FastHTTP Frenzy: 10% Success Rate in Microsoft 365 Brute-Force Attacks Unleashed!
Threat actors are abusing FastHTTP for Microsoft 365 account takeovers, launching high-speed brute-force attacks. The campaign, discovered by SpearTip, has a 10% success rate, with most traffic originating from Brazil. Admins are urged to check audit logs for the FastHTTP user agent and take immediate action if detected.
Hot Take:
FastHTTP: Making Hacking Fast and Furious! Who knew Go could help you go-go-go right into someone else’s Microsoft 365 account? Forget about “going with the flow”; these cybercriminals are flowing with Go, leaving admins to play an endless game of whack-a-mole. Someone call Vin Diesel, because this is a Fast and Furious sequel we didn’t ask for!
Key Points:
- Threat actors leverage FastHTTP Go library for high-speed brute-force attacks on Microsoft 365.
- The campaign, discovered by SpearTip, began on January 6, 2024, targeting Azure Active Directory Graph API.
- 65% of malicious traffic originates from Brazil, with other significant contributors including Turkey and Argentina.
- 10% success rate for account takeovers, making it a notably successful campaign.
- SpearTip offers a PowerShell script and manual methods for detecting malicious activity.
Already a member? Log in here