Password-Spraying Attacks Surge 155-Fold Because of MFA Gaps

Huntress has reported a 155-fold increase in password-spraying attacks during the first half of 2026. The technique itself is nothing new, but attackers have found a new way to make it more effective.

A notable contributor to the statistics was a campaign targeting the Azure CLI — the command-line tool administrators use to manage Azure and Entra resources. The traffic originated from an IPv6 range belonging to the hosting provider LSHIY LLC. In just two weeks in mid-June, Huntress counted more than 81 million login attempts and 78 compromised accounts.

A Forgotten Way In

The classic scenario looks like this: an attacker assembles a list of valid logins from LinkedIn, company websites and data leaks, then tries a short set of popular or “seasonal” passwords against them, testing one password against many accounts at once. To avoid triggering a lockout, they move slowly and cautiously.

What set the LSHIY campaign apart was that it combined sheer scale with the reuse of “login–password” pairs from past leaks that had never been changed. On top of that, the attackers turned to a legacy OAuth mechanism — Resource Owner Password Credentials (ROPC), which was dropped in OAuth 2.1. ROPC supports neither MFA nor SSO: the login and password go straight to the /token endpoint without any interactive prompt for a second factor. As Huntress specialist Andrew Brandt put it, on paper it is an authorization method, but in essence it is a method of impersonation.

That is precisely why even organizations that had configured MFA through a Conditional Access Policy were hit: the protection simply did not extend to this particular login flow. Of the 23 companies analyzed, eight had no MFA at all, while the remaining fifteen had MFA that failed to kick in — the policies were limited to specific applications or groups, relied on “trusted locations,” or ran only in report-only mode.

No follow-on malicious activity was observed after the successful logins. Huntress suspects the attackers were simply validating credentials to resell on underground marketplaces. LSHIY subsequently halted the attacks and confirmed that the attacker had been using its bring-your-own-IP service.

A Shell Game

BYOIP lets customers route traffic through a provider using their own address ranges. For attackers, this is a convenient way to dodge blocks: after the original range was shut down, the activity shifted to FranTech IPv6 addresses, and then to IPv4 from 3xK Tech. The vast IPv6 space and the ease of switching providers turn address-based blocking into an endless shell game.

The specialists' main recommendation: a password alone should never open the door. ROPC should be disabled, access to the Azure CLI should be restricted from non-privileged users, and the MFA requirement should be extended to all users, all cloud applications and all client types without exception. And when it comes to response, priority is better given not to the most heavily “bombarded” tenants, but to those where the guessed passwords are actually valid.

Source: Bleeping Computer