Attackers are spraying passwords from old breaches at Microsoft 365 accounts through the Azure command-line client (Azure CLI), whose password-only sign-in never shows an MFA prompt. Huntress reported one campaign that made more than 81 million sign-in attempts in two weeks of June 2026 and compromised 78 accounts at 64 organizations.

Any organization whose MFA policy leaves gaps (some users, some apps, trusted locations, report-only mode) is exposed. MSSPs should check every tenant they manage. On October 23, 2026, Fluency released to every instance a detection for the takeover that follows a blocked attempt. No action is needed to turn it on.

Attackers posing as IT support are contacting employees on Microsoft Teams from throwaway Microsoft 365 tenants. They call within seconds of opening a chat and talk the employee into a remote-support session, a fake IT page or an installer. This is the campaign Microsoft Threat Intelligence described on September 2, 2026, which turns one remote session into enterprise-wide access.

Any organization that allows Teams chats from outside tenants is exposed, and Teams allows them by default. MSSPs should check every tenant they manage. On October 23, 2026, Fluency released two detections for the campaign to every instance. No action is needed to turn them on.

Fluency has released new behavior rules for Microsoft Entra ID and Microsoft 365 that detect three campaigns reported by Microsoft Threat Intelligence: adversary-in-the-middle session theft, device-code phishing, and takeover of whole tenants through a registered app.

The rules rolled out October 18–20, 2026 and reach every instance automatically. No configuration is needed.

The v2 interface is available on every Fluency instance. To open it, add /v2 after your instance's address. Every escalated case now comes with an AI investigation report attached.

The Fluency platform now has a public status page. saasmgr.ingext.io/status shows the current operational status of the platform, so you can check it directly before opening a support request.

Free trials now run on the new Fluency platform, and they are fully self-service. Sign up at trial.ingext.io/signup, confirm your email, and your trial instance launches on its own, ready for your first data sources.

Fluency instances are moving to the new Fluency SaaS platform. Each instance is migrated application by application, most data sources move over without any change on your side, and your current instance stays available while you try the new one.

Fluency is introducing the Fluency Logic Layer™, an architecture built for AI-assisted operations. It turns security expertise — investigation procedures, behavioral analytics, reporting methods and operational workflows — into governed capabilities that AI assistants such as Claude, Codex and ChatGPT, as well as analysts, MSSPs and automation, can call directly.

The Logic Layer is available now as part of the Fluency platform.

The FPLv2 engine now follows JavaScript strict-mode rules. An assignment to a variable that was never declared, such as a = 1, now fails validation. Processors from the Fluency repository are already updated. Processors written or edited on your own instance should be checked.

Ingext Community Edition, free on AWS Marketplace since 2024, now also installs into your own Kubernetes cluster on AWS, Microsoft Azure or Google Cloud, from Helm charts. It collects, labels, enriches, transforms and routes telemetry before it reaches a SIEM, and stores it in a searchable data lake in your own cloud account.