Top Tweets for #AzureDevOps

🚨 Hackers Breach at Least 27 Organizations Using Stolen Microsoft Entra ID and Azure DevOps Credentials An ongoing cyberattack campaign has compromised cloud environments belonging to at least 27 organizations, with attackers abusing stolen Microsoft Entra ID application credentials and Azure DevOps identities to gain access to Microsoft 365 and Azure resources. According to security researchers at Todyl, the campaign began on November 1, targeting managed service providers (MSPs) and their customers across government, energy, transportation, education, legal, and other sectors. Investigators have identified extensive unauthorized activity, including: • 27 organizations affected • 45 application registrations targeted • 33+ successful application authentications • Approximately 2,279 mailbox items accessed • 81 files downloaded from compromised environments • One application used to access 15 customer tenants Stolen information included password lists, private keys, VPN configurations, backup credentials, and remote access settings, raising concerns about additional compromises. Attackers were able to impersonate trusted applications and access cloud resources without triggering traditional user MFA challenges. No Microsoft vulnerability was exploited. Attack Details • Initial activity: November 1, 2026 • Targeted platforms: Microsoft Entra ID, Azure DevOps, Microsoft 365 • Attack method: Stolen application credentials and session token abuse • Confirmed source IP: 199[.]19[.]77[.]84 • Attribution: Unknown • Status: Ongoing investigation Organizations are advised to investigate unusual service principal activity, revoke compromised credentials, rotate exposed secrets, and review third-party application permissions.