4 posts tagged with "microsoft"

Attackers are spraying passwords from old breaches at Microsoft 365 accounts through the Azure command-line client (Azure CLI), whose password-only sign-in never shows an MFA prompt. Huntress reported one campaign that made more than 81 million sign-in attempts in two weeks of June 2026 and compromised 78 accounts at 64 organizations.

Any organization whose MFA policy leaves gaps (some users, some apps, trusted locations, report-only mode) is exposed. MSSPs should check every tenant they manage. On October 23, 2026, Fluency released to every instance a detection for the takeover that follows a blocked attempt. No action is needed to turn it on.

An attacker stole the credentials of ConnectWise's multi-tenant Cloud Backup (formerly SkyKick) and Cloud Management apps. It then signed in to customers' Microsoft 365 tenants as those apps, with no user and no MFA. Microsoft attributed the attack on October 21, 2026 to Storm-0940, a China state-aligned actor that automated it with an AI penetration-testing framework. Microsoft counts attempts against more than 2,250 tenants. In several cases, the actor went from first targeting to privileged access in under three hours.

Any tenant that consented to one of these apps should be checked for changes the attacker made. MSPs use the apps widely, so MSSPs should check every tenant they manage. Every other tenant runs the same kind of risk through the vendor apps it trusts. On October 23, 2026, Fluency released four detections to every instance for an app that hands out directory roles or keys other apps. No action is needed to turn them on.

Attackers posing as IT support are contacting employees on Microsoft Teams from throwaway Microsoft 365 tenants. They call within seconds of opening a chat and talk the employee into a remote-support session, a fake IT page or an installer. This is the campaign Microsoft Threat Intelligence described on September 2, 2026, which turns one remote session into enterprise-wide access.

Any organization that allows Teams chats from outside tenants is exposed, and Teams allows them by default. MSSPs should check every tenant they manage. On October 23, 2026, Fluency released two detections for the campaign to every instance. No action is needed to turn them on.

On November 13, 2025, Microsoft briefly changed the user ID in the Office 365 audit feed to all lowercase. For users whose usernames contain capital letters, Fluency saw the lowercase name as a new user, so O365_AzureAD_UserLoggedIn and other rules that key on the field raised false positives.

No action is needed. Alerts raised during that window for this reason can be closed as false positives.