Digital Warfare Podcast Daily Brief #123 July 01, 2026

The Digital Warfare Podcast · Jul 1, 2026 · 4m · transcript

Summary

Huntress researchers uncovered a large-scale password spray campaign targeting Microsoft Entra ID through Azure CLI authentication and the OAuth Resource Owner Password Credentials (ROPC) flow. By replaying previously stolen credentials, attackers generated more than 81 million login attempts over two weeks, compromising at least 78 accounts across 64 organizations. The campaign demonstrates that incomplete Conditional Access policies and legacy authentication flows can allow attackers to obtain valid cloud access tokens without triggering the MFA protections organizations believe are…