🤚 The Open-Palm Barrage

Between June 12 and June 26, an unknown threat actor launched 81 million login attempts against Microsoft 365 environments in what cybersecurity firm Huntress is calling one of the most aggressive password-spraying campaigns ever observed. The result: 78 accounts compromised across 64 organizations.

The method was not sophisticated. It was industrial.

The attacker used Microsoft’s own Azure command-line interface to authenticate with username-and-password combinations that had been exposed in previous data breaches. When a valid pair was found, the attacker authenticated through ROPC (Resource Owner Password Credentials) — an OAuth flow that Microsoft itself provides — which bypassed multi-factor authentication in environments with poorly configured Conditional Access policies.

The attack traffic originated from an IPv6 range belonging to LSHIY LLC, registered under AS32167. Who LSHIY LLC actually is remains unclear, which is exactly the kind of sentence that should keep your security team awake tonight.

👐 The Two-Handed Authentication Bypass

Let us be precise about what happened here, because the details are exquisite.

The attacker didn’t exploit a zero-day. Didn’t deploy custom malware. Didn’t phish a single employee. They used Azure CLI — a tool Microsoft distributes to its own administrators — and fed it stolen passwords from breaches that, in many cases, are years old. The tool obligingly authenticated those credentials against Microsoft’s own identity platform.

The ROPC OAuth flow, which was designed for legacy applications that can’t support interactive login, became the skeleton key. In organizations where Conditional Access policies didn’t explicitly cover all client app types, ROPC requests sailed past MFA requirements like a VIP skipping the velvet rope. The bouncer checked IDs at the front door, but there was a service entrance and it was labeled “Resource Owner Password Credentials.”

According to Huntress, this isn’t an isolated phenomenon. Password-spraying attacks have increased 155-fold, with organizations now averaging 1,964 failed login attempts per tenant per month. The industry’s response to credential stuffing has been to implement MFA. The attackers’ response to MFA has been to find the one Microsoft authentication flow that doesn’t require it.

🌿 The Gentle Awakening

There is a delicious irony in the fact that Microsoft’s own CLI tool was the weapon of choice. Azure CLI is marketed as a productivity tool for administrators — a way to manage cloud resources efficiently from the terminal. It turns out that what is efficient for administrators is also efficient for people who would like to become administrators without being invited.

The 81 million number sounds catastrophic, and it is, but the 78 compromised accounts are where the real damage lives. Each compromised account is a foothold. Each foothold is a potential ransomware deployment, data exfiltration, or lateral movement opportunity. The spray-and-pray approach works precisely because it only needs to succeed 0.0001% of the time to be profitable.

The passwords that opened the door were, in many cases, credentials that users set years ago, that were leaked in breaches they were notified about, and that they never changed. The human element of cybersecurity is not a vulnerability — it is a feature that attackers have learned to depend on.

👑 The Gold-Leaf Reckoning

The lesson here is one the industry keeps teaching and the industry keeps failing to learn: MFA is not a policy. It is a configuration. If your Conditional Access policies don’t cover all client application types — including legacy flows like ROPC — then your MFA deployment has a hole in it the size of an Azure CLI window.

Huntress recommends three immediate actions:

• Ensure MFA covers All Users, All Cloud Apps, and All Client App types
• Restrict Azure CLI access to administrative accounts only
• Respond to credential validity signals, not just spray volume

The 155-fold increase in password-spraying activity means this is not a campaign — it is a climate change. The weather has shifted. Organizations that haven’t updated their Conditional Access policies are not behind the curve. They are standing in an open field during a thunderstorm, holding a metal rod labeled “Legacy Authentication Enabled.”

“The attacker used Microsoft’s own tools, Microsoft’s own OAuth flow, and Microsoft’s own documentation. At that point, it’s not a hack — it’s a guided tour with unauthorized ticketing.” — The Slap of Wisdom Incident Response Sommelier, authenticating via ROPC because the MFA prompt was taking too long