A single operator has spent several days logging in to managed service provider environments as their own applications, using app secrets that were stolen but never revoked. No Microsoft flaw is involved, and that is exactly why UK MSPs and their customers should pay attention.
What happened
Detection firm Todyl published an incident write-up on 3 November 2026, updated the next day, describing an ongoing campaign its MXDR team has named Key Eater. Since the morning of 1 November, an unidentified operator has been authenticating to Microsoft 365 and Azure tenants belonging to MSPs by presenting valid credentials for registered applications.
Todyl counts roughly 45 app registrations targeted across about 18 organisations, with more than 33 of those sign-ins succeeding. Because several of the compromised applications belonged to MSPs with access into client tenants, the operator ultimately reached 27 organisations spanning government, energy, agriculture, transport, engineering, legal, education and the charity sector. Todyl says these figures are a floor.
Across about 25 tenants the operator ran 29 Microsoft Graph searches, downloaded 81 files and touched around 2,279 mailbox items. According to Todyl and GBHackers, the haul included firewall configurations, VPN profiles, private keys, password lists, backup credentials, MFA and remote monitoring API keys, and service account maps. The last successful action Todyl observed was at 15:16 UTC on 3 November; the most recent attempt, at 21:31 UTC that night, was blocked.
The activity is unattributed. Todyl assesses it as one operator with scripted tooling and a stockpile of secrets, not a worm. How the secrets were obtained is unknown.
The technical picture
The interesting part, from an offensive tradecraft point of view, is the choice of identity. Service principals in Entra ID authenticate with a client secret, a certificate or a federated credential. They never prompt for MFA, are rarely covered by Conditional Access policies written for people, and log to a separate table many SOCs ignore. No Microsoft vulnerability is involved.
Todyl reports that for almost every credential the operator first asked for an Azure Resource Manager token and then a Key Vault token, with Graph, Storage and Cognitive Services tokens often following within seconds. Applications that had been dormant then began signing in minutes later, which Todyl reads as secrets being harvested from vaults and reused, although it notes this still needs confirming from Key Vault audit logs.
The operator also abused an Azure DevOps federated workload identity from the afternoon of 1 November and replayed Azure DevOps session tokens belonging to users. Collection meant wildcard Graph searches, then SharePoint downloads at about one file per second.
The MSP dimension is what turns a single tenant compromise into a supply chain problem. Todyl describes multi-tenant and GDAP applications, plus tokens from Microsoft’s partner portal, being used to reach downstream customers. In one case a single multi-tenant app was cycled through 15 client tenants in loops of roughly ten seconds.
The operator adapted once it was noticed. After detections early on 3 November, it swapped obvious curl and Python signatures for spoofed browser user agents, then tried replaying refresh tokens for several users. Conditional Access blocked every one of those replays.
Todyl rates 199.19.77.84, hosted on AS203662 in Poland, as the operator’s address with high confidence, and lists two odd user agent strings, task177-f2267/1.0 and sait-tenant-deep/37346, as unique to this actor. It warns against blocking the surrounding /24 wholesale.
Why it matters for UK organisations
Todyl only sees its own customers’ logs, and none of the sources names a UK victim. But the mechanics are vendor-neutral and geography-neutral. A large share of UK small and mid-sized businesses buy IT from MSPs that hold delegated admin rights through Microsoft’s partner portal and GDAP, and many of those MSPs run their tooling as multi-tenant Entra apps. The NCSC has warned for years that MSPs are a high-value route into their customers, and this campaign is a live example of why.
Secnews covered the ConnectWise Cloud Backup (SkyKick) credential abuse on 18 October. Todyl considers that incident, attributed to Storm-0940, to be different in infrastructure and persistence, and says it is not linked.
For UK organisations, the data protection angle matters too. Mailbox access across client tenants is very likely to involve personal data, so an MSP that discovers it was used as a conduit will need to think quickly about its own and its customers’ obligations under UK GDPR, including the 72-hour ICO notification window.
Expert view
In my experience, app registrations are the most neglected identities in almost every Entra tenant we assess. Secrets get created for a proof of concept, granted generous Graph or Key Vault permissions, pasted into a pipeline variable or a wiki page, and then forgotten. Nobody owns them or reviews their sign-ins. When we test, an exposed client secret is frequently a faster route to sensitive data than any user account.
What this operator did well was stay inside that blind spot. It did not need to defeat MFA because app-only authentication never asks for it, and it moved laterally by reading vaults rather than by exploiting anything. Detection only really started to bite when the actor’s tooling behaved unusually and when it fell back to replaying user tokens, which ran straight into Conditional Access.
“MFA and Conditional Access everywhere” usually means everywhere a human logs in. Todyl notes workload identity policies need an extra licence and do not cover managed identities, multi-tenant apps or third-party SaaS, so gaps are normal.
What to do now
- Hunt first, then contain. Search service principal and non-interactive sign-in logs for the operator IP and user agents Todyl published, going back as far as retention allows. Preserve audit logs before disabling anything.
- Look for the behavioural patterns. Todyl highlights a failed secret (AADSTS7000215) followed by success from the same address, one address signing in as service principals across unrelated tenants, Key Vault tokens followed by newly active apps, and app-only SharePoint downloads from non-Microsoft infrastructure.
- Rotate everything reachable. For any affected app, remove secrets, certificates and federated credentials, revoke user sessions, Azure DevOps personal access tokens and SSH keys, and rotate every secret held in vaults the app could read, plus credentials found in exposed documents.
- MSPs: audit delegated access. Review partner portal access, GDAP relationships and multi-tenant apps, move to least-privilege, time-bound GDAP roles, and tell affected customers as your contracts require.
- Harden workload identities. Replace client secrets with managed identities or federation where possible, apply Conditional Access for workload identities where licensed, restrict Key Vault and Storage to private networks, and limit PAT scope and lifetime. This maps directly to the Cyber Essentials user access control requirement: every account, including non-human ones, should have only the privileges it needs and be removed when unused.
- Inventory AI keys. Check AI resources for unexpected usage and set quotas and alerts.
Bottom line
Key Eater is not clever malware or a zero-day. It is an operator who found a pile of valid application secrets and used them faster than defenders noticed. Any UK organisation that relies on an MSP, or is one, should treat app registrations as privileged accounts this week: find them, check who signed in as them, and rotate what they could reach.
Sources
- Todyl: Stolen App Credentials, Real Access: An Actor Is Signing Into Entra ID and Azure DevOps as Your Workloads
- GBHackers: Hackers Use Stolen Microsoft Entra ID App Credentials to Breach 27 Organizations
- ICT Security Magazine: Credenziali applicative rubate in Entra ID e Azure DevOps
- Hunter Strategy: From Mobile Browsers to Cloud App Identities: Five Threats Stealing Sessions, Secrets, and Credentials
