'Key Eater' Campaign Abuses Stolen Microsoft Entra ID App Credentials to Breach 27 Organizations via MSPs
Todyl's MXDR team identified an ongoing campaign dubbed Key Eater, active since November 1, 2026, in which attackers use stolen Microsoft Entra ID application credentials to breach Microsoft 365 and Azure environments through managed service providers (MSPs) and their downstream clients. The campaign has impacted 27 organizations, targeting roughly 45 app registrations across 18 organizations and successfully authenticating into more than 33. No Microsoft vulnerabilities were exploited; instead, the attacker authenticates as legitimate applications using valid secrets, abusing Azure DevOps federated workload identity and replaying session tokens. Victims span government, energy, agriculture, transportation, engineering, legal, education, and nonprofit sectors, with 81 files downloaded and ~2,279 mailbox items accessed.
Detalhes técnicos
For nearly every stolen credential, the operator requests an Azure Resource Manager token followed by a Key Vault token, then often Microsoft Graph, Storage, and Cognitive Services tokens within seconds. Previously unused applications begin authenticating within minutes, suggesting harvested secrets enable further access. The attacker executed 29 single-wildcard Microsoft Graph searches across ~25 tenants and downloaded SharePoint files at roughly one per second, collecting password lists, private keys, VPN profiles, MFA and remote monitoring API keys, backup credentials, firewall configurations, and service-account maps. One multi-tenant MSP application swept 15 customer tenants in ~10-second loops. Scripted clients accounted for 95% of sign-ins, with a single operator believed to control scripted tooling from a VPS; AI assistance is a low-confidence possibility. After detections on November 3, the attacker spoofed browser user agents to replace curl/Python signatures and replayed multiple users' refresh tokens, though Conditional Access blocked all observed replays. Four AI-service tokens were issued across two MSPs, possibly indicating LLMjacking, though resource consumption was not confirmed. The confirmed operator IP is 199.19.77.84, with user agents task177-f2267/1.0 and sait-tenant-deep/37346.
Remediação
Administrators should investigate both successful and failed service-principal sign-ins, preserve audit logs, disable compromised applications, and rotate exposed application and downstream credentials. User-focused Conditional Access alone does not protect against app-only authentication abuse. There is no evidence of persistence or compromise of the vendor platform itself, and attribution plus the initial credential theft mechanism remain unresolved, with potential additional victims outside monitored environments.
Linha do tempo
-
'Key Eater' Campaign Abuses Stolen Microsoft Entra ID App Credentials to Breach 27 Organizations via MSPs
ler a análise desta fonte ocultar
Todyl's MXDR team identified an ongoing campaign dubbed Key Eater, active since November 1, 2026, in which attackers use stolen Microsoft Entra ID application credentials to breach Microsoft 365 and Azure environments through managed service providers (MSPs) and their downstream clients. The campaign has impacted 27 organizations, targeting roughly 45 app registrations across 18 organizations and successfully authenticating into more than 33. No Microsoft vulnerabilities were exploited; instead, the attacker authenticates as legitimate applications using valid secrets, abusing Azure DevOps federated workload identity and replaying session tokens. Victims span government, energy, agriculture, transportation, engineering, legal, education, and nonprofit sectors, with 81 files downloaded and ~2,279 mailbox items accessed.
Technical Details
For nearly every stolen credential, the operator requests an Azure Resource Manager token followed by a Key Vault token, then often Microsoft Graph, Storage, and Cognitive Services tokens within seconds. Previously unused applications begin authenticating within minutes, suggesting harvested secrets enable further access. The attacker executed 29 single-wildcard Microsoft Graph searches across ~25 tenants and downloaded SharePoint files at roughly one per second, collecting password lists, private keys, VPN profiles, MFA and remote monitoring API keys, backup credentials, firewall configurations, and service-account maps. One multi-tenant MSP application swept 15 customer tenants in ~10-second loops. Scripted clients accounted for 95% of sign-ins, with a single operator believed to control scripted tooling from a VPS; AI assistance is a low-confidence possibility. After detections on November 3, the attacker spoofed browser user agents to replace curl/Python signatures and replayed multiple users' refresh tokens, though Conditional Access blocked all observed replays. Four AI-service tokens were issued across two MSPs, possibly indicating LLMjacking, though resource consumption was not confirmed. The confirmed operator IP is 199.19.77.84, with user agents task177-f2267/1.0 and sait-tenant-deep/37346.
Remediation
Administrators should investigate both successful and failed service-principal sign-ins, preserve audit logs, disable compromised applications, and rotate exposed application and downstream credentials. User-focused Conditional Access alone does not protect against app-only authentication abuse. There is no evidence of persistence or compromise of the vendor platform itself, and attribution plus the initial credential theft mechanism remain unresolved, with potential additional victims outside monitored environments.