Threat actors have compromised 27 different organizations by abusing stolen Microsoft Entra ID and Azure DevOps credentials. Security reports highlight that the application identity abuse specifically targeted managed service providers (MSPs) and downstream client environments, allowing attackers to infiltrate corporate networks and exfiltrate sensitive data.
By leveraging illicitly obtained application credentials, the malicious actors gained unauthorized access to enterprise cloud resources and development platforms. The multi-organization campaign underscores ongoing risks associated with identity and access management vulnerabilities, as well as the cascading impact when provider-level credentials are compromised.
Security researchers and industry analysts advise organizations to review their identity federation settings, monitor for anomalous application permission grants, and enforce rigorous multi-factor authentication and credential rotation protocols to mitigate similar threats.
