Stolen Cloud App Secrets Let Attackers Cascade Through MSP Clients
This is a DailyCyber.News update, brought to you by BareMetalCyber.com, for Thursday, November 5th, 2026.
Attackers are using valid Microsoft Entra application secrets to move through managed service providers and target downstream clients at machine speed. About ninety five percent of the observed sign-ins used scripted clients. That included bursts of 24 attempts in 10 seconds. Researchers believe one operator is working through credentials collected before November 1st, but they haven’t tied the activity to a specific AI workflow.
Application registrations allow software to authenticate without a person present. Stolen secrets can therefore bypass security controls that focus mainly on employee logins. MSP relationships can also amplify the blast radius across sectors, even though this isn’t a traditional software-update attack.
Leaders should give nonhuman identities the same ownership and risk review applied to privileged users. Defenders should rotate exposed secrets, investigate rapid scripted sign-ins and reduce each application’s permissions to the minimum required.
The larger lesson is that automation can turn old credentials into fast, cascading access. Rotate application secrets, reduce their permissions and alert on rapid nonhuman sign-ins across both MSP and customer environments.
For the sources and the full Daily Cyber newsletter, visit DailyCyber.News.
