Cyberattackers have unleashed a massive wave of password spraying attacks, flooding networks with over 81 million login attempts in just two weeks alone. What’s more, these attacks are not your run-of-the-mill brute-force efforts – they’re leveraging gaps in multi-factor authentication (MFA) to gain a foothold.
The surge in password spraying attacks is a staggering 155 times higher than what was observed during the first half of this year, according to Huntress Labs. And it’s not just about the sheer volume of attempts; these attacks are also exploiting specific vulnerabilities in MFA policies that leave organizations vulnerable to attack.
One notable campaign targeted Microsoft’s Azure CLI, with attackers using a range of compromised credentials and valid username-and-password pairs from previous breaches. This allowed them to bypass even multi-factor authentication (MFA) controls, which were configured but not properly set up to cover this specific flow.
So how do these attacks work? In a typical password spraying campaign, attackers first gather valid usernames via social engineering or data breaches. They then assemble a list of breached passwords or common phrases that are likely to be reused across multiple accounts. With their target list in hand, they proceed to try each password against every account on the list, often using a “low and slow” approach to avoid triggering lockout thresholds.
In this case, however, attackers took it up a notch by combining password spraying with the reuse of valid username-and-password pairs from previous breaches. This made each successful attempt more valuable than a typical guess. They also exploited Resource Owner Password Credentials (ROPC), a legacy OAuth grant that’s been deprecated in favor of more secure authentication flows.
The worrying thing about this campaign is that many of the compromised businesses had implemented MFA via Conditional Access Policy (CAP). However, their MFA policies didn’t cover this specific flow used by attackers. This highlights a critical issue with relying solely on IP-based detection and account-lockout controls – attackers can easily move between IP ranges and providers to evade these measures.
The ease of switching providers is what makes infrastructure blocking such a “whack-a-mole” problem for defenders. As one provider shuts down the activity, it simply shifts to another range or provider, making it harder to keep up with the attacks.
So what can organizations learn from this campaign? It’s clear that relying on MFA policies alone isn’t enough – even when configured correctly. Defenders need to be aware of the gaps in their controls and take steps to address them proactively. This includes regularly reviewing password reuse, implementing more robust authentication flows, and staying vigilant for signs of lateral movement or credential theft.
In short, password spraying attacks like this one serve as a stark reminder that cybersecurity is an ongoing battle – not just about keeping up with the latest threats, but also about closing the gaps in our defenses before they’re exploited.
Source: Bleeping Computer — 2026-08-19