A brute force method of password-spraying has resulted in a 44% breach success rate by attackers, researchers say.
Bleeping Computer reports:
Massive IMAP-based password-spraying attacks successfully breached Microsoft Office 365 and G Suite accounts protected with multi-factor authentication (MFA) according to an analysis by Proofpoint.
This technique takes advantage of the fact that the legacy authentication IMAP protocol bypasses MFA, allowing malicious actors to perform credential stuffing attacks against assets that would have been otherwise protected.
As noted by Proofpoint's Information Protection Research Team in a recent report, during a "recent six-month study of major cloud service tenants, Proofpoint researchers observed massive attacks leveraging legacy protocols and credential dumps to increase the speed and effectiveness of brute force account compromises at scale."
Their analysis unearthed the fact that around 60% of all Microsoft Office 365 and G Suite tenants have been targeted using IMAP-based password-spraying attacks and, as a direct result, approximately 25% of G Suite and Office 365 tenants that were attacked also experienced a successful breach.