Loading story…
LevelBlue SpiderLabs reported that Microsoft’s public Self-Service Password Reset (SSPR) portal can be used without authentication to enumerate Entra accounts. Differences in portal responses—including hidden fields and error codes—can reveal whether an account exists even where password reset is blocked by tenant policy.
For eligible accounts, the behavior may also disclose registered password-reset methods and help identify likely privileged users, supplying attackers with reconnaissance for phishing and social-engineering campaigns. Organizations should review SSPR exposure and Entra Audit Logs, remove weaker recovery methods, and require phishing-resistant authentication for privileged accounts; SpiderLabs released the ResetSpy Python tool to automate testing across email-address lists.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Microsoft removed the legacy CAPTCHA from its Self-Service Password Reset flow and replaced it with backend throttling and behavior-based abuse detection.
LevelBlue SpiderLabs reported that unauthenticated users can distinguish valid from invalid accounts through Microsoft SSPR responses and, for eligible accounts, identify registered password-reset methods. The researchers developed the ResetSpy Python tool to automate checks across email-address lists.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
An open-source Python tool, **ResetSpy**, queries Microsoft Entra ID's Self-Service Password Reset (SSPR) portal to identify valid user accounts and infer the password-reset methods registered to them. It emulates browser requests to `passwordreset.microsoftonline.com`, obtains session-bound ASP.NET values, submits target email addresses, and interprets portal responses to classify accounts as MFA-enabled, lacking visible MFA, not found, SSPR-disabled, CAPTCHA-protected, or error states. The exposed SSPR methods can approximate MFA posture where organizations use combined security-information registration, but the results omit FIDO2 keys, certificate-based authentication, guest or federated users, methods excluded by SSPR policy, and tenants with disabled SSPR. Because Entra ID applies stronger SSPR requirements to administrator accounts and may leave SSPR available for administrators when standard users are excluded, method-selection responses could also help identify privileged accounts. Organizations should limit SSPR exposure according to policy, review registration and administrator reset settings, and monitor anomalous SSPR portal enumeration activity.
Sep 21, 2026
Researchers reported that Microsoft Entra ID’s legacy WS-Trust autologon endpoint for Seamless SSO can be abused to conduct password-spraying attacks with reduced defensive visibility. Testing found the `usernamemixed` endpoint remained reachable for older Office 2013-era clients, did not appear to trigger expected Smart Lockout protections, and omitted failed attempts from standard Entra ID sign-in logs. The endpoint also returned distinct `AADSTS` error codes that let attackers distinguish invalid passwords from valid credentials that were later blocked by MFA or Conditional Access, enabling efficient credential validation without full account access. The activity aligns with ATT&CK techniques for **Password Spraying** and abuse of **Valid Accounts**, including default or legacy authentication paths that permit legitimate-looking logons once credentials are known. Defenders were advised to disable the WS-Trust `usernamemixed` endpoint, block legacy authentication through Conditional Access, monitor the Unified Audit Log for autologon requests, and use detections for repeated failed logons from a single IP across multiple users—similar to Okta analytics that flag more than five invalid authentication attempts from one source as suspicious spraying behavior.
Aug 12, 2026
Russian-linked threat actor **UTA0352** targeted NGOs with Microsoft 365 OAuth phishing that impersonated trusted Microsoft first-party applications, including Visual Studio Code and Microsoft Authentication Broker. The operation sought authorization codes that could be exchanged for Microsoft Graph access tokens; one observed path used Authentication Broker and the Device Registration Service to obtain a refresh token, register an attacker-controlled device, and mint a Microsoft Entra ID **Primary Refresh Token (PRT)**. A PRT is a long-lived, device-bound Entra credential used to provide SSO and obtain tokens for multiple cloud applications. If attackers gain code execution or access to an authenticated Azure AD/Entra-joined Windows user context, they may be able to request PRT-derived token material through `BrowserCore.exe` and obtain reusable refresh tokens that can preserve MFA and device-compliance claims. Defenders should correlate Entra sign-in, audit, and Microsoft Graph logs for session IDs reused from different IP addresses, anomalous Authentication Broker-to-Device Registration Service token activity, scripted device registrations, and refresh-token-to-PRT transitions; endpoint telemetry should also flag suspicious `BrowserCore.exe` and Microsoft account token-provider activity.
Aug 26, 2026