In most cases, the attackers are manually testing credentials for things like Microsoft Office 365 themselves.
— Danny Palmer (@dannyjpalmer) June 8, 2021
"It's a pretty tedious process I'm sure on their end, but they're getting a lot of good information from it" said @CraneHassold https://t.co/9oigpqCzdP via @ZDNet