6 posts tagged with "microsoft"

Fluency investigated a compromise at one customer. An attacker captured an employee's password and a one-time MFA code, signed in to Workday through Microsoft single sign-on, and held the Workday session open for about nine hours with an automated script. The session kept working for 83 minutes after the employee's password was reset and their Microsoft sessions were revoked.

The way in resembles the published "payroll pirate" campaigns, in which attackers change an employee's direct-deposit details so the next paycheck goes to an account they control. Here no bank or payment change was made before the session ended, but the attacker did view the employee's tax documents, date of birth, salary and contact details. Any Microsoft Entra ID tenant that signs users in to Workday or another HR or payroll app through SSO is exposed in the same way. Fluency swept every customer tenant and found no other customer affected.

On November 10, 2026, Fluency released a detection to every instance for the step that let this attack through: a user who signs in with a passkey completing a sign-in with a password and a weaker MFA method from a new network. No action is needed to turn it on.

A low-and-slow password spray against Microsoft 365 / Entra ID accounts has been running since at least October 1, 2026, and is still active. Fluency sees it in 42 of 104 monitored Microsoft 365 tenants. The attacker tries one password per account from a fresh IP address almost every time, so per-IP lockouts and thresholds never trigger. Part of the traffic comes from OpenBullet / SilverBullet credential-stuffing configs.

In October the attacker entered the correct password for accounts in several customer tenants. MFA or Entra Smart Lockout was the only thing that stopped each of those sign-ins, and we found no successful attacker sign-in. On October 30 and 31, 2026, Fluency released to every instance two new detections and two updated ones that alert on a correct password from this campaign, including on tenants without Microsoft Entra ID P2 (Identity Protection). No action is needed to turn them on, but every account whose password the attacker had needs a reset.

Attackers are spraying passwords from old breaches at Microsoft 365 accounts through the Azure command-line client (Azure CLI), whose password-only sign-in never shows an MFA prompt. Huntress reported one campaign that made more than 81 million sign-in attempts in two weeks of June 2026 and compromised 78 accounts at 64 organizations.

Any organization whose MFA policy leaves gaps (some users, some apps, trusted locations, report-only mode) is exposed. MSSPs should check every tenant they manage. On October 23, 2026, Fluency released to every instance a detection for the takeover that follows a blocked attempt. No action is needed to turn it on.

An attacker stole the credentials of ConnectWise's multi-tenant Cloud Backup (formerly SkyKick) and Cloud Management apps. It then signed in to customers' Microsoft 365 tenants as those apps, with no user and no MFA. Microsoft attributed the attack on October 21, 2026 to Storm-0940, a China state-aligned actor that automated it with an AI penetration-testing framework. Microsoft counts attempts against more than 2,250 tenants. In several cases, the actor went from first targeting to privileged access in under three hours.

Any tenant that consented to one of these apps should be checked for changes the attacker made. MSPs use the apps widely, so MSSPs should check every tenant they manage. Every other tenant runs the same kind of risk through the vendor apps it trusts. On October 23, 2026, Fluency released four detections to every instance for an app that hands out directory roles or keys other apps. No action is needed to turn them on.

Attackers posing as IT support are contacting employees on Microsoft Teams from throwaway Microsoft 365 tenants. They call within seconds of opening a chat and talk the employee into a remote-support session, a fake IT page or an installer. This is the campaign Microsoft Threat Intelligence described on September 2, 2026, which turns one remote session into enterprise-wide access.

Any organization that allows Teams chats from outside tenants is exposed, and Teams allows them by default. MSSPs should check every tenant they manage. On October 23, 2026, Fluency released two detections for the campaign to every instance. No action is needed to turn them on.

On November 13, 2025, Microsoft briefly changed the user ID in the Office 365 audit feed to all lowercase. For users whose usernames contain capital letters, Fluency saw the lowercase name as a new user, so O365_AzureAD_UserLoggedIn and other rules that key on the field raised false positives.

No action is needed. Alerts raised during that window for this reason can be closed as false positives.