Huntress reports that automated password-spraying attacks have jumped 155-fold over six months,
and details an ongoing campaign that quietly broke into Microsoft 365 accounts even at organisations
that had multi-factor authentication turned on. The attackers replay old, breached passwords against
Microsoft’s Azure command-line login using a legacy sign-in method (OAuth ROPC) that never triggers
an MFA prompt, slipping past Conditional Access policies that were not set up to cover it. One two
week wave alone made over 81 million login attempts and compromised 78 accounts across 64
organisations, and the operators simply hop between hosting providers when one shuts them down.
1. What is happening
Huntress has tracked a 155-fold increase in automated password-spraying against Microsoft 365 over the past six months. In one campaign it followed from 12 to 26 June 2026, attackers made more than 81 million login attempts and compromised 78 accounts across 64 organisations, with a single-day spike of 30 accounts across 23 businesses on 22 June. Many of the victims believed they were protected by multi-factor authentication.
2. How the attackers bypass MFA
The attackers replay old, previously breached username and password pairs against Microsoft’s Azure command-line login. They use the OAuth Resource Owner Password Credentials (ROPC) grant, a legacy sign-in flow that sends the password straight to the token endpoint and mints a session token without ever prompting for MFA. Because ROPC does not pass through the authorisation endpoint where Conditional Access policies are enforced, it slips past MFA that was not configured to cover it.
3. Why Conditional Access did not fire
Of 23 organisations hit in the 22 June spike, 15 had MFA enforced through Conditional Access, yet it did not trigger. The common gaps were MFA scoped to specific apps such as admin portals rather than all cloud apps, so Azure CLI was left uncovered; MFA scoped to specific user groups that did not include the victims; MFA required only from untrusted locations, which the attackers’ mislabelled United States IP addresses evaded; and policies left in report-only mode. Eight victims had no MFA at all.
4. Resilient, shifting infrastructure
The activity ran from an IPv6 range belonging to hosting provider LSHIY (AS32167). After LSHIY suspended the abusive customer, the operators moved to FranTech (AS53667), where 87 per cent of the targets overlapped, then to 3xK Tech (AS200373), reaching about 1.5 million attempts a day and adopting a low-and-slow approach across roughly 12,800 IPv4 addresses. Chasing the hosting providers is a losing game; the durable fix is closing the MFA and ROPC gaps.
- Watch for ROPC token requests: Successful OAuth ROPC sign-ins to the Azure CLI application, token requests at the tenant token endpoint with no interactive MFA, are the core indicator of this attack.
- Prioritise by success, not volume: The most-sprayed tenants are usually the least-compromised, so triage on valid credential sign-ins rather than raw failed-login volume.
- Expect infrastructure to move: The operators hop between bulletproof hosting ASNs (LSHIY, FranTech, 3xK Tech), so blocking a single ASN or IP range is only a temporary measure.
5. Recommendations
- In Conditional Access, require MFA (or block) for All Users, All Cloud Apps, and All Client App types unconditionally; do not scope MFA to specific apps, user groups, or trusted locations, and move any reportonly policies to enforced.
- Enable the Conditional Access setting that enforces strong authentication at the client-authentication level (userStrongAuthClientAuthNRequired), which blocks the ROPC flow outright and makes this attack fail.
- Restrict the Azure CLI application so non-administrator users cannot use it.
- Reset any passwords that appear on breach or combo lists, enforce unique strong passphrases, and prefer phishing-resistant authenticators such as FIDO2 security keys and passkeys.
- Tune detection to prioritise successful ROPC token issuance for the Azure CLI over raw spray volume, and alert on successful sign-ins from bulletproof-hosting ASNs rather than trying to block every address.
6. Sources
- https://www.huntress.com/blog/twist-the-nozzle-on-password-spraying-a-tradecraft-tuesday-recap
- https://www.huntress.com/blog/lshiy-password-spray-attack
- https://www.huntress.com/blog/conditional-access-misconfigurations
Enjoyed reading this Threat Intelligence Advisory? Stay updated with our latest exclusive content by following us on Twitter and LinkedIn
No related posts found.