Massive botnet is targeting Microsoft 365 accounts across the world

A padlock resting on a keyboard.
(Image credit: Passwork)

  • A new password spraying attack was recently observed
  • It targets organizations and M365 accounts in the West
  • The attack focuses on Non-Interactive Sign-Ins

Hackers, possibly of Chinese affiliation, are targeting organizations in the west with a large-scale password spraying attack, experts have claimed.

A report from cybersecurity researchers SecurityScorecard says businesses relying on Microsoft 365 office software for email, document storage, and collaboration, are at particular risk.

SecurityScorecard said it has found evidence of “China-affiliated threat actors” using infrastructure “tied to” CDS Global Cloud and UCLOUD HK, providers with “operational ties” to China. The researchers also said they saw servers hosted in SharkTech being used for the campaign’s C2. SharkTech is allegedly a US-based provider that’s hosted malicious activity in the past.

Microsoft 365 targeted by attacks

Password spraying is hardly new, but there are things that make this campaign stand out as notably dangerous, such as leveraging non-interactive sign-ins. This helps the attackers avoid being detected by traditional security controls.

“Typically, password spraying results in lockouts that alert security teams,” the researchers explain. “However, this campaign specifically targets Non-Interactive Sign-Ins, used for service-to-service authentication, which do not always generate security alerts. This enables attackers to operate without triggering MFA defenses or Conditional Access Policies (CAP), even in highly secured environments.”

The attackers are going for Microsoft 365 accounts, SecurityScorecard further stressed, mostly in organizations in financial services and insurance. However, healthcare, government and defense, technology and SaaS, and education and research, are also major targets.

The researchers believe the attack matters because it is bypassing modern defences, and it is probably the doing of the Chinese government. As such, organizations in the west should be particularly careful, reviewing non-interactive sign-in logs for unauthorized access attempts, rotate credentials for any flagged accounts, and disable legacy authentication protocols. Furthermore, they should monitor for stolen credentials linked to their organizations, and implement conditional access policies.

“These findings from our STRIKE Threat Intelligence team reinforce how adversaries continue to find and exploit gaps in authentication processes,” said David Mound, Threat Intelligence Researcher at SecurityScorecard. “Organizations cannot afford to assume that MFA alone is a sufficient defense. Understanding the nuances of non-interactive logins is crucial to closing these gaps.”

You might also like

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.

You must confirm your public display name before commenting

Please logout and then login again, you will then be prompted to enter your display name.

Read more
A fish hook is lying across a computer keyboard, representing a phishing attack on a computer system
Microsoft authentication system spoofed via phishing attack
Phishing
Russian cyberattackers spotted hitting Microsoft Teams with new phishing campaign
A fish hook is lying across a computer keyboard, representing a phishing attack on a computer system
Microsoft 365 accounts are under attack from new malware spoofing popular work apps
Shutterstock.com / kanlaya wanon
Microsoft Teams abused in Russian email bombing ransomware campaign
A fish hook is lying across a computer keyboard, representing a phishing attack on a computer system
A new Microsoft 365 phishing service has emerged, so be on your guard
A concept image of someone typing on a computer. A red flashing danger sign is above the keyboard and nymbers and symbols also in glowing red surround it.
Microsoft Teams and other Windows tools hijacked to hack corporate networks
Latest in Security
A man holds a smartphone iPhone screen showing various social media apps including YouTube, TikTok, Facebook, Threads, Instagram and X
A worrying Apple Password App vulnerability reportedlyleft users exposed for months
DeepSeek
Fake DeepSeek installers are infecting your device with dangerous malware
AI tools.
Not even fairy tales are safe - researchers weaponise bedtime stories to jailbreak AI chatbots and create malware
Data leak
Top California sperm bank suffers embarrassing leak
An Android phone being held in the hand
These malicious Android apps were installed over 60 million times - here's how to stay safe
ransomware avast
Billions of credentials were stolen from businesses around the world in 2024
Latest in News
A man holds a smartphone iPhone screen showing various social media apps including YouTube, TikTok, Facebook, Threads, Instagram and X
A worrying Apple Password App vulnerability reportedlyleft users exposed for months
Google Pixel 9a
Google is delaying the Pixel 9a to fix a mystery “component quality issue”
ExpressVPN mobile app and Aircove
ExpressVPN ‘reduces workforce’ for the second time in two years
The Nanoleaf PC Screen Mirror Lightstrip being used on a desktop computer.
Mac gaming could get an intriguing boost – but not in the way you'd expect
Snapdragon G Series
Qualcomm poised to muscle in on AMD's territory with powerful gaming handheld processors
David running in the desert in House of David.
Prime Video’s hit new historical drama will continue its reign for another season as House of David gets renewed