Is Your Front Door Open? The Microsoft 365 Identity Attack Targeting Aussie Businesses

The Australian Cyber Security Centre (ACSC) and even Microsoft Threat Intelligence are currently sounding the alarm on a massive rise in automated attacks targeting Microsoft 365 login portals.

We want to explain exactly what is happening, why it is affecting small-to-medium businesses (SMBs) specifically, and what we can do together to stop it.

When most people imagine a cyber attack, they picture a hooded hacker furiously typing code to break a firewall. The reality facing Australian businesses right now is far less dramatic, but much more persistent.

The specific threat flooding the country right now is known as an Identity Attack.

Those bad guys aren’t trying to “hack” Microsoft’s software. They are simply trying to walk in the front door using the correct keys by targeting your username and password.

There are two main methods the attackers are using to do this, and they are doing it on an industrial scale using automated “bots.”

🔐 Credential Stuffing

This is a domino effect. Years ago, a staff member might have used their work email address to sign up for a service, which may have been a LinkedIn account, a Canva subscription, or even a hotel booking site. If that third-party site suffers a data breach (which happens constantly), those email and password combinations are dumped onto the Dark Web.

Bots then take those millions of stolen credentials and automatically “stuff” them into the Microsoft 365 login page, hoping that the staff member made the serious mistake of reusing the same password for work.

🔑 Password Spraying

If Credential Stuffing is trying a specific key in a lock, Password Spraying is trying a generic key in every lock on the street.

Automated bots will take a list of thousands of Australian email addresses and try a single, common password against all of them at once. They might use something like “Password123” or “Summer2026!”. Because they only try one password per account, they often slip under the radar of security software that looks for repeated failed login attempts.

You might wonder, “So what if they get into my email? I don’t have state secrets.”
At Computer Logic, we remind our clients that your email account is the master key to your business identity. Once an attacker gets past the login screen, they rarely launch a virus immediately. Instead, they lurk. They read your sent items, learn how you speak to your finance team, and look at your invoices.

This leads to Business Email Compromise (BEC).

Once they understand your business rhythms, the attacker will send an email from your actual account to a client or your accounts department. They might say, “Hi, we’ve changed banks, please pay this urgent invoice to the following account…”

Because the email is coming from a legitimate, trusted address, the recipient usually pays it. We have seen Australian Small Businesses lose anywhere from a few thousand dollars to hundreds of thousands in a single morning due to BEC. You may already have seen them try this using unknown email addresses; imagine how easy it would be to fall for it if it’s coming from a legitimate address.

There is a dangerous myth that you have to be a big bank or a government agency to be a target. In reality, the bots running these attacks do not care who you are. They are scanning the internet for any open door.

However, Small-to-Medium Businesses are often the primary victims because they are viewed as “low-hanging fruit.” Attackers know that a small architecture firm or a local retail chain is less likely to have a dedicated security team watching the logs 24/7. They are banking on the fact that you might be too busy running your business to worry about password hygiene.

It is easy to think, “I’m just a small local business; why would international cyber syndicates care about me?” The answer lies in the numbers.

In late 2025, a startling report from security vendor Barracuda revealed that 76% of surveyed Australian organisations had reported an email security breach in the previous 12 months. That is not a typo. Three out of four businesses faced an incident where an unauthorized party accessed their email environment.

The government’s own figures back this up. The ACSC’s Annual Cyber Threat Report for 2024-2025 identified BEC, which is almost always the result of a breached Microsoft 365 account, as the top self-reported cybercrime threat for businesses.

For the average Australian small business, the self-reported cost of these incidents has jumped to over $56,000. These costs don’t just come from stolen money; they come from forensic IT investigations, legal fees, lost productivity, and the hard-to-quantify cost of damaged reputation.

The good news is that because these attacks rely on automation and guessing, they are actually quite easy to stop if you have the right locks in place. At Computer Logic, we recommend a few “must-haves” for every business environment.

🔢 Enable Multi-Factor Authentication (MFA) – Immediately

If you take only one thing away from this article, let it be this. MFA requires a second step to log in, usually a code on your phone or an approval on an app. Even if a bot guesses your password correctly, they cannot get in without your phone. It stops 99.9% of these identity attacks dead in their tracks. We can assist with setting up a business-wide and easy to use MFA solution to protect your data.

🛑 Stop Password Reuse

It is vital to educate your team on why they cannot use the same password for Facebook as they do for Microsoft 365. We recommend using a Password Manager, which generates complex, random passwords for every site. This ensures that a breach at a random website doesn’t compromise your business. At Computer Logic we can assist you with setting up Password Manager software for your team that integrates with your business workflow.

🚫 Disable Legacy Authentication

Older email protocols (like IMAP or POP3) often don’t support MFA. Attackers love these protocols because they can bypass modern security checks. Ensuring your IT setup blocks these “legacy” connection methods closes a major loophole.

🌍 Geographic Blocking

Does your staff need to log in from Russia, North Korea, or Brazil? If you operate solely in Australia, we can set up “Conditional Access” rules that automatically block any login attempt coming from outside the country.

We understand that you are in the business of serving your customers, not fighting off international cyber-botnets. That is where we come in.

At Computer Logic, we view cyber security not so much as a product, but more like a culture. We act as the shield for your business, implementing the technical controls that keep these identity attacks at bay so you can sleep soundly.

We can help by conducting a thorough security audit of your current Microsoft 365 environment. We look for those open doors such as accounts without MFA, users with weak passwords, or legacy protocols that have been left active.

Furthermore, we assist with the human side of security. We can provide security awareness tips to help your staff spot a phishing attempt or a suspicious login prompt. We help you set up strict policies that balance security with ease of use, ensuring your team can work efficiently without leaving the keys in the door.

The threat of automated identity attacks is real, and the volume of these attacks hitting Australia is rising. However, falling victim to them is not inevitable. If you are getting constant MFA prompts that you know are not legitimate, that indicates you need to take action. By moving away from simple passwords and adopting a “security-first” mindset with tools like MFA and Conditional Access, you can make your business inaccessible to these bots.

At Computer Logic, we are ready to help you navigate this. We can lock the doors and secure the windows, so you can focus on what you do best: growing your business. Let’s stay safe out there.