Cybersecurity researchers have observed a significant surge in password spraying attacks, with a 155-fold increase in the first half of 2026. A notable contributor to this spike was a campaign targeting Microsoft's Azure CLI, a command-line interface used for managing Azure and Entra resources. This campaign, which began months earlier, saw over 81 million login attempts and 78 account compromises within a two-week period in mid-June alone.
The attacks originated from an IPv6 range controlled by LSHIY LLC, an internet hosting provider. The attackers leveraged valid username and password combinations from previous data breaches that had not been reset. A key vulnerability exploited was the Resource Owner Password Credentials (ROPC) OAuth grant, a legacy method deprecated in OAuth 2.1. ROPC does not support modern authentication flows like multi-factor authentication (MFA) or single sign-on (SSO), sending credentials directly to the `/token` endpoint without an interactive MFA prompt.
Many of the compromised organizations had implemented MFA through Conditional Access Policies (CAP), but these policies were not configured to cover the specific ROPC flow used by the attackers. This allowed attackers to bypass MFA protections even when they were technically in place. Researchers noted that while ROPC is an authorization method, it effectively functions as an impersonation method in this context.
Following successful logins, no post-compromise activity was observed, leading to speculation that the attackers might have been validating credentials for resale on dark web markets. LSHIY LLC later terminated the attacks originating from their IP range, confirming that the attacker had utilized their bring-your-own-IP (BYOIP) service.
BYOIP is a legitimate service allowing customers to route traffic through a provider using their own IP ranges. This flexibility enables attackers to switch between IP ranges and providers, complicating blocking and detection efforts. After LSHIY shut down the original activity, the spraying attempts shifted to FranTech-hosted IPv6 ranges, and subsequently appeared from 3xK Tech using IPv4, illustrating the "whack-a-mole" challenge for defenders. The use of IPv6, specifically the range 2a0a:d683::/32 in the LSHIY campaign, provides attackers with a vast pool of addresses, making IP-based blocking less effective.
The LSHIY campaign did not target a specific industry but rather organizations with gaps in their password controls or MFA policies. An analysis of 23 affected businesses revealed that eight had no MFA implemented. For the remaining 15, MFA did not apply to the attacker's sign-in attempts because policies were limited to certain applications or user groups, relied on trusted locations, or were in report-only mode. This highlights the critical need for organizations to thoroughly review the scope and enforcement of their Conditional Access policies.
To mitigate these attacks, organizations are advised to enforce strong password hygiene, consider passwordless authentication options, and disable ROPC or any applications that rely on it. Restricting Azure CLI access to only necessary administrative users is also recommended. Instead of prioritizing response by the volume of spray attempts, organizations should prioritize by credential validity.
Crucially, MFA should be required for all users, all cloud applications, and all client application types, without exclusions. Authentication methods that cannot satisfy an MFA requirement, including the legacy ROPC grant, should be blocked. Implementing a strong Conditional Access setting like `userStrongAuthClientAuthNRequired` can enforce robust authentication at the client level and effectively block ROPC. Properly configured and managed conditional access is considered a powerful defense against such threats.
