The attackers then abused the improperly implemented Conditional Access policies within the Resource Owner Password Credentials (ROPC) OAuth mechanism using Azure command-line interface (CLI), allowing the hackers to bypass authentication altogether when a matching username and password was discovered. Cybersecurity company Huntress observed the attack campaign as it targeted customers and noted that 78 Microsoft accounts across 64 organizations were compromised between June 12 and 26 2026. The success of the attack ultimately came down to how well organizations had implemented Conditional Access policies relating to multi-factor authentication. TechRadar is the main source layer for now, and the rest should be read as a signal that is still widening. In security, the real value is not just the warning itself but the way it changes operational risk, account safety, and the cost of responding later.
What is happening now
The attackers then abused the improperly implemented Conditional Access policies within the Resource Owner Password Credentials (ROPC) OAuth mechanism using Azure command-line interface (CLI), allowing the hackers to bypass authentication altogether when a matching username and password was discovered. TechRadar form the main source layer behind the core facts in this piece.
Where the sources line up
TechRadar is the main source layer for now, and the rest should be read as a signal that is still widening. Cybersecurity company Huntress observed the attack campaign as it targeted customers and noted that 78 Microsoft accounts across 64 organizations were compromised between June 12 and 26 2026. TechRadar form the main source layer behind the core facts in this piece.
The details worth keeping
The success of the attack ultimately came down to how well organizations had implemented Conditional Access policies relating to multi-factor authentication. In security, the real value is not just the warning itself but the way it changes operational risk, account safety, and the cost of responding later. The people who should read carefully are system admins, shop owners, content teams, and anyone holding customer data or operational accounts. The next step is to see whether the current signals harden into a durable change or fade as a short-lived experiment.
Why this matters most
The signal is strong enough to deserve attention, but it still needs to be read as something developing rather than fully settled. With 1 source layers on the table, the part worth reading most closely is where firm facts meet the market's early reaction. “Many of the compromised businesses had implemented multi-factor authentication (MFA) via a Conditional Access Policy (CAP), but the MFA was not configured to cover this specific flow that attackers used,” Huntress explained, referring to the exploitation of ROPC.
What to watch next
The next layer to watch is scope, patch speed, and the operating cost if teams are forced to change process because of this story. Patrick Tech Media will keep checking rollout speed, user reaction, and how TechRadar update the next pieces. From 1 early signals, the piece keeps 1 references that are useful for locking the main details in place. That is why the useful reading move is not to stop at the headline, but to compare the promise, the workflow change, and the likely cost before deciding anything.