GraphNinja

A vulnerability in Microsoft Graph allowed attackers to conduct password-spray attacks without detection.
The issue involved switching the 'common' authentication endpoint with that of an unrelated tenant,
thereby avoiding the appearance of logon attempts in the victim's logs.
This technique could allow attackers to validate user credentials through verbose error messages,
but actual successful logons using these credentials would still be recorded in the victims' logs (regardless of endpoint).

attackers attacks authentication credentials detection endpoint error graph issue logon logs messages microsoft password spray user credentials victim vulnerability