Stolen Entra App Secrets Hit MSP Clients: Check Yours Today
Todyl reported about 45 app registrations targeted and 27 organizations accessed, including downstream clients of managed service providers. Source: Todyl, via Cybersecurity Dive, Nov. 4, 2026.
If you use a managed service provider, or you are one, this is a story you need to hear. Todyl reported that one attacker used stolen Microsoft Entra app secrets to sign in to Microsoft 365 and Azure at about 18 organizations, including MSPs, and then reached their downstream clients (Todyl, updated Nov. 6, 2026, Cybersecurity Dive, Nov. 4, 2026).
There was no Microsoft software bug. The secrets were valid. An app's password is still a password. Treat it like one.
You can watch the short version here:
The video uses a digital avatar of Erick Grau, CEO of Chibitek.
Why Does This Matter?
These were not people typing passwords. They were app registrations: the identities software uses to sign in to Microsoft services without a person present. If an attacker has a valid app secret, the app can sign in, often with no MFA prompt and with user-focused sign-in rules left sitting on the sidelines.
Think of it like a spare key to the office that was copied and never taken off the hook. The lock still works. That is the problem.
I walk through the numbers and the check in this Short: Watch the Short on YouTube
What Did Researchers Find?
Cybersecurity Dive, citing Todyl, says the attacker targeted 45 app registrations at about 18 organizations, successfully signed in to at least 33 of them, and then accessed 27 organizations, including downstream MSP clients (Cybersecurity Dive). Todyl's own wording is "About 45 app registrations at roughly 18 organizations," "more than 33 of them authenticated successfully," and "reached 27 organizations so far" (Todyl, Nov. 3, 2026 update).
Researchers did not publish those 45 victim app names. We are not inventing them.
Todyl also reported that the actor ran searches across about 25 tenants, downloaded 81 files, and accessed around 2,279 mailbox items, and that scripted clients made 95% of sign-ins. Cybersecurity Dive rounded the mailbox figure to about 2,300. Todyl says these counts are a floor, because they only cover organizations that send logs to Todyl (Todyl, Cybersecurity Dive).
Todyl investigation figures from the Nov. 3, 2026, 4:36 p.m. MT update (post last updated Nov. 6, 2026). Todyl says these numbers are a floor. Source: Todyl.
What Did Those Apps Sign Into?
The victim app names were not published. What they signed into, or queried, was. Todyl and Microsoft Threat Intelligence report activity involving:
Azure Resource Manager
Azure Key Vault
Microsoft Graph
Azure Storage
SharePoint and OneDrive
Mailboxes (Todyl: around 2,279 mailbox items)
Azure DevOps
Microsoft Partner Center
Azure Cognitive Services, now called Foundry Tools
Azure Machine Learning
Azure App Service
Azure SQL
Application Insights
Azure Kubernetes Service
Virtual machine Run Command
Todyl describes a common sequence: after signing in, the actor often requested an Azure Resource Manager token, then a Key Vault token, then Microsoft Graph, Storage, and Cognitive Services tokens (Todyl, Microsoft Threat Intelligence, Nov. 5, 2026).
The Entra apps themselves were often custom-built. Todyl also saw security-tool integration apps, including its own in two MSP tenants, plus multi-tenant MSP apps, GDAP automation apps (delegated admin tools partners use to work in a client's tenant), and connector apps. Todyl says there is no sign any vendor platform was compromised (Todyl).
When Should You Start Looking?
Microsoft Threat Intelligence said that as early as October 28, 2026, it began observing successful service principal sign-ins from the IP address 199.19.77.84 (Microsoft Threat Intelligence). Todyl's first sighting was November 1. Todyl says that if you started your hunt on November 1, extend it back to October 28, and include failures, not just successful sign-ins (Todyl).
The Short's vertical cover, used on YouTube, is below. It is 1080 by 1920, so it is not the Wix post cover.
Official Short cover (1080 by 1920). The 45 and 27 tiles match the Cybersecurity Dive and Todyl counts cited above.
What Should You Do Today?
Open Entra and go to App registrations. Look at every client secret.
Delete the secrets nobody owns, and rotate the rest, including old ones still in use.
Check service principal and non-interactive sign-in logs back to October 28 for sign-ins you do not recognize, including failures. Hunt for 199.19.77.84, the address Microsoft and Todyl both cite.
Remember: an app's password is still a password. Treat it like one.
These checks are Chibitek guidance, based on what Todyl and Microsoft recommend.
Key Points of Entra App Secrets
One attacker used stolen Microsoft Entra app secrets to sign in as apps, not people.
Todyl and Cybersecurity Dive report about 45 app registrations targeted at about 18 organizations, at least 33 signed in, and 27 organizations accessed, including MSP clients.
Those 45 victim app names were not published.
There was no Microsoft software bug. The secrets were valid.
What the apps signed into included Resource Manager, Key Vault, Graph, Storage, SharePoint, mail, DevOps, Partner Center, and other Azure services.
Hunt sign-in logs back to October 28, and review every app registration secret today.
Frequently Asked Questions
What is an Entra app secret? It is a password for an app registration in Microsoft Entra ID. Software uses it to sign in to Microsoft services without a person at the keyboard.
Were the victim apps named? No. Researchers did not publish the 45 app registration names. The published list is the Microsoft services those apps signed into or queried, not the names of the victim apps.
Is this a Microsoft product bug? Todyl says no Microsoft vulnerability is involved. The attacker used valid, pre-existing credentials.
Why start the hunt on October 28, not November 1? Todyl first saw the activity on November 1. Microsoft later reported successful service principal sign-ins from 199.19.77.84 as early as October 28, 2026. Todyl then asked readers who had started on November 1 to look further back.
Does this mean a security vendor was breached? Todyl says integration credentials for security tools, including Todyl's own apps in two MSP tenants, were among those abused, and that there is no sign any vendor platform was compromised. The issue was stolen app secrets, not a break-in at the vendor's own platform, according to Todyl.
Let's Check the Secrets That Never Get a Human Login
At Chibitek, we help businesses review identity hygiene, including the app passwords that sit behind the scenes, with no geek-speak. Don't let a forgotten client secret become a door into Microsoft 365, Azure, or a client's tenant. Contact us at hello@chibitek.com to learn how we can help you review app registrations, rotate secrets, and hunt sign-in logs.
Further reading: Todyl's investigation, Cybersecurity Dive, and Microsoft Threat Intelligence.
You can watch the short version here:
The same video is also on LinkedIn.
We make IT effortless so you can create, disrupt, and grow!
Follow Chibitek on YouTube at @chibitekmsp, and follow Chibitek on LinkedIn.
Comments