#passwordspray — Public Fediverse posts

Microsoft 365 users and admins, beware! There's a specific IPv6 range (2a0a:d683::/32) operated by a provider called LSHIY that is engaging in password spraying / brute force login attempts against Microsoft accounts with old, previously leaked credentials that were disclosed as part of prior breaches.

The attack bypasses MFA and SSO because it uses the deprecated (but still functional) OAuth Resource Owner Password Credentials 2.0 flow. But it works because some people still use creds that were stolen years ago and were never changed. So change your passwords, people!

https://www.huntress.com/blog/lshiy-password-spray-attack

#M365 #bruteforce #passwordspray #compromise #weakpasswords

📰 Iranian Hackers Launch Coordinated Password Spray Attacks on Middle East

🇮🇷 Iranian APT Gray Sandstorm linked to password spray attacks against Israel & UAE. The campaign, targeting M365 accounts, appears coordinated with kinetic military strikes to aid in damage assessment. #APT #Iran #CyberWarfare #PasswordSpray

🔗 https://cyber.netsecops.io/articles/iranian-hackers-launch-coordinated-password-spray-attacks-on-middle-east/?utm_source=mastodon&utm_medium=social&utm_campaign=twitter_auto

Microsoft 365: Hackers Abuse Pentesting Tool for Widespread Attack on 80,000 User Accounts

#CyberSecurity #Microsoft #Hacking #EntraID #Proofpoint #InfoSec #PasswordSpray #ThreatIntel #CloudSecurity #CyberAttack #DataBreach #Microsoft365

https://winbuzzer.com/2025/06/12/microsoft-365-hackers-abuse-pentesting-tool-for-widespread-attack-on-80000-user-accounts-xcxwbn/

Oh look, another thrilling tale of how #Microsoft bravely "uncovered" a password spray #attack with all the subtlety of a slow-motion car crash. 🚗💥 Apparently, logging in successfully is now a criminal offense—let's all panic! 😱🔍
https://petrasecurity.substack.com/p/unmasking-a-slow-and-steady-password #Security #PasswordSpray #CyberThreats #TechNews #PanicAlert #HackerNews #ngated

Chinese Botnet Powered by 130,000 Devices Targets Microsoft 365 Accounts – Source: www.securityweek.com https://ciso2ciso.com/chinese-botnet-powered-by-130000-devices-targets-microsoft-365-accounts-source-www-securityweek-com/ #rssfeedpostgeneratorecho #CyberSecurityNews #Malware&Threats #securityweekcom #passwordspray #Microsoft365 #securityweek #botnet #China

Chinese Botnet Powered by 130,000 Devices Targets Microsoft 365 Accounts https://www.securityweek.com/chinese-botnet-powered-by-130000-devices-targets-microsoft-365-accounts/ #Malware&Threats #passwordspray #Microsoft365 #botnet #China

Chinese Botnet Powered by 130,000 Devices Targets Microsoft 365 Accounts https://www.securityweek.com/chinese-botnet-powered-by-130000-devices-targets-microsoft-365-accounts/ #Malware&Threats #passwordspray #Microsoft365 #botnet #China

Citrix Warns of Password Spraying Attacks Targeting NetScaler Appliances https://www.securityweek.com/citrix-warns-of-password-spraying-attacks-targeting-netscaler-appliances/ #NetworkSecurity #Vulnerabilities #passwordspray #NetScaler #Citrix #router #MFA

Citrix Warns of Password Spraying Attacks Targeting NetScaler Appliances https://www.securityweek.com/citrix-warns-of-password-spraying-attacks-targeting-netscaler-appliances/ #NetworkSecurity #Vulnerabilities #passwordspray #NetScaler #Citrix #router #MFA

Should a password spray detection in a SIEM alert you when there are 300+ failed logins against a collection of a dozen and a half accounts in an hour, or ONLY when one of those accounts subsequently logs in _successfully_ ?

Is it only a password spray if it eventually succeeds?

#detectionRules #passwordSpray

‘Unprecedented Scale’ of Credential Stuffing Attacks Observed: Okta https://thecyberexpress.com/credential-stuffing-attacks-surge-okta/ #credentialstuffingattacks #TheCyberExpressNews #credentialstuffing #CybersecurityNews #passwordspraying #CyberEssentials #TheCyberExpress #DataBreachNews #passwordspray #bruteforce #CiscoTalso #dataleaks #Okta

26 March 2024: "Cisco was made aware of multiple reports related to password spraying attacks aimed at RAVPN services. It has been noted by Talos that these attacks are not limited to Cisco products but also third-party VPN concentrators. Depending on your environment, the attacks can cause accounts to be locked, resulting in Denial of Service (DoS)-like conditions. This activity appears to be related to reconnaissance efforts." No CVE ID associated. Indicators of attack are provided. 🔗 https://www.cisco.com/c/en/us/support/docs/security/secure-firewall-threat-defense/221806-password-spray-attacks-impacting-custome.html

See related Bleeping Computer reporting: https://www.bleepingcomputer.com/news/security/cisco-warns-of-password-spraying-attacks-targeting-vpn-services/

#Cisco #passwordspray #VPN #Fortinet #PaloAlto #SonicWall #botnet #Brutus

Mail-Hack mit Folgen: Russische Hacker klauen Quellcode von Microsoft #Hacker #Russland #Mail #Code #Quellcode #PasswordSpray #Nobelium #MidnightBlizzard https://winfuture.de/news,141628.html?utm_source=Mastodon&utm_medium=ManualStatus&utm_campaign=SocialMedia

This Week in Security: NetUSB, HTTP.sys, and 2013’s CVE is Back - Let’s imagine a worst case situation for home routers. It would have to start with... - https://hackaday.com/2022/01/21/this-week-in-security-netusb-http-sys-and-2013s-cve-is-back/ #thisweekinsecurity #hackadaycolumns #securityhacks #passwordspray #http.sys #news