81 million login attempts hit Microsoft 365 accounts as hackers try password-spraying to force entry using stolen credentials and OAuth to bypass authentication

Microsoft 365.

• A password-spraying attack successfully breached Microsoft 365 accounts
• The hackers abused improperly configured conditional access policies to bypass MFA
• Many organizations targeted had no MFA implemented

Hackers have used previously leaked credentials to target Microsoft 365 accounts in a password-spraying attack that resulted in over 81 million login attempts during a two-week period.