As cited
Copy frozen at (site build).
identity access
Attacker abuses Microsoft Entra ID to target downstream MSP clients
An attacker obtained valid credentials to gain unauthorized access to multiple organizations across sectors by abusing Microsoft Entra ID (formerly Azure Active Directory). The campaign targeted downstream clients of managed service providers (MSPs) that rely on Entra ID for authentication and access control.
Why it matters: MSP customers and organizations using Entra ID for identity management face exposure to lateral movement and data theft when MSP infrastructure is compromised; review authentication logs and enforce conditional access policies to detect anomalous sign-ins.
- Source published
- First seen by Cybersecurity Tracker