CampaignPublished 1 Jul 2026

Massive Password Spray Campaign Targeting Azure CLI

Source SecurityWeek

Description

Hackers were seen making over 81 million login attempts originating from systems associated with hosting provider LSHIY. The post Massive Password Spray Campaign Targeting Azure CLI appeared first on SecurityWeek .

Impact

The campaign led to the compromise of multiple user accounts in Microsoft 365 environments, enabling unauthorized access to cloud resources. The use of the OAuth ROPC flow bypassed MFA protections in many cases, increasing the risk of account takeover. Organizations with weak or improperly configured MFA policies were particularly vulnerable. The large volume of login attempts indicates a broad and persistent attack effort. No direct evidence of exploitation beyond account compromise is provided.

Defensive guidance

Organizations should review and strengthen their MFA policies to ensure coverage of all authentication flows, including OAuth ROPC. Disabling or restricting the use of the deprecated OAuth ROPC flow is recommended. Enforce MFA consistently across all user groups and cloud applications, and avoid conditional MFA policies that exclude certain locations or users. Monitor for unusual login activity and implement strong password policies to reduce the risk of credential compromise.

References

securityweek.com/massive-password-spray-campaign-targeting-azure-cli/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 1 Jul 2026, 07:51 UTC

References

Community reviews