Dive Brief: Researchers are investigating the abuse campaign of a lone hacker who has been using stolen application secrets for Microsoft Entra ID to sign into Microsoft 365 and Azure environments at various managed service providers, according to a recent report by Todyl.
The hacker targeted 45 app registrations at about 18 organizations and successfully authenticated at least 33 of them.
The attacker was then able to access 27 organizations, including downstream clients of these MSPs across various sectors, such as energy, government, food and agriculture, transportation and construction.
Todyl researchers said hacking attempts are ongoing.
Huntress researchers have traced the activity to a hosting IP based in Poland.