Back N-Able

M365 Service Principal credential abuse campaign, 2026-11-01. Here’s what to know.

N-Able •N-able Nightscope Threat Research Team • November 4, 2026

N-able’s Nightscope Threat Research and Adlumin MDR teams are tracking reports of an unknown actor attempting to abuse service principal credentials to access MSP and MSP customer Entra and Microsoft 365 environments. While the full intent and scope of the adversary’s activity is not fully understood, we are taking proactive steps to protect our partners and customers.

The Adlumin MDR detection engineering and Nightscope Threat Research teams have implemented detection capability for activity linked to known key indicators associated with this suspected malicious behavior. Adlumin MDR partners and clients can find this listed in the Adlumin MDR platform under the detection title “Unknown Adversary Targeting Microsoft 365 / Entra ID Service Principals”.

We have also engaged in threat hunt activity to identify any potential behavior associated with this activity cluster. If any associated activity is found, we will proactively reach out to our partners and customers.

N-able’s information security experts are monitoring this case for developments and will continue to updates as more details emerge.

Indicators of compromise

Our industry peers, including Todyl, have shared some key indicators for this cluster of activity.

What our partners should do

Review Entra ID sign-in audit events for Service Principal authentication events involving the observed key indicators. Take extra steps to follow the Correlation ID or issued token activity associated with that authentication to assess business risk stemming from any unauthorized access, conducting appropriate investigation and remediation as needed.

Implement Entra Conditional Access Policies that block authentication attempts for users and Service Principals (where licensing allows) from the IPv4 addresses using named locations.

Regularly review Microsoft 365 apps configured within your environment and their associated Service Principals. Any that are not currently in use or needed should be disabled. Also disable any that are unrecognized.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Ongoing Credential Abuse Campaign Targets MSPs via Microsoft Entra ID Since November 1, 2026, a cyber campaign has been exploiting stolen application credentials to access Microsoft Entra ID and Azure DevOps environments of managed service providers (MSPs) and their clients. The threat actor has successfully authenticated to at least 33 out of 45 targeted app registrations across 18 organizations, accessing 27 organizations, including clients in various sectors such as government and energy. The attack method involves using valid application credentials to bypass multi-factor authentication (MFA) and Conditional Access policies, allowing the attacker to operate as a trusted application. As of November 3, the actor has downloaded 81 files and accessed approximately 2,300 mailbox items. The activity is ongoing, with researchers actively monitoring and investigating the situation. The attack is attributed to a single operator using a virtual private server, with activity traced back to an IP address in Poland. No Microsoft vulnerabilities are involved, and the stolen credentials appear to have been harvested prior to the attack. 4 sources 73

Extracted Entities

M365 Service Principal credential abuse campaign, 2026-11-01. Here’s what to know.

The full story

Extracted Entities

Attack Types (1)

Campaigns (1)

Platforms (2)