Attackers are spraying passwords from old breaches at Microsoft 365 accounts through the Azure command-line client (Azure CLI), whose password-only sign-in never shows an MFA prompt. Huntress reported one campaign that made more than 81 million sign-in attempts in two weeks of June 2026 and compromised 78 accounts at 64 organizations.

Any organization whose MFA policy leaves gaps (some users, some apps, trusted locations, report-only mode) is exposed. MSSPs should check every tenant they manage. On October 23, 2026, Fluency released to every instance a detection for the takeover that follows a blocked attempt. No action is needed to turn it on.

An attacker stole the credentials of ConnectWise's multi-tenant Cloud Backup (formerly SkyKick) and Cloud Management apps. It then signed in to customers' Microsoft 365 tenants as those apps, with no user and no MFA. Microsoft attributed the attack on October 21, 2026 to Storm-0940, a China state-aligned actor that automated it with an AI penetration-testing framework. Microsoft counts attempts against more than 2,250 tenants. In several cases, the actor went from first targeting to privileged access in under three hours.

Any tenant that consented to one of these apps should be checked for changes the attacker made. MSPs use the apps widely, so MSSPs should check every tenant they manage. Every other tenant runs the same kind of risk through the vendor apps it trusts. On October 23, 2026, Fluency released four detections to every instance for an app that hands out directory roles or keys other apps. No action is needed to turn them on.

Attackers posing as IT support are contacting employees on Microsoft Teams from throwaway Microsoft 365 tenants. They call within seconds of opening a chat and talk the employee into a remote-support session, a fake IT page or an installer. This is the campaign Microsoft Threat Intelligence described on September 2, 2026, which turns one remote session into enterprise-wide access.

Any organization that allows Teams chats from outside tenants is exposed, and Teams allows them by default. MSSPs should check every tenant they manage. On October 23, 2026, Fluency released two detections for the campaign to every instance. No action is needed to turn them on.

Fluency has released new behavior rules for Microsoft Entra ID and Microsoft 365 that detect three campaigns reported by Microsoft Threat Intelligence: adversary-in-the-middle session theft, device-code phishing, and takeover of whole tenants through a registered app.

The rules rolled out October 18–20, 2026 and reach every instance automatically. No configuration is needed.

The v2 interface is available on every Fluency instance. To open it, add /v2 after your instance's address. Every escalated case now comes with an AI investigation report attached.

The Fluency platform now has a public status page. saasmgr.ingext.io/status shows the current operational status of the platform, so you can check it directly before opening a support request.

Free trials now run on the new Fluency platform, and they are fully self-service. Sign up at trial.ingext.io/signup, confirm your email, and your trial instance launches on its own, ready for your first data sources.

Fluency instances are moving to the new Fluency SaaS platform. Each instance is migrated application by application, most data sources move over without any change on your side, and your current instance stays available while you try the new one.

Fluency is introducing the Fluency Logic Layer™, an architecture built for AI-assisted operations. It turns security expertise (investigation procedures, behavioral analytics, reporting methods and operational workflows) into governed capabilities that AI assistants such as Claude, Codex and ChatGPT, as well as analysts, MSSPs and automation, can call directly.

The Logic Layer is available now as part of the Fluency platform.

The FPLv2 engine now follows JavaScript strict-mode rules. An assignment to a variable that was never declared, such as a = 1, now fails validation. Processors from the Fluency repository are already updated. Processors written or edited on your own instance should be checked.