Cybersecurity firm Huntress has uncovered a massive, ongoing password spray campaign targeting Microsoft's Azure command-line interface (CLI), compromising at least 78 accounts across 64 organizations. The attackers, operating from an IPv6 address range controlled by LSHIY LLC, made over 81 million login attempts between June 12 and June 26. The attacks rely on old username-password combos from previous breaches, not on targeting specific industries or business types.

What makes this campaign particularly dangerous is its use of a deprecated OAuth flow called Resource Owner Password Credentials (ROPC). This legacy protocol, which Microsoft recommends against and warns is incompatible with multi-factor authentication (MFA), allows attackers to bypass Conditional Access Policy (CAP) protections entirely. Many of the compromised organizations had MFA and CAP enabled, but these were misconfigured—for example, enforcing MFA only for specific apps or user groups, not for all cloud apps or all users. Eight of the affected businesses had no MFA policy at all.

The attack cadence escalated sharply on June 22, when 30 identities were compromised in a single day, up from a daily average of two to four. Huntress reports that credential spray attacks across its customer base have surged by over 155 times, with an average of nearly 2,000 failed attempts per tenant per month. To defend against such attacks, organizations should require MFA for all users, all cloud apps, and all client app types, restrict Azure CLI access for non-admins, and prioritize response based on credential validity. The key lesson: legacy protocols like ROPC can slip through poorly configured CAPs, so proper policy configuration is critical.

Source: The Hackers News