Azure CLI Password Spray Hits At Least 78 Microsoft Accounts in 81M+ Attempts
Cybersecurity researchers have warned of a “massive, persistent, automated password spray attack” targeting Microsoft’s Azure command-line interface (CLI), compromising dozens of accounts in the process.
The service, per Huntress, originates from an IPv6 address range (2a0a:d683::/32) managed by Internet infrastructure provider LSHIY LLC (AS32167).
“Between June 12 and June 26, a threat actor made more than 81 million login attempts and compromised at least 78 Microsoft accounts across 64 organizations,” the company said in a statement. “The targeting of these attacks appears to be based entirely on the use of passwords in a pooled list of passwords, and is not specific to the type of business or industry.”
What makes password spraying attacks remarkable is not only the scale, but also the fact that many vulnerable organizations have conditional access policies enabled. Specifically, the campaign was found to be proposing a dropped OAuth flow called Resource Owner Password Credentials (ROPC) to bypass Conditional Access Policy (CAP) protections.
ROPC is a form of legacy OAuth 2.0 where a user directly provides a username and password to a client application, which then sends these credentials to an authorization server to exchange them for an access token. Deprecated in OAuth 2.1.
In its document, Microsoft advises customers against using ROPC, arguing that it is incompatible with multi-factor authentication (MFA).
“In most cases, safer alternatives are available and recommended,” the tech giant said. “This flow requires a very high level of trust in the application, and carries risks that other flows do not. You should only use this flow if a more secure flow does not work.”
The credential and token spray attacks are said to have led to a few successful logins per day between June 12 and 21, 2026, with an estimated two to four accounts being compromised every day, except for June 19, when 12 user accounts (identities) were compromised. A strong cadence changed on June 22, affecting 30 identities across 23 businesses.
In total, 78 user accounts were compromised at 64 organizations as part of the campaign. Most of the password cracking work comes from LSHIY LLC. Some IP addresses decide to go to the US, while a few others decide to go to China.
“This attack is part of a larger wave of spam attacks on several different ASNs,” Huntress said, adding that it has seen a number of spam attacks multiply by more than 155 times for its customers. “Attacks peaked in late May through early June, with a current average of 1,964 failed attacks per month per tenant protected by Huntress.”
The function appears to specifically target username/password combinations that have been previously breached but never rotated. The use of the ROPC vector meant that attackers were able to target entities that used MFA, but it was not enforced or configured to account for Azure CLI ROPC logging.
This includes cases where MFA has not been enabled –
- Enforcing MFA only on specific apps, as opposed to “All Cloud Apps,” thus fails to cover Azure CLI logins used by malicious actors.
- Enforcing MFA only for certain groups of users, such as administrators
- Enforce MFA only if requests are from untrusted sources
“It is important that the eight businesses affected by this campaign did not have an MFA policy at all,” said Huntress. “Although the threat actors in this campaign were able to penetrate despite the establishment of MFA, the takeaway should not be that MFA does not work at all; rather, organizations should ensure that their MFA policies are well structured to deal with the authorization flows used in all of these incidents.”
To counter this type of attack, organizations are advised to require MFA for All Users, All Cloud Applications, and All Client Application Types when enabling CAP, limit the Azure CLI request to non-administrator users, and prioritize the response with authentication authentication.
“This attack exposes cracks in CAPs that have not been properly patched,” Huntress researchers concluded. “There are still strong weaknesses in the way CAPs are implemented that could allow threat actors to get through. One glaring flaw here is that legacy policies like ROPC can’t override some poorly drafted CAPs as they don’t pass the authorization end where the policies are implemented.”
