Intercepted is your monthly cybersecurity intelligence drop - built for CISOs, Security Analysts, Threat Researchers and Security Engineers defending complex global environments.

This episode featured Rachel Rabin, a threat researcher on the Cloud Threat Research Team at Proofpoint. Rachel presented on brute force campaigns in cloud environments, focusing on two emerging spoofing techniques: user agent spoofing and client ID spoofing. She explained how attackers are evolving beyond simple IP rotation by generating millions of unique user agents and spoofing client IDs to avoid detection and test credentials without generating successful sign-in events. The discussion included analysis of real campaigns and provided practical recommendations for defense, including implementing multi-factor authentication, conditional access policies, and monitoring error codes in sign-in logs.