Evidence · DiggingBeagle record
Todyl: stolen app credentials, downstream MSP access and suspected agentic harvesting
First-party investigation updated November 6, with downstream tenant access and cautious overlap with a Microsoft ARTEX operation.
- Source role
- primary disclosure
Evidence record
First-party investigation updated November 6, with downstream tenant access and cautious overlap with a Microsoft ARTEX operation.
Claim-level citations (1)
- supportsMicrosoft traces agentic cloud-secret abuse from GitHub into Azure Key Vault: Todyl reported about 45 app registrations targeted across roughly 18 organizations, more than 33 successful app sign-ins, and access extending to 27 organizations through managed-service-provider relationships. Its November 6 update linked observed infrastructure to Microsoft’s ARTEX credential-harvesting report, without independently recording the model’s per-action decisions.
November 3, 4:36 p.m. MT update, What we are seeing; November 6, 1:19 p.m. MT update, Root cause and Microsoft correlation