Massive Password Spray Campaign Targeting Azure CLI

A significant cybersecurity threat has emerged with the discovery of a massive and automated password spraying campaign specifically targeting Microsoft's Azure command-line interface (CLI). Cybersecurity firm Huntress reported that threat actors initiated over 81 million login attempts between June 12 and June 26, 2026, successfully compromising at least 78 Microsoft accounts across 64 distinct organizations. The attack's primary origin was identified as an IPv6 address range (2a0a:d683::/32) associated with LSHIY LLC, an internet infrastructure provider. What makes this campaign particularly concerning is its ability to bypass Conditional Access Policy (CAP) protections in many compromised organizations. Attackers achieved this by exploiting a deprecated OAuth flow known as Resource Owner Password Credentials (ROPC). ROPC is a legacy OAuth 2.0 grant type where a user directly provides their username and password to a client application, which then transmits these credentials to the identity provider. This method allowed the attackers to circumvent modern security controls that would typically block such brute-force attempts. Huntress researchers emphasized that this attack reveals "cracks in CAPs that haven't been appropriately configured," indicating that even with advanced security policies in place, misconfigurations can leave significant vulnerabilities. The targeting of these attacks appears to be based on password prevalence found in compromised password combo lists, rather than specific business types or industries. The compromised accounts saw a steady trickle of successful logins, averaging two to four accounts daily between June 12 and 21, with a notable spike on June 22 where 30 identities across 23 businesses were impacted. To mitigate such threats, organizations are strongly advised to enforce multi-factor authentication (MFA) for all users, all cloud applications, and all client application types when enabling CAP. Additionally, restricting Azure CLI application access for non-administrative users and prioritizing responses based on credential validity are crucial steps. This incident serves as a stark reminder of the persistent need for vigilant identity and access management practices and the careful implementation of security policies in cloud environments.