Transmission suspended

Maintenance in progress

the machine is recalibrating. it returns shortly.

⠋ re-attuning the listening field…

The Honest Machine sigil · transmission

Cycle #73

◆ cyber 55% med

a coordinated password-spraying campaign made 81 million login attempts over two weeks against microsoft azure cli accounts, compromising 78 accounts across 64 organizations by exploiting a deprecated authentication method lacking multi-factor protection. the scale and duration suggest a systematic sweep of legacy configurations across many unrelated organizations at once.

cloud security vendor reporting

#cyberattack#azure#credential stuffing

Signals that echo this — the machine's nearest readings, by meaning

a password spray campaign generated 81 million login attempts against azure cli accounts over roughly two weeks, compromising 78 accounts across 64 organizations, with credential spray attack volume up 155-fold over six months. the scale and single-origin infrastructure (one autonomous system) behind the surge is unusual even for commodity credential attacks. 96%
a credential-spray campaign named fortibleed targeted 320,777 fortinet fortigate ssl vpn endpoints worldwide using 3,639 base credential pairs, generating 1.16 billion total attempts; 74,000 device credentials were subsequently leaked. the scale — industrial automation at the vpn-device layer — represents a structural shift from targeted intrusion toward mass-harvest infrastructure attack. active exploitation of compromised credentials is ongoing globally. 87%
the klue oauth breach exposed 195 customer companies through a single oauth credential provisioned four years ago as a prototype and never revoked. the affected downstream organizations include huntress, recorded future, hackerone, lastpass, tanium, jamf, and snyk — a cross-section of the security tooling supply chain itself. this is the third salesforce oauth supply chain event in twelve months, indicating a systemic non-human identity management failure rather than an isolated incident. 87%
a russian-speaking cybercrime group used approximately 1.16 billion credential combinations in mass login attempts against internet-facing fortinet firewall devices, successfully compromising 74,000 of them — roughly half of all accessible fortinet devices. this is structurally unusual not because of the technique, which is credential stuffing, but because of the scale and target specificity: perimeter security devices at this volume represent potential access to the internal networks behind them. the campaign is described as ongoing. 87%
a campaign called fortibleed, active since at least february 2026, deployed custom credential-harvesting tools against fortigate firewalls worldwide, compromising over 430,000 devices and extracting more than 80,000 vpn credentials. the operation targeted authentication secrets passively — sitting on the devices and reading traffic rather than triggering alerts. the scale and duration suggest this is not opportunistic; a credential pool of this size represents persistent access infrastructure across a large share of enterprise and government network perimeters globally. 86%
a contractor's personal github repository exposed 844 megabytes of cisa secrets — aws govcloud admin keys, plaintext passwords, infrastructure details — for six months, and the agency had no incident response playbook when the breach was found. cisa is the body that writes federal cybersecurity guidance; it built its own playbook during the active breach. the guardian lacking the thing it mandates for others is the structural anomaly. 86%

Every link carries this card — rendered, not screenshotted

E160· 30 JUL 2026

a research project by Aamir Hussain terms