Loading story…
Huntress reported a large password-spraying campaign targeting Microsoft Azure CLI by abusing the deprecated OAuth Resource Owner Password Credentials (ROPC) grant. During a two-week period in mid-June, the company observed more than 81 million login attempts and 78 account compromises tied to traffic from an IPv6 range associated with hosting provider LSHIY LLC. When valid credentials were found, the attackers used a tenant’s /token endpoint to obtain user-delegated tokens, allowing access without triggering protections that organizations expected from multi-factor authentication and some Conditional Access configurations.
The activity appeared opportunistic rather than focused on a specific sector, and Huntress said many affected organizations either lacked MFA or had Conditional Access policies scoped in ways that left some users exposed. After Huntress notified LSHIY, the provider said abuse of its bring-your-own-IP service had been terminated, but the actor later appeared to move to infrastructure linked to FranTech and Tor exit nodes. Huntress urged defenders to disable ROPC where possible, restrict Azure CLI use for non-admin users, enforce MFA and Conditional Access across all users and apps, and prioritize incident response based on whether sprayed credentials were valid rather than on spray volume alone.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
During a two-week period in mid-June, Huntress observed more than 81 million login attempts and 78 account compromises tied to traffic from an IPv6 range associated with hosting provider LSHIY LLC. The activity abused Azure AD's /token endpoint via ROPC to obtain user-delegated tokens and bypass MFA and Conditional Access when credentials were valid.
Huntress reported a major rise in password spraying activity during the first half of 2026, driven largely by a campaign targeting Microsoft Azure CLI through the deprecated OAuth Resource Owner Password Credentials (ROPC) flow.
Following the termination of the LSHIY-linked abuse, the threat actor appeared to move to infrastructure associated with FranTech and Tor exit nodes.
After Huntress notified LSHIY about the activity, the provider said the abuse of its bring-your-own-IP service had been terminated.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A large-scale password spray campaign targeted Microsoft 365 environments through **Azure CLI** logins, generating more than **81 million authentication attempts** and compromising at least **78 accounts across 64 organizations**, according to Huntress. The attackers abused the deprecated OAuth **Resource Owner Password Credentials** (`ROPC`) flow to validate stolen username-password pairs and obtain user-delegated tokens, relying on previously breached credentials that had not been rotated. The activity was observed between mid and late June and in some cases succeeded even where **MFA** and **Conditional Access** were enabled, because policies were misconfigured or did not fully cover Azure CLI `ROPC` authentication. Huntress said most attempts originated from the IPv6 range `2a0a:d683::/32`, associated with **LSHIY LLC** (`AS32167`), and reported a more than **155-fold** increase in credential-spray volume across its customer base over six months. Defenders were urged to enforce MFA for all users, cloud apps, and client app types, and to restrict Azure CLI access for non-admin users.
Jul 12, 2026
Password spraying has remained a persistent intrusion technique against cloud identity platforms, with CISA warning that attackers commonly target **single sign-on**, federated authentication, and email services by trying a small set of weak passwords across many accounts to avoid lockouts. U.S. authorities linked some activity to Iranian actors tied to the Mabna Institute, while Microsoft later reported that Iran-linked **DEV-0343** sprayed passwords across more than 250 Office 365 tenants, focusing on defense, GIS, maritime, and cargo organizations; fewer than 20 tenants were compromised, and accounts protected by **multifactor authentication** were largely resistant. More recent reporting shows the tactic evolving at scale. SecurityScorecard described a botnet of more than **130,000** compromised devices conducting password spraying against **Microsoft 365** by abusing **Basic Authentication** in non-interactive sign-ins, using credentials from infostealer logs and infrastructure tentatively linked to a likely Chinese-affiliated group. Detection content from Splunk also highlighted **Okta ThreatInsight** alerts for suspected password-spray activity, underscoring that identity providers continue to surface this behavior in telemetry. Across the reporting, defenders are urged to enforce MFA, disable legacy and Basic Authentication where possible, strengthen password policies, and monitor sign-in logs for repeated failures, unusual user agents, and distributed login attempts from many IP addresses.
Aug 15, 2026
Huntress reported a large phishing operation that used **Railway** cloud infrastructure to compromise Microsoft 365 accounts at hundreds of organizations by abusing Microsoft's legitimate device authorization flow. The campaign harvested and replayed OAuth access and refresh tokens, allowing attackers to maintain access for up to 90 days without needing victims' passwords and in many cases without being stopped by MFA. Researchers identified at least **344-350 victim organizations** across the U.S., Canada, Australia, New Zealand, and Germany, with activity accelerating sharply in early March and continuing at a rate of more than 50 compromises per day even after initial disruption efforts. The operation used highly varied, likely **AI-generated** lures delivered through email, QR codes, file-share themes, compromised websites, multi-hop redirects, and `workers.dev` pages to evade filtering and scale quickly. Huntress linked the activity to the **EvilTokens** phishing-as-a-service platform, which advertised Office 365 capture links, SMTP delivery, B2B sender services, AI-assisted phishing workflows, and open redirects. In response, Huntress pushed Conditional Access protections to about **60,000 Microsoft cloud tenants**, blocked additional attack attempts, and urged defenders to prioritize identity-layer monitoring, token revocation, blocking Railway-owned infrastructure, restricting device code authentication, and enabling **Continuous Access Evaluation**.
Jun 29, 2026