CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Exposed application credentials used for Entra service-principal sign-ins (October to November 2026)

campaign · campaign:exposed-app-credentials-entra-service-principal-signins-2026-11

Microsoft (2026-11-05) reports an agentic framework searching public GitHub for OAuth application secrets from August 2026 and service-principal sign-ins with valid application credentials from 2026-10-28; Todyl (2026-11-03) reports one operator signing in as about 45 MSP application registrations since 2026-11-01 and reaching 27 organisations, government clients among them, without tying it to ARTEX.

Coverage
1
first 2026-11-06 → last 2026-11-06
Latest activity
2026-11-06
Entra app-credential abuse: agents hunt GitHub for secrets, an operator reaches MSP clients, government among…
Peak priority
high
1 high
Targets
public-sector
sectors: public-sector
Sources cited
2
2 hosts

Action items (1)

Do-now tasks recorded on the entries about Exposed application credentials used for Entra service-principal sign-ins (October to November 2026), newest first. Check the date before acting on an older one.

  • In every Entra tenant you run or manage for others, list the app registrations that hold client secrets, starting with multitenant, delegated-admin (GDAP) and Partner Center apps, security-tool integration apps and Azure DevOps service connections, and search the service-principal and non-interactive sign-in logs for the invalid-secret or expired-secret errors AADSTS7000215 and AADSTS7000222 followed by a success for the same app; on any hit remove all client secrets, certificates and federated credentials on that app, including ones you did not add, disable its service principal if needed and rotate everything stored in any Key Vault it could read, because issued tokens stay valid until they expire.
    2026-11-06Entra app-credential abuse: agents hunt GitHub for…

Defender insights

What each entry about Exposed application credentials used for Entra service-principal sign-ins (October to November 2026) tells a defender to do, newest first.

2026-11-06HIGHEntra app-credential abuse: agents hunt GitHub for secrets, an operator reaches MSP clients, government among them

Exposure · triage · detection

Relationships explore in graph

Typed, source-stated connections from the entity registry; each edge cites the entry whose reporting establishes it.

uses

Story timeline

  1. 2026-11-06Exposed application credentials: Microsoft sees an agentic framework search GitHub for OAuth and cloud application secrets and then sign in as the applications from 2026-10-28, and Todyl sees an operator use MSP applications to reach 27 organisations, government clients among them
    active-threatsEntra app-credential abuse: agents hunt GitHub for secrets, an operator reaches MSP clients, government among them

Hunting pivots

Affected products
Microsoft 365Microsoft AzureMicrosoft Azure DevOpsMicrosoft Entra ID
Tags
ai-abusecloudidentitysupply-chain
ATT&CK techniques (11 across 10 tactics)

11 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • ReconnaissanceSearch Open Websites/Domains: Code Repositories
  • Initial AccessValid Accounts: Cloud Accounts · Trusted Relationship
  • ExecutionCloud Administration Command
  • PersistenceValid Accounts: Cloud Accounts
  • Privilege EscalationValid Accounts: Cloud Accounts
  • StealthValid Accounts: Cloud Accounts
  • Credential AccessUnsecured Credentials: Credentials In Files · Credentials from Password Stores: Cloud Secrets Management Stores
  • DiscoveryCloud Infrastructure Discovery
  • Lateral MovementUse Alternate Authentication Material: Application Access Token
  • CollectionEmail Collection: Remote Email Collection · Data from Information Repositories: Sharepoint · Data from Cloud Storage

Reconnaissance TA0043

T1593.003Search Open Websites/Domains: Code Repositories×1

Adversaries may search public code repositories for information about victims that can be used during targeting. Victims may store code in repositories on various third-party websites such as GitHub, GitLab, SourceForge, and BitBucket. Users typically interact with code repositories through a web application or command-line utilities such as git.

Evidence: 2026-11-06/exposed-app-credentials-entra-signins-msp-clients-artex · ATT&CK page ↗

Initial Access TA0001

T1078.004Valid Accounts: Cloud Accounts×1

Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory.

Evidence: 2026-11-06/exposed-app-credentials-entra-signins-msp-clients-artex · ATT&CK page ↗

T1199Trusted Relationship×1

Adversaries may breach or otherwise leverage organizations who have access to intended victims. Access through trusted third party relationship abuses an existing connection that may not be protected or receives less scrutiny than standard mechanisms of gaining access to a network.

Evidence: 2026-11-06/exposed-app-credentials-entra-signins-msp-clients-artex · ATT&CK page ↗

Execution TA0002

T1651Cloud Administration Command×1

Adversaries may abuse cloud management services to execute commands within virtual machines. Resources such as AWS Systems Manager, Azure RunCommand, and Runbooks allow users to remotely run scripts in virtual machines by leveraging installed virtual machine agents.

Evidence: 2026-11-06/exposed-app-credentials-entra-signins-msp-clients-artex · ATT&CK page ↗

Persistence TA0003

T1078.004Valid Accounts: Cloud Accounts×1

Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory.

Evidence: 2026-11-06/exposed-app-credentials-entra-signins-msp-clients-artex · ATT&CK page ↗

Privilege Escalation TA0004

T1078.004Valid Accounts: Cloud Accounts×1

Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory.

Evidence: 2026-11-06/exposed-app-credentials-entra-signins-msp-clients-artex · ATT&CK page ↗

Stealth TA0005

T1078.004Valid Accounts: Cloud Accounts×1

Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory.

Evidence: 2026-11-06/exposed-app-credentials-entra-signins-msp-clients-artex · ATT&CK page ↗

Credential Access TA0006

T1552.001Unsecured Credentials: Credentials In Files×1

Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.

Evidence: 2026-11-06/exposed-app-credentials-entra-signins-msp-clients-artex · ATT&CK page ↗

T1555.006Credentials from Password Stores: Cloud Secrets Management Stores×1

Adversaries may acquire credentials from cloud-native secret management solutions such as AWS Secrets Manager, GCP Secret Manager, Azure Key Vault, and Terraform Vault.

Evidence: 2026-11-06/exposed-app-credentials-entra-signins-msp-clients-artex · ATT&CK page ↗

Discovery TA0007

T1580Cloud Infrastructure Discovery×1

An adversary may attempt to discover infrastructure and resources that are available within an infrastructure-as-a-service (IaaS) environment. This includes compute service resources such as instances, virtual machines, and snapshots as well as resources of other services including the storage and database services.

Evidence: 2026-11-06/exposed-app-credentials-entra-signins-msp-clients-artex · ATT&CK page ↗

Lateral Movement TA0008

T1550.001Use Alternate Authentication Material: Application Access Token×1

Adversaries may use stolen application access tokens to bypass the typical authentication process and access restricted accounts, information, or services on remote systems. These tokens are typically stolen from users or services and used in lieu of login credentials.

Evidence: 2026-11-06/exposed-app-credentials-entra-signins-msp-clients-artex · ATT&CK page ↗

Collection TA0009

T1114.002Email Collection: Remote Email Collection×1

Adversaries may target an Exchange server, Office 365, or Google Workspace to collect sensitive information. Adversaries may leverage a user's credentials and interact directly with the Exchange server to acquire information from within a network. Adversaries may also access externally facing Exchange services, Office 365, or Google Workspace to access email using credentials or access tokens. Tools such as MailSniper can be used to automate searches for specific keywords.

Evidence: 2026-11-06/exposed-app-credentials-entra-signins-msp-clients-artex · ATT&CK page ↗

T1213.002Data from Information Repositories: Sharepoint×1

Adversaries may leverage the SharePoint repository as a source to mine valuable information. SharePoint will often contain useful information for an adversary to learn about the structure and functionality of the internal network and systems. For example, the following is a list of example information that may hold potential value to an adversary and may also be found on SharePoint:

Evidence: 2026-11-06/exposed-app-credentials-entra-signins-msp-clients-artex · ATT&CK page ↗

T1530Data from Cloud Storage×1

Adversaries may access data from cloud storage.

Evidence: 2026-11-06/exposed-app-credentials-entra-signins-msp-clients-artex · ATT&CK page ↗

Entries about Exposed application credentials used for Entra service-principal sign-ins (October to November 2026) (1)

2026-11-06 · view entry permalink →

HIGHNATOB2

Exposed application credentials: Microsoft sees an agentic framework search GitHub for OAuth and cloud application secrets and then sign in as the applications from 2026-10-28, and Todyl sees an operator use MSP applications to reach 27 organisations, government clients among them

Microsoft reports that since August 2026 threat actors have used the agentic offensive framework ARTEX to submit large volumes of queries to public GitHub for secrets (Microsoft Threat Intelligence, 2026-11-05). As early as 2026-10-28 it saw successful service-principal sign-ins from two IP addresses, one a Tor exit node that may carry unrelated activity, across dozens of applications in several tenants, including a vendor-owned multitenant application whose credential was compromised at the source and used to reach multiple downstream tenants (Microsoft Threat Intelligence, 2026-11-05). Microsoft states that a similar campaign involving the same addresses was also reported by Todyl (Microsoft Threat Intelligence, 2026-11-05).

Todyl, from its managed-detection telemetry, describes one operator who since 2026-11-01 has signed in to MSPs' Microsoft 365 and Azure environments as their own applications with stolen credentials that are still valid: about 45 app registrations at roughly 18 organisations were targeted, more than 33 authenticated, and 27 organisations were reached, among them the MSPs' downstream clients in government (Todyl, 2026-11-03). For nearly every credential the operator requests an Azure Resource Manager token, then a Key Vault token, and within minutes applications that had never been used start authenticating; MSP multitenant and delegated-admin apps and Partner Center tokens reach client tenants, one app sweeping 15 client tenants in about 10-second loops (Todyl, 2026-11-03). Todyl says no Microsoft vulnerability is involved, that it saw no persistence and does not know how the credentials were obtained, and that several seed secrets had only ever been used from staff devices and office networks, which points to a file store or live backend rather than configurations crawled from the internet (Todyl, 2026-11-03). After its detections fired on 2026-11-03 the operator switched to spoofed browser user agents and replayed users' refresh tokens, all blocked by Conditional Access (Todyl, 2026-11-03).

Triage: the invalid-secret and expired-secret errors alone only show that someone holds an old or wrong credential for the app; Microsoft treats a failure followed by a success as the urgent case (Microsoft Threat Intelligence, 2026-11-05).

Starting in August 2026, Microsoft observed threat actors using an agentic AI offensive framework to submit large volumes of queries to GitHub for secrets.

Sign-in errors AADSTS7000215 (invalid secret) or AADSTS7000222 (expired secret) indicate someone holds a credential for your app; a failure followed by a success is urgent.

Microsoft Threat Intelligence 2026-11-05

Through those apps the actor has reached 27 organizations so far, including the MSPs' downstream clients in government, energy, food and agriculture, transportation, construction and engineering, legal, education and nonprofits.

We have not tied the activity to a specific agentic workflow or offensive framework, and our telemetry does not show an AI model directing it, so we hold that possibility at low confidence.

Todyl 2026-11-03

Builds on: Microsoft: Storm-0940 runs ARTEX at machine speed; Mandiant now sees agent frameworks in… · ConnectWise SkyKick app credential used in 162+ Microsoft 365 tenants; disabling it does not… · CrowdStrike: VAPOR PANDA runs ARTEX against 200+ organisations, European foreign ministries… · Huntress: stolen post-MFA M365 tokens replayed within minutes; a password reset leaves planted… · JPCERT/CC and NICT: attackers decompile the public app, then call internal APIs; AI platforms…

threat06 Nov 03:46Zmulti-sourceOpen finding →
Sources: Microsoft Threat Intelligence · Todyl

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Threats1

Source distribution

  • microsoft.com1 (50%)
  • todyl.com1 (50%)
All cited sources (2)