Password-Spraying Campaign Exploited Deprecated OAuth Flow to Bypass MFA

Summary

Huntress reports a major Azure CLI password-spraying campaign that used deprecated OAuth ROPC to bypass MFA and Conditional Access. The initial LSHIY-hosted activity was terminated, but attempts later shifted to other IP ranges.

Key points

• Huntress observed a 155-fold rise in credential-spraying attacks in the first half of 2026.
• In a two-week period in June, the LSHIY-linked campaign generated more than 81 million login attempts and compromised 78 accounts.
• The attackers used the deprecated Resource Owner Password Credentials (ROPC) flow to obtain user-delegated tokens, bypassing MFA and Conditional Access when credentials were valid.
• Huntress observed no follow-on compromise activity after the successful logins; it suggested the credentials may have been validated for resale.
• LSHIY said the activity using its IP range had been terminated in early July. The actor later appeared to shift to FranTech-hosted IPv6 ranges and Tor exit nodes, with lower attempt volumes.
• Huntress recommends disabling ROPC, restricting Azure CLI access for non-admins, enforcing MFA across users and client apps, and strengthening password hygiene and Conditional Access.

MITRE ATT&CK

Vendors

Products

Related Articles

• Hexastrike Details S5PIVOT Proxy in Qilin Ransomware Intrusionhexastrike.comMicrosoft
• Proofpoint Details BluePhishing Consent Abuse Against Microsoft Entra Agent Identitiesproofpoint.comMicrosoft
• Microsoft Reports Storm-3358 Using ARTEX to Target Financial Organizationsmicrosoft.comMicrosoft
• CIS Details Device Code Phishing’s Growth and Impact on U.S. SLTTscisecurity.orgMicrosoft
• Security Roundup: Flowise Exploitation, AI Credential Theft and SAP Riskssecurityweek.comMicrosoft