Stolen application credentials are opening cloud environments to an unidentified operator, according to Todyl’s Key Eater investigation. Its latest 3 November update says activity beginning on 1 November reached 27 organisations, including managed service providers and their customers.
Todyl reports 81 files downloaded and around 2,279 mailbox items accessed within its telemetry. The operator used valid app secrets, an Azure DevOps federated workload identity and replayed user sessions. No Microsoft vulnerability is involved; the original source of the credentials remains unknown.
The company describes a human-directed operation with scripted activity, rather than a self-propagating worm. AI involvement is unconfirmed. Its latest assessment treats the activity as unrelated to the earlier ConnectWise Cloud Backup compromise, superseding an earlier tentative connection. The figures reflect Todyl’s visibility, not a complete victim count.
App identities need their own controls
Microsoft’s Conditional Access documentation for workload identities explains why protecting user accounts alone leaves a gap: these nonhuman identities cannot perform multifactor authentication. Administrators need policies that explicitly target eligible service principals.
There are important limits. Workload identity policies cover single-tenant service principals registered in the organisation’s tenant. Multitenant applications, third-party SaaS and managed identities are outside their scope. A service principal must be assigned directly to a policy; putting it in a targeted group does not enforce that policy.
Creating or modifying those policies requires Workload Identities Premium licensing. Microsoft supports location- and risk-based blocking and lets administrators assess a policy in report-only mode before enforcing it.
Review machine sign-ins as well as users
The service principal sign-in log records authentication by applications using credentials such as secrets or certificates. Microsoft groups matching events by identity, status, source IP and resource; analysts can expand a row to inspect individual timestamps. Managed identity activity has a separate log.
Todyl recommends investigating exposed applications’ permissions, rotating compromised and downstream credentials, and reviewing customer-tenant access rather than stopping at the MSP.
