Ongoing Credential Abuse Campaign Targets MSPs via Microsoft Entra ID

• •Threat actor exploits stolen application credentials to access MSP environments.
• •Bypasses MFA and Conditional Access by authenticating as trusted applications.
• •Ongoing activity has affected 27 organizations, including various sectors.

Since November 1, 2026, a cyber campaign has been exploiting stolen application credentials to access Microsoft Entra ID and Azure DevOps environments of managed service providers (MSPs) and their clients. The threat actor has successfully authenticated to at least 33 out of 45 targeted app registrations across 18 organizations, accessing 27 organizations, including clients in various sectors such as government and energy. The attack method involves using valid application credentials to bypass multi-factor authentication (MFA) and Conditional Access policies, allowing the attacker to operate as a trusted application. As of November 3, the actor has downloaded 81 files and accessed approximately 2,300 mailbox items. The activity is ongoing, with researchers actively monitoring and investigating the situation. The attack is attributed to a single operator using a virtual private server, with activity traced back to an IP address in Poland. No Microsoft vulnerabilities are involved, and the stolen credentials appear to have been harvested prior to the attack.