Microsoft Exchange Autodiscover Credential Harvest for 2026-10-22
Oct 22, 2026
Exploitation
Last Updated: 00:00 UTC
Requests to /Autodiscover/Autodiscover.xml harvest Exchange credentials from Outlook clients that auto-negotiate mail settings. Any host responding to this path can capture NTLM or Basic auth credentials. Also used in ProxyLogon reconnaissance.
CVE References
MITRE ATT&CK
Tactic: Credential Access (TA0006)
Technique: T1114.002 — Remote Email Collection
Observed URIs
Attackers by Country
| France | 1 | 100.0% |
IP Address : ASN : City/Provider
- 77.132.88.57 : AS15557 Societe Francaise Du Radiotelephone - SFR SA : France