Attackers sign in to Microsoft Entra ID and Azure DevOps as app service principals using stolen client secrets, hitting MSPs and their customer tenants to loot Key Vault and files (Todyl, Huntress)

Since 1 Nov 2026 an unknown actor has been signing in to Microsoft Entra ID as application service principals with valid, pre-existing client secrets and, in at least one case, a workload identity federated credential tied to Azure DevOps. Because these are app sign-ins there is no MFA and user Conditional Access does not apply. Per app the actor goes to Azure Resource Manager, then Key Vault, Storage, Microsoft Graph and Partner Center, downloads Microsoft 365 files (keys, API credentials, client documents) and leaves quickly with no persistence seen. Two users' Azure DevOps sessions were replayed on 2 Nov. In at least one case, access to an MSP was followed within seconds by access to downstream customer tenants via delegated admin. Todyl reports multiple unrelated organisations including MSPs; Huntress separately confirms the same activity in 4 customer tenants. Todyl also sees unauthorised AI model (Claude) usage at affected orgs, possibly from AI keys stored in Key Vault (moderate confidence). How the secrets were stolen and who is behind it are unknown; possible links to Storm-0940/SkyKick and the trojanized Claude Code extension are unconfirmed.

Summary written from the sources below. Check the originals before acting.