- Published on
Azure CLI Password Spray Hits at Least 78 Microsoft Accounts in 81M+ Attempts
- Authors
- Name
- DeepHorus
Cybersecurity researchers have uncovered a massive password spray attack targeting Microsoft's Azure command-line interface, compromising dozens of accounts across multiple organizations. The campaign, detected by Huntress, involved over 81 million login attempts between June 12 and June 26, successfully breaching at least 78 Microsoft accounts across 64 organizations. The attack originates from an IPv6 address range controlled by internet infrastructure provider LSHIY LLC.
Password spray attacks involve trying commonly used passwords against many accounts to avoid detection and lockouts. What makes this campaign particularly alarming is its exploitation of a deprecated OAuth flow called Resource Owner Password Credentials (ROPC). Microsoft has long advised against using ROPC because it bypasses multi-factor authentication and is incompatible with modern security standards. The targeting appears to be based entirely on password prevalence from breached password lists, not on any specific industry or business type.
The attackers averaged two to four successful logins per day, with a notable spike on June 22 when 30 identities across 23 businesses were compromised. In total, 78 user accounts across 64 organizations were breached over the two-week period. The vast majority of password spraying activity originated from LSHIY LLC, with some IP addresses resolving to the United States and China. This steady cadence indicates a systematic and automated operation rather than opportunistic hacking.
The attack underscores critical gaps in Conditional Access policies, as the ROPC flow allowed adversaries to bypass MFA protections. In many affected organizations, MFA was enforced only for specific apps or user groups, not for all cloud apps, leaving Azure CLI logins unprotected. Some organizations enforced MFA only for non-trusted locations, but the ROPC flow bypassed this requirement. Eight of the compromised businesses had no MFA policy at all, making them easy targets. The use of previously breached but unrotated credentials further widened the attack surface.
Huntress noted that the volume of credential spray attacks has surged by 155 times across its customer base, with a peak in late May and early June. The researchers emphasized that MFA remains effective when properly configured, but organizations must ensure policies cover all authentication flows, especially legacy protocols like ROPC. "The takeaway should not be that MFA doesn't work at all," Huntress stated, "instead, organizations should ensure their MFA policies are properly configured to address the authorization flow used across these incidents." This campaign highlights the need for continuous security posture assessment.
To mitigate such attacks, Microsoft recommends requiring MFA for all users, all cloud apps, and all client app types when enabling Conditional Access. Additionally, organizations should disable the ROPC flow entirely and monitor for anomalous login attempts. The campaign serves as a stark reminder that outdated authentication methods and misconfigured security policies can leave enterprises vulnerable to large-scale credential attacks.
