Massive Azure CLI Password Spray Attack Compromises 78 Accounts Across 64 Organizations

Cybersecurity firm Huntress has uncovered a large-scale, automated password spray campaign targeting Microsoft's Azure command-line interface (CLI). Over a two-week period in June, attackers launched more than 81 million login attempts, successfully breaching at least 78 Microsoft accounts across 64 organizations. The activity, traced to an IPv6 address range controlled by internet infrastructure provider LSHIY LLC, appears to rely on old username and password combinations leaked in prior breaches that were never updated.

What makes this attack particularly concerning is its ability to bypass Conditional Access Policies (CAPs) by exploiting a deprecated OAuth flow called Resource Owner Password Credentials (ROPC). This legacy protocol allows users to hand over their credentials directly to an application, which then exchanges them for an access token - making it incompatible with multi-factor authentication (MFA). Microsoft has long advised against using ROPC, noting that it requires an unusually high degree of trust and carries risks absent in more secure alternatives. In many cases, organizations had MFA policies in place, but they were configured only for specific apps or user groups, leaving Azure CLI logins unprotected. Eight of the affected businesses had no MFA policy at all.

The attackers maintained a steady cadence of two to four successful logins per day from June 12 to 21, with a spike on June 19 when 12 accounts were compromised. On June 22, the pace accelerated, hitting 30 accounts across 23 businesses. Huntress reports that the vast majority of the password spray activity originated from LSHIY LLC, with some IP addresses resolving to the U.S. and a few to China. The firm has observed a dramatic surge in credential spray attacks across its customer base - up by over 155 times - with an average of nearly 1,964 failed attempts per month per protected tenant.

To defend against this kind of attack, security experts recommend requiring MFA for all users, all cloud applications, and all client app types when enabling Conditional Access. They also advise restricting the Azure CLI application for non-admin users and prioritizing responses based on credential validity. As Huntress researchers put it, the campaign reveals cracks in poorly configured CAPs, particularly where legacy protocols like ROPC can slip through enforcement entirely. The key takeaway isn't that MFA doesn't work - it's that organizations must ensure their policies are properly configured to cover the authorization flows attackers are exploiting.

Source: The Hackers News