Botnet targets Basic Auth in Microsoft 365 password spray attacks

A massive botnet of over 130,000 compromised devices is conducting password-spray attacks against Microsoft 365 (M365) accounts worldwide, targeting basic authentication to evade multi-factor authentication. According to a report by SecurityScorecard, the attackers are leveraging credentials stolen by infostealer malware to target the accounts at a large scale. The attacks rely on non-interactive sign-ins using Basic Authentication (Basic Auth) to bypass Multi-Factor Authentication (MFA) protections and gain unauthorized access without triggering security alerts. "Organizations relying solely on interactive sign-in monitoring are blind to these attacks. Non-interactive sign-ins, commonly used for service-to-service authentication, legacy protocols (e.g., POP, IMAP, SMTP), and automated processes, do not trigger MFA in many configurations," warns SecurityScorecard. "Basic Authentication, still enabled in some environments, allows credentials to be transmitted in plain form, making it a prime target for attackers." Basic Auth is an outdated authentication method where a user's credentials are sent in plaintext or base64 encoded form with every request to a server. It lacks modern security features like MFA and token-based authentication, and Microsoft plans to deprecate it in favor of OAuth 2.0 in September 2025, already having disabled it for most Microsoft 365 services. The newly discovered botnet uses Basic Auth attempts targeting a large number of accounts with common/leak...