A massive surge in password spraying attacks has left cybersecurity experts scrambling to keep up with the evolving tactics employed by hackers. According to Huntress Labs, a 155-fold increase in these types of attacks was observed in the first half of 2026, highlighting a disturbing trend that puts even organizations with robust security measures at risk.
At the heart of this surge is a campaign targeting Microsoft’s Azure CLI, which allows administrators to manage Azure and Entra resources. The attackers exploited gaps in multi-factor authentication (MFA) policies by leveraging valid username-and-password pairs from previous breaches that were never rotated. This approach made each successful attempt more valuable than a typical guess.
The attack follows a familiar pattern: reconnaissance, where attackers collect valid usernames; building a list of breached passwords or common words used as passwords; spraying across accounts with low and slow attempts to avoid triggering lockout thresholds; and finally gaining access to pivot to lateral movement, business email compromise (BEC), data exfiltration, or further credential theft. However, in this case, the attackers also abused Resource Owner Password Credentials (ROPC), a legacy OAuth grant that allows applications to migrate from direct authentication schemes but lacks modern authentication flows like MFA.
The ease with which these attacks can be conducted is particularly concerning because many of the compromised businesses had implemented MFA via Conditional Access Policy (CAP). However, the CAP was not configured to cover this specific flow that attackers used. Huntress’ Principal Threat Intelligence Incident Commander, Andrew “Spike” Brandt, noted that ROPC “is technically an impersonation method,” highlighting its vulnerabilities.
It’s worth noting that the attacks did not appear to target a particular industry but rather took advantage of organizations with weak password controls or gaps in MFA policies. After Huntress observed more than 81 million login attempts and 78 account compromises in a two-week window, the ISP LSHIY LLC terminated the attacks from its original IP range. Subsequent activity shifted between IPv6 ranges hosted by various providers, making it challenging for defenders to block and detect these attacks.
The ease of switching providers using legitimate services like bring-your-own-IP (BYOIP) allows attackers to evade detection and account-lockout controls, turning infrastructure blocking into a “whack-a-mole” problem. This scenario highlights the need for organizations to regularly review their security measures and ensure that their policies are up-to-date with the latest threats.
In practical terms, this means that cybersecurity teams should be aware of the potential vulnerabilities in ROPC and ensure that their MFA policies cover all authentication flows. Regularly reviewing and updating password controls, as well as implementing robust security awareness training for employees, can also help mitigate these types of attacks. Ultimately, staying vigilant and adaptable is crucial in today’s rapidly evolving threat landscape.
Source: Bleeping Computer — 2026-08-19