Azure CLI Password Spray Hits at Least 78 Microsoft Accounts in 81M+ Attempts

A massive, ongoing, automated password spray attack targeted Microsoft's Azure CLI between June 12 and June 26, 2026. The threat actor made over 81 million login attempts and successfully compromised at least 78 Microsoft accounts across 64 organizations. The attack originated from an IPv6 address range (2a0a:d683::/32) controlled by LSHIY LLC (AS32167), with some IPs resolving to the U.S. and a few to China. The campaign leveraged the deprecated OAuth 2.0 Resource Owner Password Credentials (ROPC) flow, which bypasses Conditional Access Policies (CAP) because ROPC does not route through the standard authorization endpoint where CAP policies are enforced. This allowed attackers to bypass MFA in scenarios where: MFA was enforced only for specific apps (not 'All Cloud Apps'), MFA was enforced only for specific user groups (e.g., Admins only), or MFA was enforced only for requests from non-trusted locations. The attack used old, previously breached username/password combinations that had never been rotated. Compromise rates averaged 2-4 accounts per day from June 12-21, with a spike of 12 accounts on June 19, and 30 identities across 23 businesses on June 22. Eight impacted businesses had no MFA policy at all. Huntress observed credential spray attack volume surge by over 155 times across its customer base, with a current mean of ~1,964 failed attacks per month per protected tenant.