Password-Spraying Campaign Compromises 78 Microsoft Accounts by Exploiting Azure CLI ROPC MFA Gaps
Summary
Huntress found a password-spraying campaign that compromised 78 Microsoft accounts across 64 organizations using Azure CLI’s OAuth ROPC flow. Attackers later shifted providers; Huntress recommends properly scoped MFA and restricting Azure CLI access.
Key points
- From June 12–26, attackers made more than 81 million login attempts and compromised 78 accounts across 64 organizations.
- The campaign replayed previously breached credentials through Azure CLI’s OAuth Resource Owner Password Credentials flow, which does not provide an interactive MFA prompt.
- MFA gaps included policies limited to specific apps or user groups, trusted-location exclusions, and report-only settings; eight affected businesses had no MFA policy.
- The initial activity came largely from LSHIY LLC’s IPv6 range. After Huntress reported the abuse, LSHIY suspended the user and attacks from that range stopped.
- The attackers later shifted to other providers, including FranTech and 3xK Tech, and reached roughly 1.5 million attempted logins per day during a later wave.
- Huntress recommends requiring MFA or blocking access for all users, cloud apps, and client app types, and restricting Azure CLI for non-admin users.
Article Details
- Attack Vectors
- Automated password spraying against Azure CLI sign-ins using the OAuth ROPC flow.
- Previously breached username/password combinations were replayed at the tenant /token endpoint to obtain user-delegated tokens.
- Attackers shifted activity across hosting providers and ASNs, rotating source IPs and limiting attempts per IP.
- Defensive Notes
- Require MFA, or block access, for all users, all cloud apps, and all client app types; ensure policies cover Azure CLI ROPC sign-ins.
- Restrict the Azure CLI application for non-admin users.
- Use the userStrongAuthClientAuthNRequired Conditional Access setting to enforce strong authentication at the client-authentication level and block ROPC flows.
- Prioritize response based on credential validity rather than spray volume.
- Review Conditional Access scope, including app coverage, user groups, trusted locations, and whether policies are enforced rather than report-only.
MITRE ATT&CK
Vendors
Products
Azure CLIwith this newer activity and the initial password spray campaign (attackers are still attempting Azure CLI ROPC logins, for instance), we've also identified a few notable differences. First off, at the time ofMicrosoft 365 Apps for Enterprisethe past several weeks, we have been tracking a wave of credential and token spray attacks against Microsoft 365 environments. This activity was also reported by the wider community, as seen on various Reddit