Stolen App Credentials, Real Access: An Actor Is Signing Into Entra ID and Azure DevOps as Your Workloads | Todyl
An ongoing identity attack is using stolen, still-valid credentials for Microsoft Entra ID service principals to sign in to MSP and customer Microsoft 365 and Azure environments, including Azure DevOps. Around 27 organizations are confirmed affected so far, spanning government, energy, legal, education and other sectors, and the activity continues with numbers likely understated. Because these are app sign-ins, MFA and user-scoped Conditional Access do not apply, so affected organizations should rotate exposed secrets, review audit logs and apply the recommended blocks.
Continue on todyl.com ↗ ‹ All news Get the newsletter
The summary and image come from Pro CISO; the image is shown from their website.