Microsoft says agent signed in to dozens of applications
Microsoft says attackers stole Azure Key Vault secrets in a handful of cases and accessed SharePoint, OneDrive and mailbox items through compromised applications.
Loading… Բեռնվում է…
Microsoft says attackers stole Azure Key Vault secrets in a handful of cases and accessed SharePoint, OneDrive and mailbox items through compromised applications.
An agent successfully signed in as an application identity to dozens of associated applications across multiple cloud tenants, Microsoft said. The company also said agents stole secrets from organizations' Azure Key Vault in a handful of cases, while compromised applications accessed SharePoint, OneDrive and mailbox items, including downloading files.
A tenant is an organization’s cloud environment, and the application identity used to sign in is known as a service principal. Microsoft’s figures describe applications and tenants, not a total number of affected organizations. The activity is assessed to have been ongoing since August 2026.
The Hacker News said Microsoft had observed attackers using agentic superintelligence (SI) tools to search public GitHub repositories for exposed credentials and API keys. Such tools can carry out sequences of tasks with less direct operator involvement. Microsoft said tools like ARTEX, an autonomous penetration-testing tool, can scan repositories, analyze the results and conduct follow-on attacks.
Some of the subsequent activity involved valid application credentials being used to access organizational tenants in Microsoft Entra ID, a cloud identity and access-management service, and connected Azure and Microsoft 365 resources. The tools obtained a token for an OAuth application restricted to the target organization, then used the compromised application to find other cloud resources. An OAuth token lets an application use the access granted to it; its permissions determine which resources it can reach.
In one reported case, an agent went from scanning GitHub for secrets to taking data from Azure Key Vault in 5 minutes.
Microsoft said attackers targeted operations that return credentials, including storage account keys, application settings, connection strings, publishing credentials and Azure Kubernetes Service user credentials. The agents also repeatedly sought credentials for SI services, including API keys and applications with access to Foundry Tools.
The attackers were also observed attempting to steal Azure resources, including compromised Azure AI services. The Hacker News said this was likely intended to support broader attacks; that purpose was not presented as an established subsequent use.
The data-center company moved its operational target from year-end to January 2027, with a possible extension through the end of February, after design changes requested by Microsoft and supplier timing affected the schedule.
2 min
The update covers seven areas, including fixes Google says address failed typing, display problems and unexpected restarts. It is reaching devices in stages.
3 min
The planned Blue Marlin terminal off Louisiana could export up to 2 million barrels of crude oil a day, the US Transportation Department says.
2 min
