An attacker is signing in to managed service providers’ (MSPs’) Microsoft 365 and Azure environments as their own applications, using stolen credentials, and using that access to reach the MSPs’ clients.
In an investigation published Nov. 3, security provider Todyl said the activity began on Nov. 1 and is ongoing. “No Microsoft vulnerability is involved,” it said.
Because the actor signed in as service principals, the identities apps use, it avoided MFA prompts and user-scoped Conditional Access policies.
The attackers successfully breached more than 33 of about 45 targeted app registrations. Through them, the actor reached 27 organizations, downloaded 81 files and accessed around 2,279 mailbox items. Todyl said the true number is likely higher, since its figures only cover organizations that send it logs.
How the attack worked
Nicholas Koken, Todyl’s head of detection engineering, said the credentials most likely came from an automated, agentic crawler picking up secrets exposed in public code repositories or web apps.
With nearly every credential, the actor requested tokens for Azure Resource Manager and Key Vault, and Todyl said Key Vault reads were one source of new credentials. In SharePoint, it downloaded files at about one per second, targeting password lists, private keys, VPN profiles, RMM API keys and backup-storage credentials.
MSPs’ multi-tenant apps and Partner Center access gave it a path into client tenants. “One compromised MSP app exposes every client it manages,” Todyl said.
Koken said the activity fits either an initial access broker or the resale of LLM API access. One Todyl partner was billed thousands of dollars within minutes of an API key being stolen, a pattern seen in attacks where criminals hijack and resell enterprise AI access.
Signs point to a single operator. Todyl now advises blocking the 199.19.77.0/24 range and 65.87.223.26, an address that ran related password sprays.
“These sign-ins go directly to Microsoft, so a firewall rule alone won’t stop them,” Koken wrote on LinkedIn, advising teams to block the addresses in Conditional Access instead.
Rotating credentials isn’t enough on its own. For an affected app, Todyl advised removing all secrets, certificates and federated credentials, and treating confirmed access as a potential data-exposure event.
MSPs should move to least-privilege, time-bound GDAP and “never store customer app secrets in runbooks, PSA/RMM notes or client documentation.”
