Another US-based login attempt? It's not your team.

Attackers based in the United States are conducting a sustained, coordinated effort to compromise Microsoft Exchange Online accounts. The campaign operates through legacy SMTP authentication — an older email protocol that many organisations have not yet disabled — making it a consistent and exploitable entry point for malicious sign-in attempts.

The attack method relies on submitting repeated incorrect passwords against targeted accounts, a technique consistent with password spraying or credential stuffing. These approaches are deliberately paced to avoid triggering standard lockout thresholds, allowing attackers to probe accounts over an extended period without immediate detection. The traffic has been traced to infrastructure operated through the internet service provider TMESISTM ESIS.

Legacy authentication protocols such as SMTP do not support modern security controls like multi-factor authentication, which is precisely why attackers favour them. Even when an organisation has enforced multi-factor authentication across its primary sign-in interfaces, legacy protocols can create a blind spot that bypasses those protections entirely — leaving accounts exposed through a channel that appears routine on the surface.

Organisations running Microsoft Exchange Online should treat legacy SMTP authentication as a critical risk surface. Disabling legacy authentication protocols where they are not operationally required, reviewing conditional access policies, and monitoring for unusual SMTP sign-in activity are essential steps in closing the gap this campaign is actively seeking to exploit.