Exposed application credentials: Microsoft sees an agentic framework search GitHub for OAuth and cloud application secrets and then sign in as the applications from 2026-10-28, and Todyl sees an operator use MSP applications to reach 27 organisations, government clients among them

Microsoft reports that since August 2026 threat actors have used the agentic offensive framework ARTEX to submit large volumes of queries to public GitHub for secrets (Microsoft Threat Intelligence, 2026-11-05). As early as 2026-10-28 it saw successful service-principal sign-ins from two IP addresses, one a Tor exit node that may carry unrelated activity, across dozens of applications in several tenants, including a vendor-owned multitenant application whose credential was compromised at the source and used to reach multiple downstream tenants (Microsoft Threat Intelligence, 2026-11-05). Microsoft states that a similar campaign involving the same addresses was also reported by Todyl (Microsoft Threat Intelligence, 2026-11-05).

Todyl, from its managed-detection telemetry, describes one operator who since 2026-11-01 has signed in to MSPs' Microsoft 365 and Azure environments as their own applications with stolen credentials that are still valid: about 45 app registrations at roughly 18 organisations were targeted, more than 33 authenticated, and 27 organisations were reached, among them the MSPs' downstream clients in government (Todyl, 2026-11-03). For nearly every credential the operator requests an Azure Resource Manager token, then a Key Vault token, and within minutes applications that had never been used start authenticating; MSP multitenant and delegated-admin apps and Partner Center tokens reach client tenants, one app sweeping 15 client tenants in about 10-second loops (Todyl, 2026-11-03). Todyl says no Microsoft vulnerability is involved, that it saw no persistence and does not know how the credentials were obtained, and that several seed secrets had only ever been used from staff devices and office networks, which points to a file store or live backend rather than configurations crawled from the internet (Todyl, 2026-11-03). After its detections fired on 2026-11-03 the operator switched to spoofed browser user agents and replayed users' refresh tokens, all blocked by Conditional Access (Todyl, 2026-11-03).

Triage: the invalid-secret and expired-secret errors alone only show that someone holds an old or wrong credential for the app; Microsoft treats a failure followed by a success as the urgent case (Microsoft Threat Intelligence, 2026-11-05).