Microsoft 365 users targeted in massive password spray attack with 81 million login attempts; Huntress reports at least 78 successful breaches.

A massive password spray attack targeting Microsoft 365 users has raised alarms as hackers made 81 million login attempts between June 12 and 26, with Huntress reporting at least 78 successful breaches. The attack originated from a single source, an IPv6 address range controlled by internet provider LSHIY LLC.³

The attackers exploited older protocols like ROP (Resource Owner Password Credentials) to bypass multi-factor authentication (MFA), which many affected organizations had in place. This highlights a significant flaw in corporate security measures, as the attack took advantage of previously exposed credentials and vulnerabilities in MFA configurations.⁴

Huntress had been monitoring these spray attacks and noted a gradual increase starting June 12, culminating in a sudden spike on June 22, when 30 customers were affected. The attack's success underscores the need for organizations to reassess their security protocols, as legacy authentication methods are proving inadequate against such sophisticated threats.²

Experts emphasize that true security cannot be achieved by merely adding more conditional rules or relying on users to identify phishing attempts. Instead, organizations must adopt more robust security measures to protect against evolving cyber threats.