Massive Botnet Attack Targets Microsoft 365: 130,000 Devices Exploiting Legacy Authentication

Overview

A sophisticated botnet-powered cyber attack is putting Microsoft 365 users at risk. Security researchers at SecurityScorecard have reported that over 130,000 compromised devices are being used to launch coordinated password-spraying attacks against Microsoft 365 accounts.

By bypassing MFA and exploiting legacy authentication, attackers are gaining unauthorized access to sensitive emails, documents, and collaboration tools, posing a serious risk to financial services, healthcare, government, and tech firms.

How the Attack Works

🔹 Non-Interactive Sign-Ins

Unlike traditional brute-force attacks, this method does not trigger account lockouts or security alerts. Non-interactive sign-ins are typically used for automated services and don’t require direct user interaction—allowing attackers to remain undetected.

🔹 Basic Authentication Exploitation

Attackers are leveraging legacy authentication protocols, which send credentials without encryption. This allows them to bypass modern authentication and MFA, exposing accounts to compromise.

🔹 Command and Control Coordination

Security researchers have identified six command-and-control (C2) servers orchestrating this attack. These servers:
✅ Communicate with thousands of infected devices
✅ Use proxy services from well-known cloud providers linked to China
✅ Have open ports for botnet management and attack coordination