Hackers Launch 81 Million Login Attempts Against Microsoft 365 Accounts
Microsoft 365 powers email, document sharing, Teams meetings and cloud collaboration for a great many Bermuda businesses. That popularity also makes it one of the biggest targets for attackers, and a recent campaign shows exactly how they are getting in.
TL;DR
- Attackers made more than 81 million Microsoft 365 login attempts over two weeks using passwords leaked in earlier breaches.
- They used an older sign-in method that can send a password straight through without triggering a multi-factor prompt.
- Security firm Huntress confirmed 78 accounts compromised across 64 organisations.
- Most victims had multi-factor authentication, but it was configured with gaps this method slipped through.
- The fix is mostly about closing configuration gaps, not buying new tools.
What Happened
Between 12 and 26 June, managed security firm Huntress observed a campaign that tried to sign in through Microsoft’s Azure command-line interface using username and password pairs exposed in past breaches. When a valid pair was found, the attacker authenticated using an older method called ROPC, which sends the password directly to Microsoft’s token endpoint with no interactive multi-factor prompt. The activity originated largely from a single hosting provider and was not aimed at any particular industry, it simply worked through lists of commonly reused passwords.
What Is Password Spraying?
Traditional attacks hammer one account with many password guesses, which quickly triggers a lockout. Password spraying flips that around. Attackers take a small number of likely passwords, often drawn from previous data breaches, and try them quietly across thousands of different accounts. Because each account only sees a few attempts, lockouts and alarms are rarely triggered. Even a tiny success rate across thousands of accounts gives the attacker valuable access.
Why It Matters for Bermuda
Microsoft 365 is the backbone of daily work across Bermuda, from insurance companies, law firms and accounting practices to retailers, healthcare providers, government bodies and small businesses. A single compromised account can expose email, OneDrive files, Teams conversations, SharePoint documents, business contacts and financial data. In many ransomware cases, a compromised Microsoft 365 account is simply the first step toward a much larger network breach, and because these accounts hold personal data, a takeover can quickly become a reportable incident under Bermuda’s Personal Information Protection Act.
What You Should Do
- Check that your Conditional Access policies require multi-factor authentication for All Cloud Apps and all users, not just administrators or selected apps.
- Block legacy and basic authentication methods, including the older ROPC sign-in flow this campaign relied on.
- Make sure no policy is sitting in report-only mode, which looks active but never actually enforces anything.
- Enforce strong, unique passwords and encourage a password manager, since reused old passwords were the raw material for this attack.
- Review sign-in logs for bursts of failed logins or successful sign-ins from unexpected locations.
IT Perspective
The uncomfortable lesson here is that a control you believe is switched on may still have quiet gaps. Multi-factor authentication was present in most of the affected organisations, yet attackers got through because the policy did not cover the specific path they used. It is worth periodically auditing your Microsoft 365 Conditional Access setup, not just confirming that MFA exists, but confirming exactly what it covers. Blocking legacy authentication is one of the highest-value, lowest-cost changes most organisations can make.
Tools That Can Help
Identity: Microsoft Entra ID Conditional Access, with legacy authentication and ROPC blocked.
Monitoring: Microsoft 365 sign-in logs, with alerts on impossible-travel or high-volume failed logins.
Passwords: A business password manager and checks against known breached credentials.
