According to Microsoft’s MSRC blog on 19 January 2024, Midnight Blizzard (also known as Nobelium) used a password spray beginning in late November 2023 to compromise a legacy non-production test tenant account and gain a foothold, then used the account’s permissions to access a very small percentage of Microsoft corporate email accounts, including senior leadership, cybersecurity, legal, and other functions, and exfiltrated some emails and attached documents. Public reporting frames the initial account as lacking MFA. Microsoft detected the intrusion around 12 January 2024, stated the attack was not the result of a vulnerability in Microsoft products or services, and reported no evidence of access to customer environments, production systems, source code, or AI systems. OAuth application abuse and mailbox collection came after that password-only sign-in already succeeded.
If you want the prevention angle, read the related article on mfa2point0.com.
FAQ
How did Midnight Blizzard get into Microsoft?
Midnight Blizzard got into Microsoft by password-spraying a legacy non-production test tenant account that lacked MFA, beginning in late November 2023. According to Microsoft’s 19 January 2024 MSRC blog, that spray produced the foothold; the actor then used the account’s permissions against a very small percentage of corporate email accounts and exfiltrated some emails and attachments. Public reporting does not describe phishing kits, AiTM pages, or device-code flows for this initial access.
Was MFA bypassed, or was it simply missing?
MFA was not bypassed on the sprayed Microsoft test tenant account; public detail and intake describe an account that did not have MFA. Password spray only needs a guessed or reused password when the second factor is absent. That is a credential-phase failure at interactive sign-in, not a story about defeating a live OTP or push prompt on that account.
What role did OAuth play after the password spray?
After the password spray foothold on the Microsoft legacy test tenant account, Midnight Blizzard used residual permissions, including OAuth application abuse, to extend access and reach limited corporate mail. That step is authorization abuse after authentication already succeeded. No login MFA undoes app grants or mailbox rights an attacker already holds from a compromised account.
Did the actors reach customer tenants, production, or source code?
Microsoft stated there is no evidence Midnight Blizzard accessed customer environments, production systems, source code, or AI systems in this intrusion. Impact described in the 19 January 2024 MSRC post is limited Microsoft corporate email: a very small percentage of accounts, with some emails and attachments taken. Public reporting does not establish an exact mailbox count.
Would fixing the login have stopped the whole incident?
Closing the password-only gate on every workforce and legacy/test tenant account stops the spray path that created this Microsoft foothold. A fix for that class of sign-in exists; the companion prevention post covers it. OAuth consent governance, least privilege, and revoke remain separate controls for residual app and mailbox abuse after a session already exists. Fooling a password-only spray is easy relative to planting malware on an already-logged-in machine.
