Hackers target Microsoft 365 accounts with 81 million login attempts

Attackers launched a massive password-spraying campaign targeting Microsoft 365 accounts by exploiting the Resource Owner Password Credentials (ROPC) OAuth flow and Azure CLI, both of which can bypass Multi-Factor Authentication when Conditional Access Policies are misconfigured or incomplete. The root cause was not a software vulnerability but a policy enforcement failure — organizations had MFA enabled in principle but left legacy authentication pathways unblocked. This allowed attackers to sidestep modern security controls entirely, compromising 78 accounts across 64 organizations in just two weeks. The incident underscores that enabling MFA is insufficient without also disabling legacy protocols and enforcing Conditional Access comprehensively across all authentication mechanisms.