Brace yourselves, Windows enthusiasts—hackers are at it again! This time, the culprit is a high-performance Go library called FastHTTP, which is being used by threat actors to launch high-speed brute-force password attacks on Microsoft 365 accounts. This troubling development exposes how evolving technology can be weaponized for malicious purposes, and unfortunately, the success rate of these attacks is alarmingly high. Let’s dive into the details and arm ourselves with knowledge to combat this latest cybersecurity threat.
The FastHTTP library, designed for high-throughput and low-latency HTTP requests, has caught the attention of hackers—not for its legitimate benefits, but as a tool to fuel a series of coordinated brute-force attacks globally. The campaign was uncovered by cybersecurity incident response experts at SpearTip, who detected these activities aimed at Microsoft’s Azure Active Directory Graph API.
These attacks are not a scattershot effort. Beginning January 6, 2024, threat actors have been launching sophisticated credential-stuffing campaigns by directing a torrent of HTTP requests to Microsoft 365 endpoints. Disturbingly, 10% of these attacks result in successful account compromise—an eyebrow-raising figure, considering the usually low success rates of brute-forcing efforts. The implications of these breaches extend far beyond individual accounts, putting organizational networks, intellectual property, and sensitive data at serious risk.
In some cases, hackers don’t stop at brute-forcing but also attempt MFA fatigue attacks—repeatedly sending multi-factor authentication challenges to overwhelm and frustrate users into granting unauthorized access. The success of these tactics seems shockingly effective for such low-effort schemes.
While Microsoft and security firms like SpearTip work tirelessly to identify and mitigate vulnerabilities, remember that users are the first line of defense. By reinforcing account policies, monitoring logs, and staying informed, you can push back against even the most sophisticated malware tactics.
Hackers may have speed on their side, but knowledge is one edge they can't brute-force their way past. Stay secure, WindowsForum community!
Source: BleepingComputer Hackers use FastHTTP in new high-speed Microsoft 365 password attacks
What’s Happening?
The FastHTTP library, designed for high-throughput and low-latency HTTP requests, has caught the attention of hackers—not for its legitimate benefits, but as a tool to fuel a series of coordinated brute-force attacks globally. The campaign was uncovered by cybersecurity incident response experts at SpearTip, who detected these activities aimed at Microsoft’s Azure Active Directory Graph API.These attacks are not a scattershot effort. Beginning January 6, 2024, threat actors have been launching sophisticated credential-stuffing campaigns by directing a torrent of HTTP requests to Microsoft 365 endpoints. Disturbingly, 10% of these attacks result in successful account compromise—an eyebrow-raising figure, considering the usually low success rates of brute-forcing efforts. The implications of these breaches extend far beyond individual accounts, putting organizational networks, intellectual property, and sensitive data at serious risk.
In some cases, hackers don’t stop at brute-forcing but also attempt MFA fatigue attacks—repeatedly sending multi-factor authentication challenges to overwhelm and frustrate users into granting unauthorized access. The success of these tactics seems shockingly effective for such low-effort schemes.
FastHTTP: A Double-Edged Sword
At the heart of these attacks is FastHTTP, an incredibly efficient library for HTTP communications, crafted in the Go programming language. Let's understand why this seemingly benign library is so attractive to hackers:Why FastHTTP?
- Speed and Efficiency: FastHTTP is engineered to handle a high volume of parallel connections with low latency, making it an ideal choice for launching thousands of simultaneous login attempts without bogging down performance.
- Minimal Resource Usage: Unlike traditional HTTP libraries, FastHTTP minimizes memory consumption and overhead, ensuring relentless attack persistence without exhausting the attacker’s infrastructure.
- Customizable: The Go language it runs on allows attackers to script highly specific and repeatable HTTP requests—perfect for credential-stuffing attacks and other brute-force methodologies.
Anatomy of the Attack
The targets are Microsoft 365 accounts, particularly those configured with Azure Active Directory (AAD). Here’s a step-by-step breakdown of how the campaign operates:- Credential Targeting: Threat actors use breached password lists (from prior data leaks) to launch dictionary attacks. These lists are fed into the FastHTTP library, which systematically blasts Azure AD endpoints with login attempts.
- Endpoint Exploitation: Hackers target Azure Active Directory Graph API. Why? Because it's the backbone for integrating apps and services into Microsoft’s identity and access management framework—a prime vulnerability entry point when mishandled.
- Tactical Diversification: The attack isn’t geographically isolated. SpearTip’s telemetry shows the bulk of originating traffic stems from Brazil (65%), followed by Turkey, Argentina, Uzbekistan, Pakistan, and Iraq.
- MFA Fatigue: Another layer involves inundating users with continuous MFA prompts. If even one user gives in to this annoyance or misclicks, the attacker gains full account access.
- Success Metrics:
- 41.5%: Failed
- 21%: Caused account lockouts
- 17.7%: Rejected due to access policy violations (e.g., geo-fencing, device limitations)
- 10%: Deflected by MFA
- 9.7%: Successful access!
Ripple Effects of Account Takeovers
What can bad actors do with control over a Microsoft 365 account? Spoiler alert: it's not just about sending funny emails to your boss. Here's a non-funny look:- Corporate Espionage: Stolen trade secrets or intellectual property can wreck companies.
- Data Breaches: Microsoft 365 accounts typically store sensitive emails, documents, and confidential client data.
- Infrastructure Sabotage: Once inside, an attacker can potentially hop through the environment using lateral movement tactics, attacking other internal systems.
- Service Downtime: Admin accounts can be hijacked to deactivate systems or lock out legitimate users.
Defense Tactics: How to Stay Ahead of Attackers
If you're sweating at this point, don’t worry—Microsoft 365 admins and users have impactful tools and strategies at their disposal to mitigate these threats. SpearTip has provided guidance and even practical scripts to detect and respond.Detection:
To check if you're a target, investigate your audit logs for the FastHTTP user agent. Here’s how:- Navigate to Azure Portal.
- Go to Microsoft Entra ID → Users → Sign-in Logs.
- Use filters to isolate “Client app: Other Clients.” Watch for suspicious surges of activity.
Mitigation:
If malicious activity is detected, respond immediately:- Expire all user sessions: Force a global sign-out for affected accounts.
- Reset credentials: Issue new, strong passwords.
- Inspect MFA devices: Remove unrecognized or suspicious devices.
- Review authentication policies: Tighten geographic, device, and compliance controls.
Proactive Measures:
- Educate Users:
- Train employees to spot MFA fatigue attacks and phishing scams.
- Emphasize the importance of not recycling old passwords.
- Enable Conditional Access Policies:
- Restrict risky locations or unknown devices to bolster geo-fencing efficiency.
- Use PowerShell Audits:
- SpearTip has provided PowerShell scripts to scan for the FastHTTP user agent efficiently. Run these regularly to detect signs of targeting.
- Adopt Advanced Authentication:
- Upgrade to hardware-backed MFA like FIDO2 keys or Windows Hello for stricter account security.
A Battle Worth Fighting
If there’s one lesson from this, it’s that security vigilance is non-negotiable. Hackers aren’t just glued to Hollywood-style hacking tools; they’re ingeniously repurposing legitimate software like FastHTTP to wreak havoc. The campaign against Microsoft 365 accounts is a wake-up call for small businesses, enterprises, and even personal users to take cybersecurity seriously.While Microsoft and security firms like SpearTip work tirelessly to identify and mitigate vulnerabilities, remember that users are the first line of defense. By reinforcing account policies, monitoring logs, and staying informed, you can push back against even the most sophisticated malware tactics.
Hackers may have speed on their side, but knowledge is one edge they can't brute-force their way past. Stay secure, WindowsForum community!
Source: BleepingComputer Hackers use FastHTTP in new high-speed Microsoft 365 password attacks
Last edited:
