"Send me a quick text"

In this episode of the CyberBrief Project, we break down Sneaky Strike — a large-scale campaign that turns a legitimate security tool into a weapon for mass account takeover.

Using TeamFiltration, an open-source framework originally built for penetration testing, attackers have targeted more than eighty thousand Microsoft Entra ID accounts across hundreds of organizations.

We walk through how they enumerate accounts, launch stealthy password spraying attacks from rotating cloud servers, and establish persistence inside compromised accounts. More importantly, we unpack why this technique is so effective, and what it teaches us about defending against the creative misuse of legitimate tools.

Support the show

Thanks for spending a few minutes on the CyberBrief Project.

If you want to dive deeper or catch up on past episodes, head over to cyberbriefproject.buzzsprout.com.

You can also find the podcast on YouTube at youtube.com/@CyberBriefProject — I’d love to see you there.

And if you find these episodes valuable and want to support the project, you can do that here: buzzsprout.com/support

Your support means a lot.

See you in the next one, and thank you for listening.