Executive Summary
Beginning November 1, 2026, a campaign dubbed 'Key Eater' has targeted approximately 18 organizations, primarily Managed Service Providers (MSPs), by abusing stolen application credentials and workload identities. The actor uses valid client secrets and federated workload identities to sign into Entra ID and Azure DevOps, bypassing traditional user-focused security measures like Multi-Factor Authentication (MFA). Once inside, the actor moves at machine speed to harvest credentials, configuration files, and private keys from Azure Key Vault and SharePoint, often reaching downstream client tenants within minutes of the initial compromise.
The activity is characterized by highly automated, scripted clients (likely AI-assisted) that execute rapid sign-in loops and bulk file downloads. While there are behavioral similarities to China-aligned actor Storm-0940, researchers currently assess this as a distinct, unattributed campaign. The impact is significant for MSPs, as a single compromised multi-tenant application provides the attacker with immediate access to a broad range of client environments, including government, energy, and transportation sectors.
Organizations are urged to shift from client secrets to managed identities where possible and to implement Conditional Access policies specifically for workload identities. Because the attacker relies on stolen secrets rather than interactive logins, traditional perimeter and user-identity defenses may fail to detect the intrusion.