Microsoft 365 Accounts Get Sprayed by Mega-Botnet

Security researchers observed a botnet of more than 130,000 compromised devices conducting large-scale, stealthy password-spray attacks against Microsoft 365 by abusing noninteractive sign-ins, allowing high-volume credential attempts to evade interactive-sign-in monitoring; the activity has been seen across multiple tenants, may enable account takeover and MFA/conditional-access bypass, and is suspected (but not confirmed) to be Chinese-affiliated, with recommendations to rotate service-account credentials, monitor noninteractive authentication, and apply PAM and strong credential hygiene.