Nice2GeekYou

Stolen Microsoft App Logins Hit 27 Organizations Through Their MSPs — Check Your Connected Apps

A lone attacker used stolen Microsoft Entra app secrets to sign into MSP Microsoft 365 and Azure tenants, then reached downstream clients. Mailboxes and files were searched. Here is what to check this week before payroll or client data walks out.

  • microsoft-365
  • entra-id
  • msp
  • smb
  • cybersecurity
  • identity
  • managed-it
  • azure

Stolen software logins — not a phishing email to your inbox — are how attackers just walked into dozens of businesses through their IT providers. Cybersecurity Dive reported on November 4, 2026 that researchers at Todyl are tracking a lone hacker who used stolen Microsoft Entra ID application secrets to sign into Microsoft 365 and Azure at managed service providers (MSPs), then reached their clients.

Why it matters

App registrations are the non-human identities software uses to sign into Microsoft services without a person present. If those secrets leak, the attacker looks like a trusted app — not a stranger guessing passwords.

According to the report:

  • About 45 app registrations across roughly 18 organizations were targeted; at least 33 authenticated successfully.
  • The attacker reached 27 organizations, including downstream clients of those MSPs, across energy, government, food and agriculture, transportation and construction.
  • Searches ran across 25 tenants; about 81 files were downloaded and roughly 2,300 mailbox items were accessed.
  • About 95% of the sign-ins used scripted clients, with bursts of dozens of attempts in seconds. Researchers say attempts were still ongoing after Nov. 1.

That is mailbox access, file downloads and tenant searching — the same paths used for payroll fraud, invoice diversion and quiet data theft. If your business uses an MSP (or you are an MSP), a compromised app secret upstream can put your email and files at risk even when your staff never clicked a bad link.

What to do this week

  1. Review Entra / Microsoft 365 enterprise applications and app registrations. Flag anything you do not recognize, anything with unused secrets, or any high-privilege app that has not been rotated lately.
  2. Rotate secrets and certificates on apps that talk to Microsoft 365 or Azure. Prefer certificate-based credentials over long-lived client secrets where you can, and delete secrets you no longer need.
  3. Turn on alerts for unusual non-interactive / service-principal sign-ins. Scripted bursts from odd locations or clients are the tell in this campaign.
  4. Ask your MSP (or ask yourself) who can create app registrations and who reviews consent. Limit who can grant admin consent, and re-check connected apps after any vendor change.
  5. Verify bank and payroll changes by phone on a number you already have on file. Mailbox access is often the setup step for payment diversion.

Nice2GeekYou is based in San Antonio and serves all of Texas on site, and our managed IT plans cover remote clients across the U.S. We help SMBs review Microsoft 365 connected apps, tighten identity alerts, and keep MFA and backup hygiene in place so a leaked vendor secret does not become a quiet mailbox raid. Request a quote, see our monthly plans, or text us at (210) 504-8969.

Sources: Cybersecurity Dive — Attacker abuses Microsoft Entra ID to target downstream MSP clients (Nov 4, 2026), citing Todyl research and Huntress commentary.