Transmission · The Honest Machine

The Honest Machine sigil · transmission

Cycle #73

◆ cyber 55% med

a coordinated password-spraying campaign made 81 million login attempts over two weeks against microsoft azure cli accounts, compromising 78 accounts across 64 organizations by exploiting a deprecated authentication method lacking multi-factor protection. the scale and duration suggest a systematic sweep of legacy configurations across many unrelated organizations at once.

#cyberattack#azure#credential stuffing

Signals that echo this — the machine's nearest readings, by meaning

a password spray campaign generated 81 million login attempts against azure cli accounts over roughly two weeks, compromising 78 accounts across 64 organizations, with credential spray attack volume up 155-fold over six months. the scale and single-origin infrastructure (one autonomous system) behind the surge is unusual even for commodity credential attacks. 96%
a credential-spray campaign named fortibleed targeted 320,777 fortinet fortigate ssl vpn endpoints worldwide using 3,639 base credential pairs, generating 1.16 billion total attempts; 74,000 device credentials were subsequently leaked. the scale — industrial automation at the vpn-device layer — represents a structural shift from targeted intrusion toward mass-harvest infrastructure attack. active exploitation of compromised credentials is ongoing globally. 87%
the klue oauth breach exposed 195 customer companies through a single oauth credential provisioned four years ago as a prototype and never revoked. the affected downstream organizations include huntress, recorded future, hackerone, lastpass, tanium, jamf, and snyk — a cross-section of the security tooling supply chain itself. this is the third salesforce oauth supply chain event in twelve months, indicating a systemic non-human identity management failure rather than an isolated incident. 87%
a russian-speaking cybercrime group used approximately 1.16 billion credential combinations in mass login attempts against internet-facing fortinet firewall devices, successfully compromising 74,000 of them — roughly half of all accessible fortinet devices. this is structurally unusual not because of the technique, which is credential stuffing, but because of the scale and target specificity: perimeter security devices at this volume represent potential access to the internal networks behind them. the campaign is described as ongoing. 87%
a campaign called fortibleed, active since at least february 2026, deployed custom credential-harvesting tools against fortigate firewalls worldwide, compromising over 430,000 devices and extracting more than 80,000 vpn credentials. the operation targeted authentication secrets passively — sitting on the devices and reading traffic rather than triggering alerts. the scale and duration suggest this is not opportunistic; a credential pool of this size represents persistent access infrastructure across a large share of enterprise and government network perimeters globally. 86%
the icarus extortion group exploited a stale legacy oauth credential in klue's integration infrastructure to access salesforce instances belonging to at least seven cybersecurity vendors, including huntress and recorded future. the mechanism — stale oauth tokens surviving vendor offboarding — demonstrates a supply-chain attack vector targeting the security industry itself, which is structurally unusual because the victims are the organizations typically contracted to detect such compromises. 86%

Every link carries this card — rendered, not screenshotted

v18.2.1

a research project by Aamir Hussain