Xakerlar Microsoft Entra ID ilova ma'lumotlarini o'g'irlab, Microsoft 365 va Azure muhitlariga kirib olishmoqda; bu 27 ta tashkilotga, boshqariladigan xizmat provayderlari (MSP) va ularning pastki mijozlari orqali ta'sir qilgan.
Todyl MXDR jamoasi bu davom etayotgan kampaniyani kuzatmoqda, u Key Eater deb ataladi. 2026-yil 1-noyabrdan beri hujumchilar taxminan 45 ta ilova ro'yxatga olishni, taxminan 18 ta tashkilotda nishonga olgan va ulardan 33 dan ortig'iga muvaffaqiyatli autentifikatsiya qilgan.
Tergovchilar hujumchilar 81 ta faylni yuklab olganini va taxminan 2 279 ta pochta qutisi elementiga kirganini qayd etishdi. Bu buzilishlar davomida Microsoft tizimlaridagi hech qanday zaiflikdan foydalanilmagan.
Todyl tergoviga ko'ra, jabrlanuvchilar davlat, energetika, qishloq xo'jaligi, transport, muhandislik, huquq, ta'lim va notijorat tashkilotlarini o'z ichiga oladi. Bu raqamlar faqat uning telemetriyasi orqali ko'rinadigan muhitlarni ifodalaydi.
Alohida hisoblarni avval buzish o'rniga, hujumchi haqiqiy ilovalar sifatida autentifikatsiya qiladi va haqiqiy maxfiy kalitlardan foydalanadi. Tergovchilar shuningdek, Azure DevOps federatsiyalashgan ish yuklamasi identifikatori suiiste'molini va foydalanuvchining Azure DevOps sessiya tokenini qayta ishlatishni aniqlashdi.
Deyarli har bir ma'lumot uchun operator avval Azure Resource Manager tokenini, so'ngra Key Vault tokenini so'raydi. Microsoft Graph, Storage va Cognitive Services tokenlari so'rovlari ko'pincha bir necha soniya ichida ketma-ket keladi.
Oldin foydalanilmagan ilovalar keyin bir necha daqiqa ichida autentifikatsiya qilishni boshlaydi. Bu o'g'irlangan maxfiy kalitlar qo'shimcha kirish imkonini berishini ko'rsatadi, garchi manbani tasdiqlash uchun Key Vault audit jurnallari talab qilinadi. Tegishli Entra ID hujumlari bulut identifikatorlari va ochiq maxfiy saqlash joylari tekshirilishi kerakligini ko'rsatadi.
Hujumchi SharePoint fayllarini yuklab olishdan oldin taxminan 25 ta tenantda 29 ta yagona yulduzli Microsoft Graph qidiruvini bajardi, bu taxminan soniyada bir fayl tezligida amalga oshirildi.
Yig'ilgan materiallar parol ro'yxatlari, shaxsiy kalitlar, VPN profillari, MFA va masofaviy monitoring API kalitlari, zaxira nusxa ma'lumotlari, xavfsizlik devori konfiguratsiyalari va xizmat hisoblari xaritalarini o'z ichiga oldi. Bunday ma'lumot Microsoft 365 dan tashqarida keyingi kirishlarga imkon berishi mumkin.
MSP integratsiyalari ta'sirni kengaytirdi. Bitta ko'p tenantli ilova taxminan 10 soniyalik tsikllarda 15 ta mijoz tenantini qamrab oldi.
Tezligiga qaramay, Todyl bu faoliyat qurt emasligini aytadi. Dalillar VPS dan skriptlangan vositalarni boshqaradigan bitta operatorni, oldin o'g'irlangan ma'lumotlardan foydalanib va MSP mijoz guruhlari ichida kengayib borishini ko'rsatadi. Skriptlangan mijozlar kirishlarning 95 foizini tashkil etdi. AI yordami past ishonchli ehtimol bo'lib qolmoqda, tasdiqlangan topilma emas.
3-noyabrda aniqlashlar ishga tushgandan so'ng, hujumchi curl va Python imzolarini soxta brauzer foydalanuvchi agentlari bilan almashtirdi. Keyingi urinishlar bir nechta foydalanuvchilarning yangilash tokenlarini qayta ishlatdi; o'sha kuni kuzatilgan har bir qayta ishlatish Conditional Access tomonidan bloklandi. Shunga o'xshash Microsoft 365 token qayta ishlatish hujumlari ilova ma'lumotlari bilan birga o'g'irlangan sessiyalarni tekshirish muhimligini ko'rsatadi.
Ikki MSP bo'yicha to'rtta AI-xizmat tokeni berildi. Bu mumkin bo'lgan LLMjacking bilan mos keladi, lekin faqat token berilishi resurs iste'molini tasdiqlamaydi.
Tasdiqlangan operator manzili 199.19.77.84. O'ziga xos foydalanuvchi agentlari task177-f2267/1.0 va sait-tenant-deep/37346 ni o'z ichiga oladi.
Administratorlar muvaffaqiyatli va muvaffaqiyatsiz xizmat-prinsipal kirishlarini tekshirishi, audit jurnallarini saqlashi, har qanday buzilgan ilovalarni o'chirishi va har qanday ochiq ilova va pastki ma'lumotlarni aylantirishi kerak. Foydalanuvchiga yo'naltirilgan Conditional Access ilova faqat autentifikatsiyasi bilan bog'liq nazoratlar o'rnini bosa olmaydi.
Biz sotuvchi platformasining doimiyligi yoki buzilishi belgilarini kuzatmadik. Attribyutsiya va ma'lumot o'g'irlanishining asl mexanizmi hal qilinmagan, va kuzatilgan muhitlardan tashqarida qo'shimcha jabrlanuvchilar bo'lishi mumkin.
SOC jamoangizga hodisalarni tez to'xtatish uchun ogohlantirish kontekstini bering.16K SOC dan tahdid razvedkasini integratsiya qiling.
Hackers are exploiting stolen Microsoft Entra ID application credentials to infiltrate Microsoft 365 and Azure environments, impacting 27 organizations via managed service providers (MSPs) and their downstream clients.
Todyl’s MXDR team is monitoring this ongoing campaign, referred to as Key Eater. Since November 1, 2026, the attackers have targeted approximately 45 app registrations across about 18 organizations, successfully authenticating into more than 33 of them.
Investigators noted that attackers downloaded 81 files and accessed about 2,279 mailbox items. No vulnerabilities in Microsoft’s systems were exploited during these breaches.
According to Todyl’s investigation, victims span government, energy, agriculture, transportation, engineering, legal, education, and nonprofit organizations. The figures represent only environments visible through its telemetry.
Rather than compromising individual accounts first, the attacker authenticates as legitimate applications using valid secrets. Investigators also identified abuse of an Azure DevOps federated workload identity and replay of a user’s Azure DevOps session token.
For nearly every credential, the operator requests an Azure Resource Manager token followed by a Key Vault token. Requests for Microsoft Graph, Storage, and Cognitive Services tokens frequently follow within seconds.
Previously unused applications then begin authenticating within minutes. This suggests harvested secrets enable additional access, although Key Vault audit logs are required to confirm the source. Related Entra ID attacks illustrate why cloud identities and accessible secret stores require scrutiny.
The attacker executed 29 single-wildcard Microsoft Graph searches across approximately 25 tenants before downloading SharePoint files at roughly one per second.
Collected material included password lists, private keys, VPN profiles, MFA and remote monitoring API keys, backup credentials, firewall configurations, and service-account maps. Such information could enable follow-on intrusions beyond Microsoft 365.
MSP integrations amplified exposure. One multi-tenant application swept 15 customer tenants in approximately 10-second loops.
Despite its speed, Todyl says the activity is not a worm. Evidence indicates one operator controlling scripted tooling from a VPS, using previously stolen credentials and expanding within MSP customer groups. Scripted clients accounted for 95% of sign-ins. AI assistance remains a low-confidence possibility, not a confirmed finding.
After detections triggered on November 3, the attacker replaced curl and Python signatures with spoofed browser user agents. Later attempts replayed multiple users’ refresh tokens; Conditional Access blocked every observed replay that day. Similar Microsoft 365 token replay attacks demonstrate the importance of investigating stolen sessions alongside application credentials.
Four AI-service tokens were issued across two MSPs. This fits possible LLMjacking, but token issuance alone does not establish resource consumption.
The confirmed operator address is 199.19.77.84. Distinctive user agents include task177-f2267/1.0 and sait-tenant-deep/37346.
Administrators should investigate both successful and failed service-principal sign-ins, preserve audit logs, turn off any compromised applications, and rotate any exposed application and downstream credentials. User-focused Conditional Access does not replace the need for controls related to app-only authentication.
We have observed no signs of persistence or compromise of the vendor platform. The attribution and the original mechanism behind the credential theft remain unresolved, and there may be additional victims outside of monitored environments.
Give your SOC the alert context to stops incidents quickly.Integrate Threat Intel from 16K SOCs.