---
title: Hunt: one operator is signing in to MSPs' Entra ID and Azure DevOps as their own apps with stolen secrets, then fanning out to client tenants | ctxsec
url: https://ctxsec.com/items/hunt-todyl-stolen-entra-app-secrets-msp-service-principal-sign-ins-key-vault
description: "Todyl says that since Nov 1 a single operator has used a stockpile of stolen, still-valid app secrets (plus an Azure DevOps federated workload identity and replayed session tokens) to sign in as service principals. About 45 app registrations at roughly 18 organizations were targeted, over 33 authenticated, and through MSP multi-tenant and GDAP apps the actor reached 27 organizations, ran wildcard Graph searches across about 25 tenants, downloaded 81 files and touched about 2,279 mailbox items. It requests ARM and Key Vault tokens almost immediately, and new apps start authenticating minutes later. Files taken focus on password lists, private keys, VPN profiles, MFA/RMM API keys and backup credentials. No Microsoft vulnerability is involved; how the seed secrets were stolen is unknown. Todyl assesses it as unrelated to the October ConnectWise/SkyKick compromise."
status: "confirmed research (Todyl MXDR incident write-up, published Nov 3, updated Nov 4); unattributed"
published: 2026-11-04
---

> Todyl says that since Nov 1 a single operator has used a stockpile of stolen, still-valid app secrets (plus an Azure DevOps federated workload identity and replayed session tokens) to sign in as service principals. About 45 app registrations at roughly 18 organizations were targeted, over 33 authenticated, and through MSP multi-tenant and GDAP apps the actor reached 27 organizations, ran wildcard Graph searches across about 25 tenants, downloaded 81 files and touched about 2,279 mailbox items. It requests ARM and Key Vault tokens almost immediately, and new apps start authenticating minutes later. Files taken focus on password lists, private keys, VPN profiles, MFA/RMM API keys and backup credentials. No Microsoft vulnerability is involved; how the seed secrets were stolen is unknown. Todyl assesses it as unrelated to the October ConnectWise/SkyKick compromise.

[← Threat Hunting](/hunting) · [markdown](/items/hunt-todyl-stolen-entra-app-secrets-msp-service-principal-sign-ins-key-vault.md)

confirmed research (Todyl MXDR incident write-up, published Nov 3, updated Nov 4); unattributed

2026-11-04

### Hunt: one operator is signing in to MSPs' Entra ID and Azure DevOps as their own apps with stolen secrets, then fanning out to client tenants

- **IP:** `199.19.77.84` (high confidence, all confirmed sign-ins, downloads and token replays, Nov 1-3). Lower confidence: `199.19.77.18` and `65.87.223.26` (Azure CLI password spray); range `199.19.77.0/24` on AS203662.
- **Entra sign-in logs (service principal):** app sign-ins from hosting IPs; an app requesting ARM then Key Vault tokens within seconds, often followed by Graph, Storage and Cognitive Services tokens; apps that had never signed in before suddenly authenticating.
- **Activity:** single-wildcard (`*`) Graph searches; SharePoint downloads at about one file per second; Partner Center tokens issued to MSP apps; switch from curl/Python user agents to spoofed browser strings.
- **Respond:** rotate secrets and certificates for every app in the affected tenant and in client tenants it can reach, then rotate whatever was in Key Vault and in downloaded files (VPN, RMM, MFA, backup, firewall). Apply Conditional Access for workload identities and block sign-ins from hosting ASNs; the actor keeps retrying old credentials and replaying refresh tokens.

Sources: [Todyl: Stolen App Credentials, Real Access: An Actor Is Signing Into Entra ID and Azure DevOps as Your Workloads](https://www.todyl.com/blog/stolen-app-credentials-real-access-an-actor-is-signing-into-entra-id-and-azure-devops-as-your-workloads)