Microsoft Entra ID Account Takeovers: Lessons from a Major Password-Spraying Campaign
A dangerous campaign targeting Microsoft Entra ID (formerly Azure AD) accounts began spreading rapidly in December 2024. During this time, cybercriminals hijacked over 80,000 accounts across hundreds of organizations. They used an open-source tool called TeamFiltration to carry out their attacks.
Instead of acting randomly, the attackers followed a calculated plan. Known as UNK_SneakyStrike, the group used cloud-based infrastructure and Microsoft Teams APIs. This method allowed them to identify users and conduct widespread password spraying. For example, on January 8 alone, they attempted to access more than 16,000 accounts in just one day.
How TeamFiltration Works
Originally developed for penetration testing, TeamFiltration first appeared in 2022. While its purpose was to help ethical hackers, cybercriminals later abused it for malicious purposes.
Specifically, TeamFiltration automates:
- Identifying Entra ID users
- Launching password-spraying attacks
- Extracting data from OneDrive, Outlook, and Teams
- Gaining persistent access through rogue uploads
Rather than using a single region, attackers rotated their login attempts across different cloud locations. As a result, they were able to avoid detection and mimic normal traffic behavior.
Geographic Trends and Patterns
Understanding the geography and rhythm of these attacks is essential. The campaign peaked between December 2024 and January 2025.
Here are a few notable findings:
- Most login attempts came from the U.S., Ireland, and the UK
- Attackers often launched bursts of activity, targeting all users in smaller companies
- Afterward, they paused for 4–5 days before repeating the process
Therefore, organizations must stay alert during both attack periods and downtime.
How to Defend Your Organization
Fortunately, organizations can take action to reduce the risk. Experts recommend several measures that improve security and prevent unauthorized access.
To begin with, make sure all users have Multi-Factor Authentication (MFA) enabled. This extra layer adds strong protection against unauthorized logins.
In addition:
- Apply conditional access policies for sensitive accounts
- Watch for sudden login spikes or new login locations
- Block suspicious IPs known for automated attacks
- Limit third-party access through OAuth settings
- Set up continuous identity monitoring and alerts
By following these steps, companies can stay a step ahead of cybercriminals.
Why This Campaign Matters
Clearly, this campaign proves that open-source tools—if misused—can cause massive damage. It also reveals how cloud platforms can serve as launchpads for large-scale attacks.
Thus, it is vital to:
- Use strong authentication
- Regularly audit user activity
- Train staff to recognize early signs of suspicious behavior
Additionally, IT teams should focus on behavior-based detection, not just signature-based firewalls. Cybersecurity today requires proactive, not reactive, strategies.
Conclusion
The Microsoft Entra ID password-spraying campaign offers a serious wake-up call. While password spraying may seem simple, it remains one of the most effective techniques used by attackers.
By enabling MFA, enforcing conditional access, and monitoring cloud logins, organizations can protect their users and data. In today’s digital world, cybersecurity isn’t optional—it’s essential.
