Key Eater: stolen Microsoft Entra ID app credentials used to breach 27 organizations through MSPs and their clients
Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 2 fontes trouxeram em 05/11/2026 00:10; os links antigos trazem para cá.
A campaign dubbed Key Eater, identified by the Todyl MXDR team and active since November 1, 2026, abuses stolen Microsoft Entra ID application credentials to break into Microsoft 365 and Azure environments of managed service providers (MSPs) and their downstream clients (gbhackers.com). 27 organizations are reported impacted across government, energy, agriculture, transportation, engineering, legal, education and nonprofit sectors, with 81 files downloaded and about 2,279 mailbox items accessed (gbhackers.com). No Microsoft vulnerability is exploited: the attacker authenticates as legitimate applications with valid secrets, which makes signature-based detection harder (gbhackers.com, cybersecuritydive.com). Attribution and the initial credential-theft mechanism remain unresolved, and more victims may exist outside monitored environments (gbhackers.com). There is no evidence of persistence or of compromise of the vendor platform itself (gbhackers.com).
Detalhes técnicos
- Scope: about 45 app registrations were targeted across 18 organizations, with successful authentication into more than 33 (gbhackers.com).
- Technique: the attacker abuses Azure DevOps federated workload identity and replays session tokens (gbhackers.com).
- Token pattern: for nearly every stolen credential, the operator requests an Azure Resource Manager token, then a Key Vault token, and often Microsoft Graph, Storage and Cognitive Services tokens within seconds. Previously unused applications begin authenticating within minutes, suggesting harvested secrets enable further access (gbhackers.com).
- Data collection: 29 single-wildcard Microsoft Graph searches ran across about 25 tenants. SharePoint files were downloaded at roughly one per second, including password lists, private keys, VPN profiles, MFA and remote monitoring API keys, backup credentials, firewall configurations and service-account maps. One multi-tenant MSP application swept 15 customer tenants in loops of about 10 seconds (gbhackers.com).
- Tooling: scripted clients made up 95% of sign-ins. A single operator is believed to control the tooling from a VPS; AI assistance is a low-confidence possibility (gbhackers.com).
- Evasion: after detections on November 3, the attacker spoofed browser user agents to replace curl/Python signatures and replayed several users' refresh tokens. Conditional Access blocked all observed replays (gbhackers.com).
- Possible LLMjacking: four AI-service tokens were issued across two MSPs, but resource consumption was not confirmed (gbhackers.com).
- IOCs: operator IP 199.19.77.84; user agents task177-f2267/1.0 and sait-tenant-deep/37346 (gbhackers.com).
Remediação
- Investigate both successful and failed service-principal sign-ins, and preserve audit logs (gbhackers.com).
- Disable compromised applications and rotate exposed application and downstream credentials (gbhackers.com).
- User-focused Conditional Access alone does not protect against app-only authentication abuse (gbhackers.com).
Relatos divergentes
- Scope: cybersecuritydive.com says details on the actor, the initial access method and the number of affected organizations remain limited, and describes only multi-sector access via an MSP's clients. gbhackers.com, citing Todyl telemetry, gives the specific figures above (27 organizations) and is the more detailed and more authoritative source. Its counts of 18 organizations with targeted app registrations and 27 impacted organizations are not reconciled in the report, so the exact scope remains unconfirmed.
Linha do tempo
-
Threat Actor Abuses Microsoft Entra ID to Compromise MSP Clients via Valid Credentials
ler a análise desta fonte ocultar
An attacker has been observed abusing Microsoft Entra ID to target downstream clients of a managed service provider (MSP), using valid credentials to gain unauthorized access to organizations across multiple sectors. The campaign leverages legitimate identity infrastructure rather than exploiting a software vulnerability, making detection harder for defenders relying on signature-based tools. Details on the specific threat actor, initial access method for credential theft, and scope of affected organizations remain limited in current reporting. The incident highlights ongoing risk from supply-chain-style attacks against MSPs that provide identity and access management services to multiple downstream customers.
-
'Key Eater' Campaign Abuses Stolen Microsoft Entra ID App Credentials to Breach 27 Organizations via MSPs
ler a análise desta fonte ocultar
Todyl's MXDR team identified an ongoing campaign dubbed Key Eater, active since November 1, 2026, in which attackers use stolen Microsoft Entra ID application credentials to breach Microsoft 365 and Azure environments through managed service providers (MSPs) and their downstream clients. The campaign has impacted 27 organizations, targeting roughly 45 app registrations across 18 organizations and successfully authenticating into more than 33. No Microsoft vulnerabilities were exploited; instead, the attacker authenticates as legitimate applications using valid secrets, abusing Azure DevOps federated workload identity and replaying session tokens. Victims span government, energy, agriculture, transportation, engineering, legal, education, and nonprofit sectors, with 81 files downloaded and ~2,279 mailbox items accessed.
Technical Details
For nearly every stolen credential, the operator requests an Azure Resource Manager token followed by a Key Vault token, then often Microsoft Graph, Storage, and Cognitive Services tokens within seconds. Previously unused applications begin authenticating within minutes, suggesting harvested secrets enable further access. The attacker executed 29 single-wildcard Microsoft Graph searches across ~25 tenants and downloaded SharePoint files at roughly one per second, collecting password lists, private keys, VPN profiles, MFA and remote monitoring API keys, backup credentials, firewall configurations, and service-account maps. One multi-tenant MSP application swept 15 customer tenants in ~10-second loops. Scripted clients accounted for 95% of sign-ins, with a single operator believed to control scripted tooling from a VPS; AI assistance is a low-confidence possibility. After detections on November 3, the attacker spoofed browser user agents to replace curl/Python signatures and replayed multiple users' refresh tokens, though Conditional Access blocked all observed replays. Four AI-service tokens were issued across two MSPs, possibly indicating LLMjacking, though resource consumption was not confirmed. The confirmed operator IP is 199.19.77.84, with user agents task177-f2267/1.0 and sait-tenant-deep/37346.
Remediation
Administrators should investigate both successful and failed service-principal sign-ins, preserve audit logs, disable compromised applications, and rotate exposed application and downstream credentials. User-focused Conditional Access alone does not protect against app-only authentication abuse. There is no evidence of persistence or compromise of the vendor platform itself, and attribution plus the initial credential theft mechanism remain unresolved, with potential additional victims outside monitored environments.