Back Securityaffairs.Co

Azure CLI Targeted in LSHIY Password Spray Campaign Across 64 Orgs

Securityaffairs.Co •Pierluigi Paganini • July 1, 2026

81 Million Login Attempts, 78 Compromised Accounts: The LSHIY Password Spray Hitting Azure CLI Huntress researchers have been tracking a massive automated password spray campaign against Microsoft Azure CLI environments since June 12, 2026. A password spray attack is when attackers try a small number of common passwords across many accounts instead of many passwords […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Massive Password Spray Attack Targets Microsoft 365 Accounts A significant automated password spray attack has targeted Microsoft 365 environments, generating over 81 million login attempts between June 12 and June 26, 2026. The attack, attributed to a threat actor using an IPv6 address range controlled by LSHIY LLC, successfully compromised 78 Microsoft accounts across 64 organizations. Attackers exploited the Azure command-line interface (CLI) using valid username and password combinations from previous breaches. Despite many organizations having multi-factor authentication (MFA) in place, misconfigurations in Conditional Access policies allowed the attackers to bypass MFA using the Resource Owner Password Credentials (ROPC) OAuth mechanism. Huntress, a cybersecurity firm, reported a 155-fold increase in password spray attacks over the past six months. The attack highlights vulnerabilities in existing security configurations, particularly regarding legacy authentication methods. 11 sources 69

Extracted Entities

Azure CLI Targeted in LSHIY Password Spray Campaign Across 64 Orgs

The full story

Extracted Entities

Attack Types (1)

Campaigns (1)

MITRE ATT&CK (1)

Tools (1)