Hackers Exploit Stolen Entra ID Credentials to Breach MSPs and Downstream Clients

Cybersecurity firm Todyl disclosed on November 3 that threat actors exploited stolen Microsoft Entra ID App Registration credentials to target managed service providers (MSPs). The investigation revealed that attacks began on November 1, with attackers targeting 45 application registrations across 18 organizations, successfully authenticating 33 of them and accessing environments belonging to 27 organizations. Downstream victims spanned sectors including construction, transportation, government, energy, and agriculture. Todyl observed that roughly 95% of login attempts were driven by automation scripts capable of 24 attempts within 10 seconds. Upon gaining entry, the tools requested tokens for Azure Resource Manager, Key Vault, Microsoft Graph, and Cognitive Services within seconds. Attackers searched 25 tenant environments, downloaded 81 files, and accessed approximately 2,279 mailbox records. Todyl noted the attack resembled a self-propagating worm and may have leveraged AI assistance, though no specific framework was identified, warning that rotating credentials alone is insufficient and access routes must be restricted.

Key takeaways

• Attackers used stolen Entra ID credentials across 18 organizations, successfully accessing 27 environments including construction and government clients.
• Approximately 95% of logins were scripted, generating up to 24 attempts in 10 seconds and rapidly requesting core Azure tokens.
• The breach affected 25 tenants with 81 files downloaded and 2,279 mailbox records exposed; researchers advise restricting Entra ID access.