Two distinct campaigns exploited Microsoft 365 authentication flow misconfigurations to bypass MFA at scale. The Railway campaign leveraged device code phishing via Railway.com PaaS infrastructure (attributed to the EvilTokens PhaaS platform), compromising 344 organizations by harvesting OAuth tokens valid up to 90 days. The LSHIY campaign used the deprecated ROPC OAuth flow to replay credentials against Azure CLI, attempting 81 million logins and compromising 78 accounts—55 of which had MFA policies that failed to cover the attack path due to scoping gaps, report-only enforcement, or mislabeled trusted locations.
ROPC
3 posts
Railway. LSHIY. Different Auth Flows, but the Same Lesson We Keep Skipping The "Success" Illusion: How Cross-Tenant ROPC Can Gaslight Your SOC and Poison Data A nuance in the Entra ID Resource Owner Password Credentials (ROPC) protocol allows attackers with compromised credentials to authenticate against a permissive external tenant, generating a 'Sign-in: Success' log in the victim's home tenant. While this cross-tenant authentication does not grant access to the victim's data, it effectively poisons UEBA models and floods the SOC with false positive alerts, creating significant operational disruption and compromising log integrity.
From Misconfigured Spring Boot Actuator to SharePoint Exfiltration: How Stolen Credentials Bypass MFA Threat actors exploited an exposed Spring Boot Actuator endpoint and plaintext credentials found in a spreadsheet to authenticate via the legacy ROPC flow. This allowed them to bypass MFA, obtain a Microsoft Graph access token, and exfiltrate sensitive data from SharePoint Online without deploying malware.
