A lone hacker is actively exploiting stolen application secrets for Microsoft Entra ID to gain unauthorized access to Microsoft 365 and Azure environments, based on information published by Channeldive.
The attacker targeted 45 application registrations across 18 organizations, successfully authenticating into 33 of them. This breach allowed the actor to compromise 27 organizations, including downstream clients in the energy, government, food and agriculture, transportation and construction sectors. The operator, potentially utilizing a virtual private server in Poland, has accessed 2,300 mailbox items and downloaded 81 files. Approximately 95% of the sign-ins were executed via scripted clients, demonstrating machine-speed activity with rapid bursts of 24 sign-ins within 10 seconds.
Unlike traditional supply chain attacks that rely on compromised software updates, this campaign leverages existing valid secrets for application registrations. Security researchers note that while the cadence suggests the use of automated tooling, there is no direct link to the recent campaign involving the Artex agentic tool. Organizations are advised to monitor for suspicious authentication patterns as the hacking attempts remain ongoing.
Source: Channeldive
