Cybersecurity researchers have uncovered an ongoing cyberattack campaign involving stolen Microsoft Entra ID application credentials that has affected at least 27 organizations. The campaign, tracked as “Key Eater” by cybersecurity firm Todyl, began November 1, 2026, targeting managed service providers (MSPs) and their customers across government, energy, transportation, education, legal, and nonprofit sectors. Investigators identified approximately 45 targeted application registrations across 18 organizations, with more than 33 successful authentications. Attackers accessed approximately 2,279 mailbox items and downloaded 81 files containing potentially sensitive information.
STOLEN APPLICATION CREDENTIALS BYPASS TRADITIONAL SECURITY CONTROLS
Rather than exploiting a Microsoft software vulnerability, attackers used legitimate application credentials and Azure DevOps identities to gain unauthorized access to Microsoft 365 and Azure environments. The stolen credentials allowed attackers to authenticate as trusted applications without triggering traditional user-based multifactor authentication (MFA) prompts. Investigators observed attackers requesting access tokens for Azure Resource Manager, Key Vault, Microsoft Graph, and cloud storage services. The stolen information reportedly included passwords, private keys, VPN configurations, backup credentials, and remote-access settings. In one instance, a compromised multi-tenant application enabled access across 15 customer environments, demonstrating how MSP integrations can amplify cloud security threats.
SECURITY EXPERTS URGE IMMEDIATE CREDENTIAL ROTATION
Todyl researchers warn that compromised application identities can provide attackers with extensive access to sensitive cloud resources while avoiding security controls designed primarily for human users. Organizations should immediately review Microsoft Entra ID service-principal authentication logs, investigate suspicious activity associated with IP address 199.19.77.84, revoke compromised credentials, rotate exposed application secrets, and audit third-party integrations. Security teams should also monitor unusual Microsoft Graph activity and unauthorized access to Azure Key Vault. The attacker’s identity and original method of credential theft remain unknown, highlighting the growing importance of securing non-human identities and monitoring cloud application permissions.