81 Million Login Attempts and 78 Accounts Gone

Between 12 and 26 June 2026, attackers launched a massive automated password spray attack against Microsoft's Azure CLI (command-line interface, a tool used by developers and IT teams to manage cloud services), according to Huntress. The result: 78 accounts compromised across 64 organisations, with 30 of those accounts falling in a single day on 22 June.

What makes this unusual is how the attackers got past MFA (multi-factor authentication, the extra verification step beyond your password). They used a deprecated OAuth flow called ROPC (Resource Owner Password Credentials), a legacy login method that sends usernames and passwords directly to Microsoft's servers without triggering the usual MFA checks. Think of it like a side door that was supposed to be locked but still opens if you know the old key.

Many of the targeted organisations had MFA enabled, but their policies had gaps: MFA was only enforced for specific apps, specific user groups, or specific locations, leaving Azure CLI logins uncovered. Eight organisations had no MFA at all.

The attack drew on previously leaked password lists, so accounts that had never had their old passwords rotated were especially exposed.

What you should do: Check that your Microsoft MFA policies cover all cloud apps, not just selected ones. If you manage Azure accounts, disable the ROPC authentication flow entirely. Huntress recommends reviewing your Conditional Access policies for gaps.

Researchers at Palo Alto Networks' Unit 42 have documented a new attack technique called phantom squatting, and it is already happening in the wild. The full research is available here.

Large language models (AI tools that generate text and answer questions) regularly invent domain names that do not exist. Attackers register those invented domains before anyone else does, then set up phishing pages on them. When an AI tool points a user toward a fake domain it fabricated, the user arrives at a site they were told to trust.

Unit 42 tested 685,339 queries across 913 brands. The AI models returned 2.1 million links; over 13,000 were already flagged as malicious, and around 250,000 invented domains had no owner yet, each a waiting target.

A freshly registered phantom domain has no reputation history, so security filters have nothing to flag. In one documented case, an attacker registered a predicted phantom domain 23 days after Unit 42 flagged it and immediately deployed a phishing kit that stole card numbers and national ID data.

What you should do: Do not copy-paste web addresses that AI tools hand you without verifying them first. Type the domain directly into your browser or search for the official site independently.

CVE ID not confirmed in source — check the original advisory before acting.

What NetScaler ADC and NetScaler Gateway are: Citrix NetScaler products are network appliances used by organisations to manage, secure, and accelerate traffic flowing into their applications and services.

What it is: An external file path control flaw that allows an unauthenticated attacker to read arbitrary files from the appliance's filesystem. No login is required.

Who's at risk: Any organisation running an unpatched NetScaler appliance with the management interface (NSIP, Cluster Management IP, or SNIP with management access) exposed to untrusted networks.

CVSS: 7.7 (High) — patch this week.

Root cause: The appliance fails to properly validate or restrict user-supplied input that controls which file path is accessed during a request. Because no authentication check gates this operation, the flaw is reachable by anyone who can reach the management interface.

Attack vector: An attacker sends a crafted, unauthenticated HTTP request to the management interface, supplying a manipulated file path. The appliance processes it without validating who made the request or whether the path is permitted, and returns the contents of the targeted file. Configuration files and credentials are realistic targets.

Recommended actions:

1. Upgrade to NetScaler ADC and Gateway 14.1-72.61 or 13.1-63.18 or later immediately.
2. Restrict management interface access (NSIP/SNIP) to trusted internal networks only — never expose it to the public internet.
3. Review access logs on the management interface for unexpected file-read requests from unfamiliar sources.

Microsoft has rolled out a new admin policy for Microsoft Teams (the video conferencing and collaboration platform) that detects external bots before they join your meetings and holds them in a lobby for organiser approval, according to Help Net Security.

Previously, bots could join meetings with the same one-click admit as any other participant. Under the new policy, Teams uses behavioural and infrastructure signals to identify bots, groups them separately in the lobby, and removes the one-click admit option for them. The organiser sees a clear visual indicator and must explicitly approve entry.

What to do: If your organisation uses Teams, ask your IT admin to enable the Manage external bots and their access to meetings policy in the Teams Admin Center. Also set Who can admit from the lobby to organizers and co-organizers only. If you run meetings yourself and have admin access, this takes about two minutes to configure.

The US Federal Trade Commission has fined Amazon $2.25 million for violating the Fair Credit Reporting Act by withholding transaction records from identity theft victims, according to Bleeping Computer. The law requires companies to hand over fraud records within 30 days of a request. Amazon repeatedly refused, cited "privacy" as justification, and in some cases blocked law enforcement requests made on victims' behalf. Under the settlement, Amazon must now comply with requests within 30 days and notify affected consumers who were denied records since April 2024.

If you have ever been a victim of fraud involving an Amazon account, you are now entitled to request those records.