Azure CLI Password Spray Hits at Least 78 Microsoft Accounts in 81M+ Attempts
Summary: Huntress reported an automated password spray against Microsoft's Azure CLI originating from an IPv6 range (2a0a:d683::/32) controlled by LSHIY LLC (AS32167), making more than 81 million login attempts between June 12 and June 26 and compromising at least 78 Microsoft accounts across 64 organizations. The campaign used the deprecated Resource Owner Password Credentials (ROPC) OAuth flow to bypass Conditional Access policies, and after LSHIY suspended the user the activity moved to FranTech (AS53667) and later 3xK Tech GmbH (AS200373), reaching roughly 1.5 million attempted logins per day.
Key Takeaway: Many of the 64 compromised organizations had Conditional Access enabled, and eight had no MFA policy at all - the attackers got in on old, previously breached credentials that had never been rotated, because ROPC logins never hit the authorization endpoint where CAP is enforced.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026