Back Feeds.4Sysops

81 million Azure login attempts exposed an MFA blind spot

Feeds.4Sysops •IT News • August 19, 2026

A password-spraying campaign generated more than 81 million login attempts against Azure CLI users in two weeks, compromising 78 accounts while exploiting an authentication path that bypassed MFA. Huntress recorded a 155-fold increase in password spraying during the first half of 2026, with attackers using breached credentials and legacy OAuth behavior rather than simply guessing passwords. Source

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Surge in Password Spraying Attacks Exploits MFA Gaps In the first half of 2026, Huntress reported a 155x increase in password spraying attacks, primarily targeting Microsoft's Azure CLI. This surge was driven by a campaign from LSHIY LLC, resulting in over 81 million login attempts and 78 account compromises within two weeks. Attackers exploited legacy OAuth behavior, specifically Resource Owner Password Credentials (ROPC), which bypassed multi-factor authentication (MFA) measures. Despite the high volume of attacks, no post-compromise activity was observed, suggesting that attackers may have been validating credentials for resale. The campaign highlighted significant gaps in MFA configurations, particularly in relation to Conditional Access Policies (CAP). Security experts emphasize the need for organizations to review their authentication methods to mitigate such risks. 3 sources 71

Extracted Entities

81 million Azure login attempts exposed an MFA blind spot

The full story

Extracted Entities

Attack Types (1)

MITRE ATT&CK (2)

Tools (1)