I have a question for the hive mind: what is the point of this, exactly?

I mean, I understand the attempt to gain access, and I understand why 2fa codes can be valuable to attempt to phish but that’s like, not the thing here.

They just spam dozens to hundreds of these (I’m showing over 400 in my inbox right now) but like, even if I WANTED to give these codes to the attacker, I have no damn clue who the dude in China that’s doing this is.

I’m confused as to what they hope to gain by trying over and over and over every couple of hours because it feels like there’s no upside to whomever is running this bot, but I probably have missed a memo on some TTP around this, heh.

  • mholivEnglish
    90·
    2 months ago

    For the record you should probably change your password. That way they can’t even try.

    • driving_croonerEnglish
      60·
      2 months ago

      Some Microsoft services don’t ask for your password anymore, they just send you a code to your register email.

      • schizoOPEnglish
        10·
        2 months ago

        Yeah it turns out that’s what nonsense this is.

        Worse, I sure as crap never opted into this, but at least you can turn it off.

        What a stupid decision some product manager made.

        • Saik0English
          80·
          2 months ago

          Not when that password is just an email…

  • slazer2auEnglish
    80·
    2 months ago

    The thing that I have seen is while it looks like they are after MFA codes, those emails are a distraction from the actual account they are trying to take over, so be very careful when deleting the emails, there could be a legit email in there asking you to roll back an account change.

  • driving_croonerEnglish
    10·
    2 months ago

    Dosen’t Microsoft rate limit the attempts? In that case ypu can just select a random number, the trie to brute force it until the code send is the one selected.

    • schizoOPEnglish
      20·
      2 months ago

      It doesn’t seem all that limited; I’ll get 4-5 in a burst, then nothing for a couple of hours or a day or so, then 4-5 more, and so on.

      Been ongoing for a couple of months now, and given it’s a random 6 digit number, I don’t think they’re even remotely doing enough attempts to try to brute force it.

      • driving_croonerEnglish
        30·
        2 months ago

        If Microsoft accepts, let’s say, 3 attempts per code send, they already tried 1200 numbers (per your 400 emails), it’s still short to the 10**6 random attempts on average (supposing that the codes are entirely random). If you email is part of a list of a thousand, they already had tried more that a million and got access to some of them.

  • Anarki_English
    10·
    2 months ago

    I’ve been getting these for an account even I can’t get back into.

    Gonna have to get real granular with my inbox filters to send them into the void…