Microsoft 365 Password-Spraying Campaign Compromised 78 Accounts
Summary
Huntress says a two-week password-spraying campaign generated over 81 million Microsoft 365 login attempts and compromised 78 accounts across 64 organizations, exploiting exposed credentials and Conditional Access gaps around ROPC.
Key points
- Huntress observed the campaign targeting customers from June 12 to 26, with activity peaking on June 22.
- The attacker tried username and password pairs exposed in earlier breaches through Azure CLI.
- After finding valid credentials, the attacker used the ROPC OAuth flow, which did not trigger an interactive MFA prompt in affected environments.
- Huntress confirmed 78 compromised Microsoft accounts across 64 organizations.
- Misconfigurations included limiting MFA to selected apps, user groups, or locations, leaving policies in report-only mode, or having no MFA policy.
- Huntress reported a more than 155-fold increase in password-spraying attacks; the actor remains unidentified, and the activity originated from an IPv6 range owned by LSHIY LLC.
Article Details
- Event Type
- Password-spraying campaign targeting Microsoft 365 accounts
- Impact
- Huntress reported more than 81 million login attempts over two weeks and confirmed that 78 Microsoft accounts across 64 organizations were compromised. Misconfigured or absent Conditional Access MFA policies allowed attackers using valid credentials to authenticate through the ROPC flow without an interactive MFA prompt.