequence provides investigators with a valuable pattern to detect, especially when previously unused applications suddenly start authenticating shortly afterward. The latest update details 29 wildcard Microsoft Graph searches followed by SharePoint downloads at a rate of one file per second. The collected data included password lists, private keys, VPN profiles, backup credentials, and remote access settings.
The broader risk is reminiscent of earlier reports on compromised accounts affecting Azure DevOps and cloud resources, though that incident involved a different breach.
