Cybersecurity News
Massive Password Spray Campaign Exploits MFA Blind Spot in Azure Environments
Reported: July 1, 2026
Cybersecurity firm Huntress has documented a large-scale password spray campaign targeting Microsoft 365 environments through the Azure command-line interface, SecurityWeek reported. Between June 12 and 21, Huntress observed over 81 million login attempts against its customers.
By the end of the campaign window, 78 user accounts across 64 organizations had been compromised, with attackers breaching two to four accounts per day before a spike on June 22 that hit 23 businesses in a single day.
How the Attack Bypassed MFA
The campaign relied on the OAuth Resource Owner Password Credentials (ROPC) authentication flow, a method that has been deprecated in OAuth 2.1 for exactly the reasons this attack illustrates. When valid credentials are submitted through the ROPC flow, a new user-delegated token is minted without triggering an interactive MFA prompt.
Organizations that had MFA enabled were still compromised because their policies had not been extended to cover this specific authentication path.
Huntress found several common configuration weaknesses among affected organizations: MFA was not enforced for all cloud applications, was applied only to certain user groups, or was configured but never actually enforced. Eight of the compromised businesses had no MFA policy at all.
The attackers appear to have worked entirely from compromised credential lists and show no signs of sophisticated targeting.
The Broader Pattern
The Azure campaign is part of a larger trend. According to Huntress, credential spray attacks across its customer base have increased by more than 155 times over the past six months. The login attempts in this campaign originated from AS32167, an autonomous system operated by LSHIY LLC, an internet infrastructure provider with registrations in Hong Kong, Wuhan, and New York.
Huntress reported the activity to LSHIY through its abuse mechanism and received no response.
For cybersecurity teams, the practical takeaway is that MFA coverage must extend to every authentication flow in use. That includes legacy and non-interactive flows like ROPC. Reviewing conditional access policies for completeness is a reasonable first step.
Attackers Are Registering the Fake Domains That AI Tools Invent
Reported: July 1, 2026
Cybersecurity researchers at Palo Alto Networks’ Unit 42 have identified a new attack technique that they call “phantom squatting.” In this type of attack, actors register web domains that AI tools have invented and handed to users as if they were real, The Hacker News reported.
The tactic has already been observed in active campaigns. Researchers describe the underlying behavior as a structural problem with large language models that have no straightforward fix.
How Phantom Squatting Works
To measure the scope of the problem, Unit 42 asked two AI models 685,339 questions about 913 well-known brands across technology, finance, healthcare, government, and other sectors. The models produced 2.1 million links.
Threat intelligence flagged 13,229 of those links as outright malicious. That meant AI was actively directing users toward addresses known to be harmful. Roughly 250,000 of the invented domains had no owner yet.
The attack works because a freshly registered domain has no reputation history, so blocklists and threat feeds have nothing to flag until the site has already been used to harm people. Unit 42 researchers also found that different AI models often invent the same fake domain in response to the same question, which makes it easy for attackers to predict their next targets.
Turning up a model’s creativity setting only produced more hallucinated addresses.
Two Observed Cases
In one documented case, Unit 42’s system predicted that AI models would generate a domain resembling a national postal service’s online marketplace. Both models produced it consistently.
Twenty-three days later, an attacker registered that exact domain and stood up a phishing kit named Montana Empire that copied the real storefront in real time, stealing card numbers, bank-transfer details, and national ID data.
In a second case, Unit 42 flagged a hallucinated domain 51 days before an attacker registered it. The attacker built a pixel-perfect brand clone, added a fake 4.8-star rating and a claim of over two million users, and used it to push a malicious Android app.
Because AI models hallucinate consistently, Unit 42 says cybersecurity teams can predict which domains a model is likely to produce for a given brand and watch for registrations, often with weeks of warning.
Phishing Campaigns Now Fingerprint Victims’ Devices Before Delivering Payloads
Reported: July 1, 2026
According to a report by Dark Reading, attackers are now routinely fingerprinting victims through user-agent data to deliver OS-specific payloads, a technique that increases compromise rates and makes campaigns harder to detect. Rather than using a single payload that works across all devices, phishing kits inspect each visitor’s browser and operating system before deciding what content to serve.
How the Technique Works
When a visitor loads a phishing page, the site reads the HTTP header that identifies the visitor’s browser, device type, and operating system. If the request looks like it’s coming from a cybersecurity scanner or automated crawler, the site returns a blank page or redirects to the target brand’s legitimate homepage.
If the request comes from a real user on Chrome, Safari, or Edge, the phishing page loads with content tailored to that device.
Operating system targeting adds another layer. A victim on Windows might see a credential-stealing login portal. A victim on Android might receive a malicious app prompt. A victim on a Mac, often assumed to be an analyst’s machine, may see nothing at all.
The practical result is that a security team scanning a suspicious URL from a standard workstation may conclude the link is safe, while victims clicking the same link from their phones encounter a fully operational phishing page.
What Cyberecurity Teams Should Do
Standard URL scanning tools are poorly equipped to catch this technique because they rely on single-agent, single-pass requests. Security teams should scan suspicious links using multiple user-agent profiles and test from both desktop and mobile configurations before clearing a URL as safe.
Organizations should also update incident response procedures to include cloaking checks, so that employee-reported phishing is treated as a credible signal even when automated scans return no findings. Phishing-resistant multi-factor authentication remains the most reliable safeguard if credentials are stolen.
Cybersecurity Tips
Zero Trust Stalls After Year One. Here Is How to Keep It Going.
Reported: June 2026
Source: CIO Magazine and CSO Magazine
Most zero-trust programs look like a success in year one. Pilot projects move fast, multi-factor authentication gets deployed, identity systems connect, and leadership sees tangible progress. But two separate practitioner reports published in recent weeks describe what tends to happen next, and the pattern is consistent enough to treat as a warning.
Why Progress Slows
According to a report in CIO Magazine, the challenge is not getting zero trust but sustaining it as complexity grows. Policies that worked for a small pilot become difficult to maintain across hybrid setups, legacy systems, cloud platforms, third-party tools, and teams with competing priorities.
The first signs of failure are operational exceptions, such as the following:
- An app team needs a workaround for an older system.
- A vendor asks for easier authentication.
- A network team keeps an extra access path open for compatibility.
Each exception seems reasonable in isolation, but together they gradually reintroduce the implicit trust that zero trust is designed to eliminate.
Ownership is also a persistent problem. Cybersecurity teams set the policies, infrastructure teams manage the connections, and application owners focus on features and deadlines. When no one is responsible for keeping the whole system consistent, exceptions multiply.
Organizations that sustain zero trust well, the CIO Magazine report found, treat it as an ongoing way of working rather than a project with a finish line. They also standardize their systems aggressively, cut exceptions wherever possible, and monitor the environment continuously.
Practical Steps for OT Environments
A separate article in CSO Magazine, written by a principal security specialist at a pipeline operator, addresses a specific version of this challenge: applying zero trust in operational technology (OT) environments where equipment must run continuously and cannot be easily taken offline for updates.
The author proposes a 90-day action plan:
- First 30 Days: Focus is on mapping which OT assets would threaten operations, safety, or compliance if compromised, and identifying every user and connection that currently reaches them.
- Days 31 through 60: Shift vendor and third-party remote access, which CISA, TSA security directives, and NERC CIP-013 all flag as a high-risk area. The practical goal is to replace unsecured remote access methods with audited, brokered connections that require multi-factor authentication for every session.
- Final 30 days: Build a maturity scorecard that tracks progress across governance, protection, and detection and response.
The author’s core argument is that a workable, regularly updated 90-day plan produces more durable results than any broad commitment to achieving zero trust in the abstract. For financial services firms managing a mix of IT and OT infrastructure, the same logic applies.
Thanks for Reading
That’s it for this month’s Cybersecurity Briefing. Contact us today to learn more about our services.
