Threat campaign 'Key Eater' is actively exploiting stolen Microsoft Entra ID application credentials to infiltrate Azure and Microsoft 365 environments across 27 organizations via managed service providers. Since November 1, 2026, attackers have authenticated into 33 of 45 targeted app registrations, downloaded 81 files, and exfiltrated 2,279 mailbox items including passwords, private keys, VPN profiles, and backup credentials. The operator, identified at 199.19.77.84, uses scripted tooling and adapted signatures after detection on November 3; no Microsoft system vulnerabilities were exploited.
// Get alerts for Microsoft Azure