By David Jones
Publication Date: 2026-11-04 16:20:00
This story was originally published on Cybersecurity Dive. To receive daily news and insights, subscribe to our free daily Cybersecurity Dive newsletter.
Dive Brief:
Researchers are investigating the abuse campaign of a lone hacker who has been using stolen but still-valid Microsoft Entra ID credentials to sign into Microsoft 365 and Azure environments at various managed service providers, according to a recent report by Todyl.
The hacker targeted 45 app registrations at about 18 organizations and successfully authenticated at least 33 of them. The attacker was then able to access 27 organizations, including downstream clients of these MSPs across various sectors, such as energy, government, food and agriculture, transportation and construction.
The hacker then ran searches across 25 tenants, while downloading a total of 81 files and gaining access to about 2,300 mailbox items, according to the report. Todyl researchers said hacking attempts are ongoing.
Dive Insight:
The operation in…
