Midnight Blizzard password spray into Microsoft corporate email
In late November 2023 Midnight Blizzard password-sprayed a legacy, non-production Microsoft test tenant account that had no MFA, then used a legacy test OAuth application with elevated access to the corporate tenant to create malicious apps and grant itself full access to Exchange Online mailboxes. Microsoft detected it on January 12, 2024 and disclosed in an 8-K on January 19. A March 2024 8-K/A said the actor had used secrets found in emails to reach some source code repositories and internal systems.
- Victim
- Microsoft
- Industry
- Technology
- Country
- United States
- Intrusion began
- Nov 2023
- First disclosed
- Jan 19, 2024
- Actor
- Midnight Blizzard (APT29) (Nation-state)
- Initial access
- Password spraying
- Identity control that failed
- Identity lifecycle
- MFA
- Not enforced on the abused account
- Abused identity
- Human account
- Records affected
- Not disclosed
- Disclosed cost
- Not disclosed
The identity lesson
MFA exceptions on forgotten test tenants and OAuth apps holding standing, tenant-wide privileges are both identity debt. Inventorying non-production identities and app permissions would have removed the path.
Regulatory and legal outcome
CISA Emergency Directive 24-02 (April 2024) ordered federal agencies to analyze emails exfiltrated from Microsoft and reset credentials found in them.
Go deeper on SWI
- Teardown: Midnight Blizzard vs Microsoft: a legacy test account and an over-permissioned OAuth app
- Technique: Password spraying
- Technique: Orphaned account abuse
- Technique: OAuth consent phishing
- Product involved: Microsoft Entra ID
Sources
- Microsoft Form 8-K (Item 1.05), US SEC, Jan 19, 2024
- Microsoft Form 8-K/A (update), US SEC, Mar 8, 2024
- Microsoft actions following attack by nation state actor Midnight Blizzard, Microsoft Security Response Center, Jan 19, 2024
- Midnight Blizzard: guidance for responders on nation-state attack, Microsoft Threat Intelligence, Jan 25, 2024
- ED 24-02: Mitigating significant risk from nation-state compromise of Microsoft corporate email system, CISA, Apr 2, 2024
Record verified Oct 31, 2026 against the sources above. Corrections: contact us.
Related incidents
- Password spraying across Chilean Microsoft 365 tenants lands on default-password service accounts 2026 · Password spraying
- Nobelium password spray campaign and Microsoft support agent compromise 2021 · Password spraying
- CrowdSec private repositories copied with a departing engineer's GitHub token 2026 · OAuth token abuse
- Cyberhaven Chrome extension hijacked through OAuth consent phishing 2024 · Consent phishing
Cite this record
SWI Community Team. (2026). Midnight Blizzard password spray into Microsoft corporate email. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/incidents/2024-microsoft-midnight-blizzard-password-spray/
Part of the Identity Breach Database, free to reuse under CC BY 4.0. Analysis across every record: Identity Breach Report 2026.