Removing a leaked key from code does not revoke it
Microsoft reports attackers using agentic tools to find exposed credentials in public code repositories and pursue cloud access. In one observed case, the path from finding a secret to extracting Azure Key Vault data took five minutes. Follow-on activity seen from October 28 included valid application credentials used across tenants, with some vendor-owned applications exposing downstream customers. Application identities can reach data without an interactive staff login, so a district's identity review must include integrations and service accounts. Deleting the public file is insufficient: an exposed credential remains usable until it is revoked or rotated. The immediate operational issue is the lifetime and reach of a secret, not whether the attacker is entirely autonomous.
Why it matters for leaders
Assign owners to high-privilege application identities. Check approved repositories and integration inventories for exposure, rotate affected credentials, and investigate historical use. Ask critical vendors how they notify downstream tenants. Prioritize managed identities or short-lived credentials where supported and cost the migration work.
Cost, service, risk & adoption
Microsoft threat-intelligence observations cover activity beginning in August and later cloud investigations. The report includes authentication, resource-access and adaptive retry evidence, plus containment guidance.
What the evidence cannot tell us
This is provider-observed activity, not a representative estimate of district compromise. Five minutes describes one case. Some linked activity and infrastructure associations are assessed rather than conclusively attributed.
Read the original sources
Summary and leadership analysis from the Week ending 2026-11-06 brief. The edition’s selection notes explain source access and evidence limitations.