[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fETJKNb_Y_Yp20qytEEnn35-i68qzClpDUs9_ApzTnrk":3},{"article":4,"iocs":55,"watch_terms":56,"solutions":57,"lesson":149},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"f45cebcb-f286-4a67-9d8b-66292a5b5889","Hackers target Microsoft 365 accounts with 81 million login attempts","hackers-target-microsoft-365-accounts-with-81-million-login-attempts-d03514","An aggressive password-spraying campaign targeting Microsoft 365 environments generated more than 81 million login attempts over a two-week period. [...]","A large-scale password-spraying campaign generated over 81 million login attempts against Microsoft 365 accounts in two weeks. Attackers exploited the Azure CLI and the ROPC OAuth mechanism, bypassing MFA due to misconfigured Conditional Access Policies. Huntress observed the compromise of 78 accounts across 64 organizations, highlighting the need for robust MFA enforcement.","Hackers attempted 81 million logins to Microsoft 365 accounts using password spraying.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fhackers-target-microsoft-365-accounts-with-81-million-login-attempts\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F07\u002F01\u002FAzure.jpg","2026-07-01T16:38:01+00:00","2026-07-01T18:00:11.715812+00:00",8,[17,20,22,25,27,29],{"name":18,"type":19},"Microsoft 365","product",{"name":21,"type":19},"Azure CLI",{"name":23,"type":24},"ROPC OAuth","technology",{"name":26,"type":24},"MFA",{"name":28,"type":24},"Conditional Access Policies",{"name":30,"type":31},"Huntress","vendor","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":32,"icon":34,"name":35,"slug":36},null,"Threat Intelligence","threat-intelligence",[38,43,48,53],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":49},{"id":50,"icon":34,"name":51,"slug":52},"c70f3a41-2f0c-4608-870d-b8cbcd8be076","Cloud Security","cloud-security",{"category":54},{"id":32,"icon":34,"name":35,"slug":36},[],[30,18,21],{"controls":58,"vendors":137},[59,88,114],{"slug":60,"name":61,"problem":62,"products":63},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[64,72,80],{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"slug":89,"name":90,"problem":91,"products":92},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[93,98,106],{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":94,"product_name":95,"url":96,"description":97},"identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"slug":115,"name":116,"problem":117,"products":118},"saas-security-posture","SaaS security posture management (SSPM)","Business apps like Microsoft 365 and Salesforce stop leaking through risky settings and connected apps.",[119,124,130],{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":120,"product_name":121,"url":122,"description":123},"falcon-shield","Falcon Shield","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Ffalcon-shield\u002F","SaaS security posture management, from CrowdStrike's acquisition of Adaptive Shield.",{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":125,"product_name":126,"url":128,"description":129},"appomni","AppOmni","\u002Fvendor-logos\u002Fappomni.png","https:\u002F\u002Fappomni.com\u002F","SaaS security posture management for platforms such as Salesforce, Microsoft 365 and ServiceNow.",{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":132,"url":135,"description":136},"obsidian-security","Obsidian Security","\u002Fvendor-logos\u002Fobsidian-security.png","obsidian","https:\u002F\u002Fwww.obsidiansecurity.com\u002F","SaaS posture management and detection of account and integration compromise.",[138,143],{"slug":139,"name":30,"logo_path":140,"roles":141},"huntress","\u002Fvendor-logos\u002Fhuntress.png",[142],"reported_by",{"slug":144,"name":145,"logo_path":146,"roles":147},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png",[148],"affected",{"slug":150,"title":151,"body":152,"framework_refs":153,"framework_notes":166},"81-million-login-attempts-expose-mfa-gaps-in-microsoft-365","81 Million Login Attempts Expose MFA Gaps in Microsoft 365","Attackers launched a massive password-spraying campaign targeting Microsoft 365 accounts by exploiting the Resource Owner Password Credentials (ROPC) OAuth flow and Azure CLI, both of which can bypass Multi-Factor Authentication when Conditional Access Policies are misconfigured or incomplete. The root cause was not a software vulnerability but a policy enforcement failure — organizations had MFA enabled in principle but left legacy authentication pathways unblocked. This allowed attackers to sidestep modern security controls entirely, compromising 78 accounts across 64 organizations in just two weeks. The incident underscores that enabling MFA is insufficient without also disabling legacy protocols and enforcing Conditional Access comprehensively across all authentication mechanisms.",[154,155,156,157,158,159,160,161,162,163,164,165],"CIS Control 4: Secure Configuration of Enterprise Assets and Software","CIS Control 6: Access Control Management","CIS Control 12: Network Infrastructure Management","NIST SP 800-63B: Digital Identity Guidelines — Authenticator Assurance Levels","NIST AC-2: Account Management","NIST AC-17: Remote Access","NIST IA-5: Authenticator Management","NIST SI-4: System Monitoring","Microsoft Zero Trust Framework: Identity Pillar","GDPR Article 32: Security of Processing (adequate technical controls)","MITRE ATT&CK T1110.003: Password Spraying","MITRE ATT&CK T1078: Valid Accounts",{"NIST AC-17: Remote Access":167,"NIST SI-4: System Monitoring":168,"NIST AC-2: Account Management":169,"MITRE ATT&CK T1078: Valid Accounts":170,"NIST IA-5: Authenticator Management":171,"CIS Control 6: Access Control Management":172,"MITRE ATT&CK T1110.003: Password Spraying":173,"Microsoft Zero Trust Framework: Identity Pillar":174,"CIS Control 12: Network Infrastructure Management":175,"CIS Control 4: Secure Configuration of Enterprise Assets and Software":176,"GDPR Article 32: Security of Processing (adequate technical controls)":177,"NIST SP 800-63B: Digital Identity Guidelines — Authenticator Assurance Levels":178},"Requires managing remote access, such as conditional access policies covering every sign-in flow including Azure CLI.","Requires system monitoring, which can spot password spraying patterns across many accounts.","Requires account management, including monitoring accounts targeted by the 81 million login attempts.","Describes using valid stolen credentials, the outcome attackers sought by finding accounts without MFA enforced.","Requires authenticator management, including strong password rules and MFA enforcement against spraying.","Asks for MFA on all accounts and access paths, which the incomplete conditional access policies failed to deliver.","Describes password spraying, the technique behind the 81 million login attempts.","Requires explicit verification of every access request, the principle broken when ROPC and Azure CLI bypassed MFA.","Asks for secure network infrastructure, including controlling which tools and endpoints can authenticate to Microsoft 365.","Asks for secure configuration, such as blocking legacy flows like ROPC that let password spraying bypass MFA in Microsoft 365.","Requires adequate technical controls for personal data, including MFA enforcement across all sign-in paths.","Sets authenticator assurance levels, making clear that single factor password flows like ROPC are not acceptable."]