A large-scale campaign built on an ordinary weakness
Between June 12 and June 26, 2026, Huntress observed more than 81 million login attempts against Microsoft 365 environments. The campaign compromised 78 accounts across 64 organizations. For an SMB, the most important number is not the volume. It is the fact that an exposed password can still open a door.
The attackers targeted Azure CLI, the tool used to administer Azure and Entra resources. They also used the OAuth flow known as ROPC, which sends credentials directly to the token endpoint and does not trigger a traditional interactive MFA prompt. This does not mean Microsoft 365 was “broken”; it shows how an access configuration can leave a less visible path under-protected.
Password spraying in plain English
In a classic brute-force attack, an attacker tries many passwords against one account, which can trigger a lockout. With password spraying, the attacker tries one common password across many accounts, then changes the password. The activity is harder to spot and often relies on username-password pairs collected from earlier breaches.
The Huntress campaign highlights two realities: automation can operate at enormous scale, and only a handful of successful logins are needed to create an incident. A mailbox, administrator account, or finance login can then support fraud, internal phishing, or further credential theft.
Why MFA does not have the same effect everywhere
MFA remains essential. But it must cover the accounts, applications, and authentication methods that people actually use. A rule limited to admin portals, selected groups, or specific locations may not protect another flow. Legacy methods and policies still running in report-only mode deserve a precise inventory.
For an SMB, the useful questions are practical: which accounts still exist, which applications can sign in, which methods are enabled, and what happens when an employee reuses a password that has already leaked?
The role of unique passwords
MFA does not replace good credential hygiene. Every important service should have a different, long, randomly generated secret. That way, compromising one account does not automatically provide the key to another service.
Soclyde addresses this part of the problem by generating and storing unique secrets in local-first vaults that remain on the user’s devices. It does not secure a Microsoft 365 configuration by itself and does not replace MFA or sign-in monitoring. It does reduce reuse and avoids concentrating sensitive credentials in a central cloud repository.
Three checks to make this week
- List the Microsoft 365 accounts, admin accounts, and shared mailboxes that still exist.
- Confirm that MFA covers every relevant user, application, and authentication flow.
- Replace reused passwords with unique secrets, then revoke sessions and tokens linked to accounts at risk.
The 81 million figure is striking. The lesson for a small business is simpler: a recycled credential and a forgotten authentication path can be enough. Reducing reuse is an immediate measure that complements MFA and Microsoft 365 controls.
To review your team’s access strategy, explore Soclyde’s local-first approach.
