--- id: "CMP-202611-codckf" kind: "campaign" aliases: [] title: "Attackers sign in to Microsoft Entra ID and Azure DevOps as app service principals using stolen client secrets, hitting MSPs and their customer tenants to loot Key Vault and files (Todyl, Huntress)" severity: "high" cvss: null epss: null exploited: true status: "open" category: "infrastructure" products: [{"name": "Microsoft Entra ID", "fixed": [], "vendor": "Microsoft"}, {"name": "Azure DevOps", "fixed": [], "vendor": "Microsoft"}, {"name": "Azure Key Vault", "fixed": [], "vendor": "Microsoft"}, {"name": "Microsoft Partner Center", "fixed": [], "vendor": "Microsoft"}] ecosystems: [] tags: ["campaign", "early-warning"] not_affected_if: [] published_at: null first_seen_at: "2026-11-03T22:18:40+00:00" updated_at: "2026-11-03T22:20:19+00:00" sources: [{"source": "analyst", "url": null, "first_seen_at": "2026-11-03T22:18:40+00:00"}] --- # Attackers sign in to Microsoft Entra ID and Azure DevOps as app service principals using stolen client secrets, hitting MSPs and their customer tenants to loot Key Vault and files (Todyl, Huntress) Since 1 Nov 2026 an unknown actor has been signing in to Microsoft Entra ID as application service principals with valid, pre-existing client secrets and, in at least one case, a workload identity federated credential tied to Azure DevOps. Because these are app sign-ins there is no MFA and user Conditional Access does not apply. Per app the actor goes to Azure Resource Manager, then Key Vault, Storage, Microsoft Graph and Partner Center, downloads Microsoft 365 files (keys, API credentials, client documents) and leaves quickly with no persistence seen. Two users' Azure DevOps sessions were replayed on 2 Nov. In at least one case, access to an MSP was followed within seconds by access to downstream customer tenants via delegated admin. Todyl reports multiple unrelated organisations including MSPs; Huntress separately confirms the same activity in 4 customer tenants. Todyl also sees unauthorised AI model (Claude) usage at affected orgs, possibly from AI keys stored in Key Vault (moderate confidence). How the secrets were stolen and who is behind it are unknown; possible links to Storm-0940/SkyKick and the trojanized Claude Code extension are unconfirmed. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - :Microsoft Entra ID affected ? fixed ? - :Azure DevOps affected ? fixed ? - :Azure Key Vault affected ? fixed ? - :Microsoft Partner Center affected ? fixed ? ## How to check Search Entra service principal and non-interactive sign-in logs (AADServicePrincipalSignInLogs, AADNonInteractiveUserSignInLogs) for IP 199.19.77.84 (AS203662, 3K33 sp. z o.o., Poland), seen 1-3 Nov 2026 UTC; search as far back as retention allows. Failed AADSTS7000215 (invalid secret) or AADSTS7000222 (expired secret) from that IP means someone holds a credential for your app; a failure followed by a success is urgent. Check Azure DevOps audit logs by IP for PAT creation/use, federated service connections and pipeline edits. Alert on one address authenticating to 3+ service principals in a tenant with mixed success, or one app fanning out across ARM, Key Vault, Storage and Graph in a short window. Do not block the whole ASN; other addresses there are unrelated. ## Fix Block 199.19.77.84/32 in a Conditional Access policy for workload identities (assign directly to service principals) and in a user-scoped block policy for replayed sessions. If you find the IP: remove all client secrets, certificates and federated credentials on the affected app (watch for ones you did not add), disable the service principal if needed, revoke affected users' Entra sessions, Azure DevOps PATs and SSH keys, rotate every secret in reachable Key Vaults and Storage (including AI API keys), review the app's API permissions, RBAC roles, Partner Center/GDAP access and Azure DevOps service connections, and set AI usage quotas and cost alerts. Treat confirmed access as a data-exposure event. ## Timeline - 2026-11-03T22:18:40+00:00 analyst ## Documents - [describes] @HuntressLabs: Huntress is investigating malicious Entra service principal sign-ins from 199.19 https://x.com/HuntressLabs/status/2117731517304902092 - [describes] @HuntressLabs: We'll update this thread with any further observations. Read Todyl's blog for mo https://x.com/HuntressLabs/status/2117731813707973117 - [describes] Stolen App Credentials, Real Access: An Actor Is Signing Into Entra ID and Azure DevOps as Your Workloads (Todyl) https://www.todyl.com/blog/stolen-app-credentials-real-access-an-actor-is-signing-into-entra-id-and-azure-devops-as-your-workloads --- _Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_