Huntress has flagged a massive ongoing password spray attack targeting Microsoft’s Azure CLI. The numbers are hard to ignore: more than 81 million login attempts between June 12 and June 26, and at least 78 Microsoft accounts across 64 organizations got compromised.
The attacks come from an IPv6 range controlled by LSHIY LLC. What makes this one different is the technique. The attackers are using a deprecated OAuth flow called Resource Owner Password Credentials (ROPC) — basically a legacy method where an app asks for your username and password directly and trades them for an access token.
ROPC was deprecated in OAuth 2.1 for good reason. Microsoft recommends against it specifically because it’s incompatible with multi-factor authentication. The problem is, many organizations have Conditional Access Policies that look like they cover everything — but they don’t. If MFA is only enforced for specific apps or specific user groups, Azure CLI logins can slip right through.
Eight of the impacted businesses had no MFA policy at all. For the rest, the attackers got in because the ROPC flow bypasses the authorization endpoint where Conditional Access Policies are enforced.
The targets aren’t picky. Huntress says the campaign goes after passwords that show up on compromised combo lists — it’s spray-and-pray, not industry-specific. The attacks hit hardest on June 22, when 30 identities across 23 businesses were compromised in a single day.
Huntress has seen credential spray attacks surge by over 155 times across its customer base, averaging about 1,964 failed attacks per month per tenant.
The fix is straightforward: require MFA for All Users, All Cloud Apps, and All Client App types. Restrict the Azure CLI application for non-admin users. And treat legacy protocols like ROPC as the gap they are — they can bypass poorly-configured CAPs entirely.
Huntress put it bluntly: “This attack reveals cracks in CAPs that haven’t been appropriately configured.”
