Stolen App Credentials, Real Access: An Actor Is Signing Into Entra ID and Azure DevOps as Your Workloads

An agentic credential crawler was observed utilizing AI agents to find exposed secrets, which is also how many of those credentials were exposed. The activity involved an automated sequence where the tool requested tokens from Azure Resource Manager, Key Vault, Microsoft Graph, Storage, and Cognitive Services in rapid succession. This process demonstrated machine speed with scripted clients making 95% of sign-ins. The attack shifted tactics mid-campaign, moving from using stolen app secrets to replaying user refresh tokens. Investigations point to automated credential harvesting, potentially powered by AI offensive frameworks like ARTEX, as the method of initial access.
The investigation traces activity back to an IP address and confirms that a single operator was involved in signing into MSP environments via stolen credentials. The actor moved through multiple layers, accessing client tenants via delegated admin roles. The timeline details sequential actions, including scanning for secrets, downloading files, and attempting token replays, with detections being blocked by Conditional Access policies.
The broader context suggests an identity attack moving through supply chains, where access to one application leads to access across multiple customer environments. The observed activity also correlates with increased usage of AI models, suggesting potential "LLM-jacking" or AI-assisted automation in the intrusion workflow.

* An agentic credential crawler was used to find exposed secrets and perform subsequent actions.
* The tooling requests tokens from Azure Resource Manager, Key Vault, Microsoft Graph, Storage, and Cognitive Services sequentially.
* Scripted clients made 95% of sign-ins with bursts up to 24 sign-ins in 10 seconds.
* The actor used harvested material to sign in to new applications within minutes.
* The activity involved scanning for secrets across multiple repositories, including GitHub.
* Activity was observed starting on November 1, 2026, with prior sign-ins noted from October 28, 2026.
* Indicators identified include IP addresses 199.19.77.84 and 65.87.223.26.
* The actor successfully signed in to 45 app registrations across approximately 18 organizations.
* Activity included downloading files from Microsoft 365 and accessing mailbox items.
* The activity involved attempting to replay user refresh tokens.

The operational sequence points to a highly automated, agentic workflow that leverages the layered access provided by workload identities and secrets stores to achieve lateral movement across an MSP infrastructure. The observation of rapid token requests (ARM $\rightarrow$ Key Vault $\rightarrow$ Graph, etc.) strongly suggests that credentials are used not just for initial access but for systematically escalating privilege across the entire cloud ecosystem. The shift in tactics, from static secrets to dynamic token replay and spoofed user agents, indicates an adaptive adversary capable of pivoting based on real-time defensive feedback, which is a hallmark of advanced agentic tooling rather than simple scripting.
The focus shifts from merely finding credentials to leveraging them for maximum impact, evidenced by the collection across Key Vault, Graph, and the specific targeting of AI service keys. This suggests that the ultimate goal is not just access but controlling or monetizing the underlying AI infrastructure. The connection drawn between this activity and other incidents involving vendor credentials (like ConnectWise) suggests a systemic vulnerability in supply chain trust; when an organization relies on third-party app credentials, the blast radius extends far beyond the immediate point of compromise.
The pattern of coordinated, high-speed actions across multiple tenants from a single source address highlights a failure in perimeter defense (firewalls) and identity governance (Conditional Access). The fact that session replay attempts were blocked by CA policies implies that standard access controls are insufficient against automated token usage, demanding a shift toward workload identity enforcement. The uncertainty surrounding the AI link—whether it was the driver or an accelerant for the activity—is crucial; whether an AI model is directly coordinating or merely generating the highly optimized commands, understanding this distinction is key to defining the necessary defensive posture moving forward.
Bridge Questions: If the activity is agent-driven but unattributed, what specific telemetry signals would be required to confirm the presence of an AI reasoning layer versus purely sophisticated scripting? How does relying on workload identity policies impact the operational viability of MSPs handling delegated administrative access? What are the organizational responsibilities when validated access patterns reveal a failure in multi-tenant governance that bypasses perimeter controls?