Microsoft blocked billions of brute-force and phishing attacks last year

Office 365 and Azure Active Directory (Azure AD) customers were the targets of billions of phishing emails and brute force attacks successfully blocked last year by Microsoft.

"From January 2021 through December 2021, we've blocked more than 25.6 billion Azure AD brute force authentication attacks and intercepted 35.7 billion phishing emails with Microsoft Defender for Office 365," said Vasu Jakkal, Microsoft's Corporate Vice President for Security, Compliance, and Identity.

Multi-factor authentication (MFA) and passwordless authentication would make it a lot harder for threat actors to brute force their way into their targets' Microsoft accounts, Jakkal added.

However, even though attackers have been steadily increasing their breach attempts throughout the last two years, Microsoft is yet to see the vast majority of its customer base interested in adopting strong identity authentication, including passwordless auth and MFA. 

"For example, our research shows that across industries, only 22 percent of customers using Microsoft Azure Active Directory (Azure AD), Microsoft's Cloud Identity Solution, have implemented strong identity authentication protection as of December 2021," Jakkal said.

"MFA and passwordless solutions can go a long way in preventing a variety of threats and we're committed to educating customers on solutions such as these to better protect themselves."

Just last week, Microsoft warned of an active multi-stage phishing campaign leveraging Azure AD to register rogue devices onto targets' networks to distribute phishing emails. As Redmond explained, the attack was blocked on networks where an MFA policy was enabled in Azure AD.

Why multi-factor authentication matters

Enabling multi-factor authentication (MFA) whenever possible makes it a lot harder or even impossible for attackers to pull off a successful attack and take control of your accounts.

To put things into perspective, Microsoft Director of Identity Security Alex Weinert said that "your password doesn't matter, but MFA does! Based on our studies, your account is more than 99.9% less likely to be compromised if you use MFA."

A joint study by Google, New York University, and University of California San Diego also discovered that MFA can block up to 100% of automated bots, 99% of bulk phishing attacks, and approximately 66% of targeted attacks.

In August, the US Cybersecurity and Infrastructure Security Agency (CISA) also advised switching to MFA when adding single-factor authentication (SFA) to its list of cybersecurity bad practices.

As CISA explained, threat actors can easily gain access to systems and accounts not protected with MFA since passwords can be easily stolen or guessed using various techniques, including phishing, keylogging, network sniffing, social engineering, malware, brute-force attacks, and credential dumping.

Microsoft and Google provide simple-to-follow guides on how to secure your accounts, with Microsoft offering a support page on the five steps to secure your identity and Google a blog post on the five things to do to stay safe online.

Microsoft blocked billions of brute-force and phishing attacks last year