# An AI Bot Is Attacking Your Login

> 8,000 password attempts a minute, while nobody's watching.

- **Format:** short video, 8 steps, ~25 seconds
- **Topic:** An automated attacker against a mobile backend — it scans the app package in seconds and runs thousands of login attempts a minute while nobody is awake — and why the answer is rate limiting, smart lockout and Defender for Cloud rather than watching logs.
- **Author:** Suthahar Jegatheesan (MSDEVBUILD)
- **Category:** Azure · Azure Security
- **Published:** 2026-08-14
- **Tags:** azure, security, cybersecurity, apisecurity, ratelimiting, microsoftentraid, defenderforcloud, dotnet, devsecops, cloudsecurity, mobilesecurity, backenddeveloper, microsoftazure, msdevbuild
- **Canonical URL:** https://blog.msdevbuild.com/shorts/ai-bot-attacks-mobile-app/

---
## What you'll learn

- Why an automated attacker changes the maths, not just the volume
- Why watching your logs is not a defence against something that never sleeps
- The three Azure controls that make speed useless: rate limits, lockout, alerts

## Understand it one step at a time

### 1. Nobody is typing

It’s three in the morning and nobody is at a keyboard — a script is running this because that’s exactly when nobody’s watching.

### 2. It read your app in 4 seconds

It downloaded your app package and unpacked it in four seconds, listing every endpoint your API exposes without asking anyone.

### 3. 8,000 tries a minute

Credential stuffing: passwords leaked from other companies’ breaches, tried against your users at 8,000 attempts a minute.

### 4. You cannot out-watch it

It never gets tired, never gets bored, and costs the attacker almost nothing to keep running — you cannot out-wait it.

### 5. So make the door slow

Rate limit at API Management: ten calls a minute per caller. At that speed the same attack takes years, not a night.

### 6. And make guessing pointless

Entra ID smart lockout plus MFA — a correctly guessed password stops being enough on its own to get in.

### 7. And let Azure do the watching

Defender for Cloud is awake at 3am so you don’t have to be — it flags the pattern before it becomes a breach.

### 8. Speed was the weapon

A CAPTCHA doesn’t help here — the bot calls your API directly from a server, not your form. Take the speed away and it stops being worth running.

---

## The takeaway

**You cannot out-watch a bot.**

Make the door slow, make guessing pointless, and let Azure do the watching.