Massive Azure CLI Password Spray Attack Compromises 78 Microsoft Accounts
Between June 12 and June 26, 2026, a massive, automated password spray attack targeted Microsoft's Azure command-line interface (CLI), resulting in over 81 million login attempts and the compromise of at least 78 Microsoft accounts across 64 organizations. The attackers exploited a deprecated OAuth 2.0 grant type known as Resource Owner Password Credentials (ROPC) to bypass Conditional Access Policies (CAP) and multi-factor authentication (MFA) in environments where MFA was not enforced for all cloud applications. The attack originated from an IPv6 address range controlled by internet infrastructure provider LSHIY LLC (AS32167). ([thehackernews.com](https://thehackernews.com/2026/07/azure-cli-password-spray-hits-at-least.html?utm_source=openai)) This incident underscores the critical need for organizations to review and properly configure their Conditional Access Policies to enforce MFA across all applications and user groups. The exploitation of legacy authentication methods like ROPC highlights the importance of disabling deprecated protocols and ensuring that security measures are comprehensive and up-to-date. ([thehackernews.com](https://thehackernews.com/2026/07/azure-cli-password-spray-hits-at-least.html?utm_source=openai))
Kill Chain
