November 9, 2026, 3:50 pm | Read time: 2 minutes
Security researchers are warning of an ongoing wave of attacks on cloud environments of companies and government agencies. Instead of exploiting traditional security vulnerabilities, the attackers are using stolen credentials for Microsoft Entra ID and Azure DevOps. Managed service providers are particularly interesting to them. These IT service providers often manage the infrastructure of multiple clients and can therefore become a starting point for further attacks.
Microsoft Access: Why MFA Doesn’t Always Protect
As reported by the online magazine “WinFuture,” so-called service principals and application identities play an important role in this. They enable programs and services to automatically access cloud resources. Since no human logs in, traditional multifactor authentication does not necessarily apply. The attackers can thus misuse existing permissions if they get hold of the appropriate credentials.
Also of interest: How North Korean hackers stole several million euros
Attackers Gain Access to Sensitive Credentials
The report is based on observations by the security firm “Todyl.” According to them, the attacks affect at least 45 applications in about 18 organizations. In more than 33 applications, the login was successful. Through connected customer systems, the perpetrators gained access to environments in sectors such as administration, energy supply, transportation, education, and law. The stolen data includes password lists, private keys, and credentials for VPNs, backups, and remote access. Companies should therefore particularly monitor automated application access and replace compromised keys.