Massive Automated Password Spray Attack Targeting Microsoft’s Azure Command

Cybersecuritynews •Guru Baran • July 1, 2026

A large-scale automated password spray campaign is actively abusing Microsoft’s Azure Command-Line Interface (CLI) and legacy OAuth flows to compromise Entra ID accounts, despite organizations having multi-factor authentication (MFA) in place. Huntress is tracking a sustained password-and-token spray campaign targeting Microsoft 365 and Azure CLI logins, with activity spiking between June 12 and June 26, […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Massive Password Spray Attack Targets Microsoft 365 Accounts A significant automated password spray attack has targeted Microsoft 365 environments, generating over 81 million login attempts between June 12 and June 26, 2026. The attack, attributed to a threat actor using an IPv6 address range controlled by LSHIY LLC, successfully compromised 78 Microsoft accounts across 64 organizations. Attackers exploited the Azure command-line interface (CLI) using valid username and password combinations from previous breaches. Despite many organizations having multi-factor authentication (MFA) in place, misconfigurations in Conditional Access policies allowed the attackers to bypass MFA using the Resource Owner Password Credentials (ROPC) OAuth mechanism. Huntress, a cybersecurity firm, reported a 155-fold increase in password spray attacks over the past six months. The attack highlights vulnerabilities in existing security configurations, particularly regarding legacy authentication methods. 11 sources 69

Extracted Entities

Massive Automated Password Spray Attack Targeting Microsoft’s Azure Command

The full story

Extracted Entities

Attack Types (1)

Companies (1)

MITRE ATT&CK (1)

Platforms (1)

Tools (1)