#password-spray-attack

#password-spray-attack

Microsoft's compromised corporate account did not have multi-factor authentication (MFA) enabled.

The attackers used password-spray attacks to gain access and then compromised a legacy test OAuth application to steal emails and files. [ more ]

A nation-state backed attack occurred in November 2023 where the Russian state-sponsored threat actor group Midnight Blizzard accessed some Microsoft corporate emails and documents.

The attackers used a password spray attack to gain access to the email accounts. [ more ]