As reported by BleepingComputer, a large-scale password-spraying campaign recently bombarded Microsoft 365 environments with more than 81 million login attempts over a two-week window — a volume that signals not just opportunistic credential stuffing, but a deliberate, operationally mature attack infrastructure.
Why This Campaign Is Different
Password spraying is not new. But 81 million attempts across a compressed timeframe represents a step-change in scale that most identity security programs are not calibrated to detect or absorb. Traditional account lockout thresholds and per-IP rate limiting are increasingly ineffective against distributed spraying operations that rotate through thousands of residential proxies, cloud VMs, and compromised infrastructure nodes. Attackers have learned to stay well below per-account lockout thresholds while operating at massive aggregate scale — a classic low-and-slow technique applied at industrial volume.
What makes Microsoft 365 a perennial target is its dual role as both an identity provider and a business-critical data repository. Compromising a single M365 account can yield access to email, SharePoint, OneDrive, Teams conversations, and — critically — authentication tokens that can be replayed across connected third-party SaaS platforms. The blast radius of a single successful spray hit is enormous.
Who Is Most at Risk
Organizations with the following characteristics face elevated exposure from campaigns of this nature:
The Attacker's Playbook
Modern password-spraying tooling — including open-source frameworks like MSOLSpray and its successors — is purpose-built for Microsoft 365's authentication endpoints. Threat actors prioritize the autodiscover and ActiveSync endpoints specifically because they can be probed without triggering the same visibility as interactive logins. Attackers also leverage valid-but-expired tokens and enumerate valid usernames via timing differences in authentication error responses before ever attempting a password.
Shield53 Analyst Note: The sheer volume here suggests the threat actors are operating with automated orchestration — likely renting access to a botnet or using a spray-as-a-service offering on criminal forums. This is no longer the domain of sophisticated nation-state actors; it is increasingly commoditized.
Broader Implications for Identity Security Programs
This campaign is a forcing function for security leaders to re-examine their identity threat detection posture — not just their preventative controls. MFA alone is insufficient if legacy auth remains enabled, if Conditional Access policies have gaps, or if your SIEM is not correlating failed authentication telemetry across tenants and time windows. Identity is now the primary attack surface, and most detection stacks were built for network-centric threat models.
There is also a growing intelligence gap: organizations rarely know when they are being sprayed until accounts fall. Proactive hunting against Entra ID Sign-In Logs and Microsoft Sentinel's identity workbooks should be a standard practice, not a reactive measure.
Shield53 Recommendations
Immediate Actions
- Disable legacy authentication protocols immediately — Use Entra ID's Authentication Methods policies to block Basic Auth across all users. Microsoft provides a dedicated Conditional Access policy template for this.
- Audit Conditional Access policy coverage — Identify any users, applications, or network locations excluded from MFA enforcement. Every exclusion is a potential spray landing zone.
- Enable and review Entra ID Identity Protection — Configure risk-based Conditional Access to automatically block or challenge sign-ins flagged as high-risk. Ensure alerts are routed to your SOC.
- Deploy Microsoft's password protection for on-premises AD — Enforce banned password lists in hybrid environments to prevent weak passwords from syncing to Entra ID.
Detection Guidance
- Hunt for high-volume failed sign-ins from distributed source IPs targeting the same usernames within rolling 24-hour windows.
- Alert on successful logins following a pattern of recent failures — especially from new ASNs or geographies inconsistent with user behavior baselines.
- Monitor ActiveSync and EWS authentication events separately from interactive logins, as spray tooling preferentially targets these endpoints.
- Review Named Locations and Trusted IP configurations for stale or overly broad ranges that may be suppressing alerting.
Longer-Term Posture Improvements
- Accelerate migration to phishing-resistant MFA (FIDO2 security keys or Certificate-Based Authentication) for privileged and high-value accounts.
- Conduct a quarterly review of service account authentication methods — these are chronically under-protected and frequently targeted.
- Consider deploying Microsoft Entra ID Password Protection's custom banned password list tailored to your organization's naming conventions, which attackers commonly exploit.
The 81 million attempt figure is a headline, but the operational reality is that even a 0.01% success rate against that volume yields hundreds of compromised accounts. Identity resilience is not optional — it is now the foundation of enterprise security posture.
