Azure CLI Password Spray Hits at Least 78 Microsoft Accounts in 81M+ Attempts

A significant cybersecurity incident has come to light, involving a massive and automated password spray attack directed at Microsoft's Azure Command-Line Interface (CLI). Cybersecurity researchers from Huntress have been tracking this campaign, which saw threat actors making over 81 million login attempts between June 12 and June 26, 2026. This relentless assault led to the successful compromise of at least 78 Microsoft accounts spanning 64 different organizations. The attackers leveraged a critical vulnerability by exploiting the deprecated OAuth flow known as Resource Owner Password Credentials (ROPC). This legacy authentication method allowed them to bypass Conditional Access Policy (CAP) protections, even in environments where multi-factor authentication (MFA) was ostensibly in place. Microsoft itself advises against using the ROPC flow due to its inherent security risks and incompatibility with modern MFA implementations. The initial phase of the attack, from June 12 to June 21, saw a steady but lower rate of compromise, with an average of two to four accounts breached daily. However, the intensity escalated sharply on June 22, when 30 user accounts across 23 businesses were compromised in a single day. The vast majority of this malicious activity originated from an IPv6 address range controlled by LSHIY LLC, an internet infrastructure provider. Huntress researchers noted that the targeting of these attacks appeared opportunistic, based on the prevalence of passwords found in compromised credential lists rather than specific business types or industries. This underscores the widespread risk posed by weak or reused passwords. To mitigate such threats, organizations are strongly advised to enforce MFA for all users, all cloud applications, and all client application types, ensuring that CAPs are meticulously configured to cover all authentication flows. Restricting Azure CLI access for non-administrative users and prioritizing responses based on credential validity are also crucial steps. This incident serves as a stark reminder that legacy protocols, if not properly managed and secured, can create significant gaps in an organization's security posture, even with advanced protections like Conditional Access policies in place.