Stolen Entra app secrets used against 27 organizations, many through MSP apps

How it happened

The operator signs in as applications with valid secrets, not as people. Todyl lists client secrets for in-house, MSP and integration apps, an Azure DevOps federated workload identity, and replayed session and refresh tokens, and says no Microsoft vulnerability is involved. Microsoft says actors using the agentic tool ARTEX searched public GitHub for exposed OAuth application secrets and AI keys, and that in at least one case a vendor's multi-tenant app credential gave access to downstream customer tenants. Todyl, relying on Microsoft's findings, now assesses the activity as an automated credential crawler and attributes the credentials to harvesting from public GitHub. Todyl's earlier updates said the source was unknown.[1][3] Checked 8 Nov 2026

What was stolen

Todyl counts 81 files downloaded and about 2,279 mailbox items accessed, and says these figures are a floor because they cover only organizations that send logs to Todyl. Microsoft reports credential and data theft, including from Azure Key Vault and Storage, and abuse of Azure AI services. Whether Key Vault was actually read in the Todyl cases is not confirmed.[1][3] Checked 8 Nov 2026

Who was impacted

Todyl reports about 45 app registrations targeted at roughly 18 organizations, more than 33 authenticating successfully, and 27 organizations reached, including downstream clients of managed service providers. Sectors named include government, energy, food and agriculture, transportation, and construction and engineering. Microsoft gives no total number of victims.[1][2][3] Checked 8 Nov 2026

Threat actor

Not attributed. No named actor. Todyl describes a single operator. Microsoft says only that unnamed threat actors used ARTEX and that the related network indicators are unattributed.

Timeline

1. 28 Oct 2026Earliest service principal sign-ins from the operator IP address that Microsoft observed. [3]
2. 1 Nov 2026First access with a stolen app credential at 08:45 UTC, according to Todyl. The Azure DevOps federated workload identity is used at 14:39 UTC. [1]
3. 3 Nov 2026Todyl publishes its report. A sweep of 15 client tenants by one multi-tenant app is recorded that morning, and the latest attempt at 21:31 UTC is blocked. [1]
4. 4 Nov 2026Cybersecurity Dive reports Todyl's counts. [2]
5. 5 Nov 2026Microsoft publishes research on threat actors using agentic AI tooling to find and abuse exposed secrets, and cites Todyl's report for the same IP address. [3]