AI-generated · no human review · verify critical claims against the linked source.how it works →
ResetSpy
tool
· tool:resetspysingle-source
Public reconnaissance tool (github.com/mlcsec/ResetSpy) automating bulk unauthenticated enumeration of Entra ID account existence, registered MFA methods and likely-admin status via Microsoft's public SSPR portal, with rotating user agents and randomised timing to reduce fingerprinting (LevelBlue SpiderLabs / Matthew Coady, 2026-09-23).
Coverage
1
first 2026-09-24 → last 2026-10-21
Latest activity
2026-09-24
A public tool bulk-enumerates Entra ID accounts and their MFA methods through Microsoft's own password-reset…
Peak priority
notable
1 notable
Targets
public-sector
sectors: public-sector
Sources cited
1
1 hosts
Defender insights
What each entry about ResetSpy tells a defender to do, newest first.
1 technique observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.1 · compare on the matrix · Navigator layer (JSON)
DiscoveryAccount Discovery: Cloud Account
Discovery TA0007
T1087.004Account Discovery: Cloud Account×1
Adversaries may attempt to get a listing of cloud accounts. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application.
Microsoft's Self-Service Password Reset (SSPR) portal, publicly reachable at passwordreset.microsoftonline.com with no prior authentication, discloses more than it is meant to about the accounts behind it (LevelBlue SpiderLabs, 2026-09-23). Submitting an email address triggers an ASP.NET UpdatePanel POST, and the server's reply carries a hidden CurrentViewName field that tells an attacker exactly what happened server-side: ViewMultigateUserControl means the account exists and SSPR advanced to method selection, while a genuine not-found bounces back to ViewUserIdentifierVerification. Every other named view, including the documented error codes SSPR_0011 (no password reset policy defined for the user) and SSPR_0013 (the user is not a member of the group enabled for SSPR), still confirms the account exists, because the server only reaches those policy checks after resolving the username in the directory: "The server only reaches those policy checks after successfully resolving the username in the directory" (LevelBlue SpiderLabs, 2026-09-23). For an account that reaches the method-selection screen, the response HTML lists every registered second factor as visible radio buttons, with unregistered methods present in the DOM but hidden, so an attacker also learns whether a target relies on an authenticator app, SMS, or a more easily phished alternate-email one-time code.
The technique's sharpest edge is administrator identification. Microsoft enforces SSPR for admin accounts regardless of the tenant-wide SSPR policy, so in a tenant that has disabled SSPR for standard users, any account that still reaches method selection is likely a privileged role account, and its registered factors are exposed the same way: "Admin accounts bypass this check entirely and proceed to method enumeration regardless" (LevelBlue SpiderLabs, 2026-09-23). This turns a list of candidate email addresses harvested from a company website, LinkedIn, or a data breach into a confirmed target list, ranked by which accounts have the weakest second factor, before any credential attack begins. Microsoft removed the portal's visual CAPTCHA in August 2026, replacing it with backend throttling and behavioural abuse detection rather than a challenge the user must solve (LevelBlue SpiderLabs, 2026-09-23). The researcher released a public automation tool, ResetSpy, that scripts bulk lookups with rotating user agents and randomised timing to reduce fingerprinting.
Importantly, every non-"ViewUserIdentifierVerification" response (including "SSPR_0011", "SSPR_0013", and the guest/federated not-available response) is confirmation that the account exists. The server only reaches those policy checks after successfully resolving the username in the directory.
Microsoft enforces SSPR for administrator accounts regardless of the tenant-wide SSPR policy. If an organization has disabled SSPR for standard users, standard accounts return "ViewSsprNotEnabledInUserPolicy" (SSPR_0011). Admin accounts bypass this check entirely and proceed to method enumeration regardless.
As of August 2026, Microsoft removed this CAPTCHA entirely and replaced it with backend throttling and behavior-based abuse detection
LevelBlue recommends scoping SSPR to a security group but also finds that "Scoped SSPR, counterintuitively, leaks more information about the accounts that are inside the group than a blanket disabled policy does", because those accounts proceed to method enumeration (LevelBlue SpiderLabs, 2026-09-23). Scoping limits method disclosure for accounts outside the group; every account still has its existence confirmed, and accounts inside the group, including those with no registered method, are exposed in full.
ResetSpy does not report administrator status. For each target it returns whether the account exists, which SSPR verification methods are registered, whether those methods amount to a meaningful second factor or are weak-only, and the SSPR policy state (LevelBlue SpiderLabs, 2026-09-23). Likely administrators are an inference from that policy state: in a tenant that has disabled SSPR for standard users, an account that still reaches method selection "is likely a privileged role account" (LevelBlue SpiderLabs, 2026-09-23).