Cloud hacks bypass MFA via token hijacking and password‑spray

Security researchers have documented two separate campaigns that circumvent multi‑factor authentication on major cloud services. An APT group dubbed Umbrij uses a toolkit called ShadowToken via Remote Debug (STRD) to extract OAuth tokens from active Chrome or Edge sessions, allowing it to take over corporate Gmail accounts without stealing passwords or triggering 2FA. The method hijacks browser‑based tokens and injects malicious code through DLL side‑loading, effectively turning an existing authenticated session into a persistent breach.

Separately, Huntress reported a massive password‑spray attack against Microsoft’s Azure CLI that made more than 81 million login attempts between 12 June and 26 June, compromising at least 78 Microsoft accounts across 64 organizations. The attackers leveraged the deprecated Resource Owner Password Credentials (ROPC) flow to bypass conditional‑access policies and MFA, exploiting mis‑configured MFA settings that left many accounts unprotected. The campaign originated from IP ranges tied to a U.S. and Chinese infrastructure provider.

Both incidents highlight weaknesses in token management and MFA configuration, urging enterprises to tighten session security, deprecate outdated authentication flows, and ensure comprehensive MFA coverage across all cloud applications.