Massive Password Spray Campaign Targeting Azure CLI

1. Executive summary

A massive, ongoing automated password-spray campaign targeting Microsoft's Azure CLI has been observed by Huntress, with over 81 million login attempts directed against customer environments between June 12 and June 26, 2026. At least 78 user accounts across 64 organisations have been compromised, with a spike around June 22 affecting 23 businesses in a single day. The campaign exploits the OAuth Resource Owner Password Credentials (ROPC) flow to validate stolen credentials against Microsoft 365 / Entra ID authentication endpoints, bypassing MFA where policies are not configured to cover ROPC. EMEA financial services with Microsoft 365 estates and incomplete MFA enforcement across all OAuth flows are directly exposed to account-takeover risk.

2. Regulatory framing

3. Technical analysis & attack chain

Confirmed attack chain

1. Reconnaissance / preparation. Threat actors acquired compromised password combo lists (username/password pairs). Huntress assesses the attacks are "based entirely on compromised password combo lists." No password generation or mutation is indicated — this is a list-driven spray, not a brute-force.
2. Infrastructure. Attack traffic originates from an IPv6 address range — 2a0a:d683::/32 — controlled by LSHIY LLC (AS32167). LSHIY is an internet infrastructure provider registered in Hong Kong, Wuhan (China), and New York. Other reports indicate IPv6 ranges associated with AS32167 and AS955 (another ASN operated by LSHIY) originate in China. Huntress reported the malicious activity to LSHIY via its abuse reporting mechanism but received no response.
3. Authentication vector — OAuth ROPC flow. Attackers use the OAuth Resource Owner Password Credentials (ROPC) flow to validate credentials. ROPC sends the username and password directly to the /token endpoint with no interactive MFA prompt. When valid credentials are received, the endpoint mints a new user-delegated access token. ROPC is deprecated in OAuth 2.1.
4. MFA bypass mechanism. The ROPC flow does not support modern auth flows such as MFA or SSO. If MFA is not configured to cover the ROPC authentication flow, attackers can successfully compromise accounts even when MFA is enabled for interactive sign-in. Huntress identified specific MFA configuration weaknesses across compromised organisations: - MFA was not enforced for all cloud applications. - MFA was enforced for certain user groups only. - MFA was required for non-trusted locations only. - MFA was implemented but never enforced. - Eight impacted businesses had no MFA policy at all.
5. Scale and timeline. - June 12–26, 2026: Campaign observed by Huntress. - 81+ million login attempts against Huntress customers. - 78 user accounts compromised across 64 organisations. - 2–4 accounts compromised daily during the two-week window. - Spike around June 22: 23 businesses compromised. - Huntress reports credential-spray attack volume across its customer base increased by over 155 times in the past six months, across multiple ASNs.
6. Post-compromise impact. The source material does not describe specific post-compromise actions (lateral movement, data exfiltration, persistence, or mailbox manipulation). The confirmed impact is account compromise — valid delegated access tokens minted for attacker-controlled sessions. What attackers do after obtaining tokens is not documented in the available sources.

Attribution: No named threat actor is identified in the source material. Attribution is limited to infrastructure association (LSHIY LLC / AS32167). No MITRE ATT&CK group or named actor is referenced. Attribution is unconfirmed — the infrastructure association indicates origin, not actor identity.

Confidence caveat: All technical detail in this advisory is single-sourced — it originates exclusively from Huntress via SecurityWeek and The Hacker News reporting. No independent corroboration from Microsoft, Microsoft Defender / Entra ID telemetry, or a second vendor is available in the provided sources. Verify before enforcement.

4. Mitigation & containment

P1 — Within 24 hours

1. Audit MFA coverage for ROPC / legacy auth flows. In the Entra ID (Azure AD) admin centre, review Conditional Access policies and confirm whether MFA is enforced for all authentication flows, including ROPC. Specifically check: - Whether any Conditional Access policy excludes the "Resource Owner Password Credentials" or "Legacy authentication" flows from MFA requirements. - Whether MFA is enforced for all cloud applications, not a subset. - Whether MFA is enforced for all user groups, not specific groups only. - Whether location-based MFA exemptions (trusted IPs / non-trusted locations) create a gap for ROPC traffic.
2. Block legacy authentication / ROPC where possible. If no business-critical application depends on ROPC, disable legacy authentication protocols in Entra ID: - Entra admin centre → Settings → Org settings → Modern auth → ensure "Enable Security defaults" or equivalent Conditional Access policy blocks legacy auth. - If Security Defaults are enabled, legacy authentication (including ROPC) is automatically blocked.
3. Hunt for ROPC token issuance. Query Entra ID sign-in logs for ROPC authentication events: - KQL (Microsoft Sentinel / Log Analytics): SigninLogs | where ClientAppUsed contains "Azure CLI" or ClientAppUsed contains "Microsoft Azure CLI" | where AuthenticationRequirement == "singleFactorAuthentication" | where ResultType == 0 | project TimeGenerated, UserPrincipalName, ClientAppUsed, IPAddress, Location, ResourceDisplayName

• Also query for token requests from the observed IPv6 range: SigninLogs | where IPAddress startswith "2a0a:d683"

4. Block observed malicious IP range. Add 2a0a:d683::/32 to Entra ID Named Location block list: - Entra admin centre → Security → Conditional Access → Named locations → Create a blocked location with the IPv6 range. - Create or update a Conditional Access policy that blocks sign-in from this named location.

P2 — Within 72 hours

5. Review and revoke active sessions for accounts showing ROPC sign-ins. For any user account that shows a successful ROPC authentication event during the campaign window (June 12 onwards), revoke all refresh tokens and active sessions: - PowerShell (Microsoft.Graph module): powershell Revoke-MgUserSignInSession -UserId <userPrincipalName>
6. Force password reset for compromised accounts. For any account confirmed compromised (successful ROPC token issuance from the observed IP range), require a mandatory password reset and re-enrollment in MFA.
7. Disable ROPC for service principals where not required. Review Entra ID app registrations and enterprise applications that have ROPC enabled. If the allowPublicClient property is set to true and ROPC is not required, set it to false.

P3 — Within 7 days

8. Implement Continuous Access Evaluation (CAE) where supported. CAE enables real-time revocation of access tokens when a Conditional Access policy changes or a user is disabled, reducing the window of opportunity for attacker-held tokens.
9. Alert on anomalous Azure CLI authentication spikes. Create a detection rule in Microsoft Sentinel or your SIEM that alerts on: - Sudden spikes in ClientAppUsed == "Microsoft Azure CLI" sign-in events. - Sign-in events from AS32167 or previously unseen ASNs. - Multiple failed sign-in attempts (password-spray pattern) followed by a successful ROPC token issuance.
10. Review password hygiene and enforce banned-password lists. Ensure Entra ID Password Protection is enabled with the custom banned password list and the Microsoft global banned password list. This reduces the efficacy of combo-list-based spray attacks.

5. Indicators of compromise

ipv6_range  2a0a:d683::/32
asn  AS32167
asn  AS955
organisation  LSHIY LLC
client_app  Microsoft Azure CLI
auth_flow  OAuth ROPC (Resource Owner Password Credentials)
endpoint  /token
date_range  2026-06-12/2026-06-26

6. Detection

Sigma rule — Entra ID sign-in via Azure CLI from observed malicious IP range

title: Azure CLI Password Spray from LSHIY Infrastructure
id: 211a-2026-07-01
status: experimental
description: >
  Detects successful sign-in events via Microsoft Azure CLI from the IPv6 range
  2a0a:d683::/32 (LSHIY LLC / AS32167), associated with a massive password-spray
  campaign reported by Huntress. Also flags ROPC-flow token issuance from Azure CLI
  with single-factor authentication.
references:

  - https://www.securityweek.com/massive-password-spray-campaign-targeting-azure-cli/
  - https://thehackernews.com/2026/07/azure-cli-password-spray-hits-at-least.html
author: Adverse Trace
date: 2026/07/01
logsource:
  product: azure
  service: signinlogs
detection:
  selection_ip:
    IPAddress|startswith: "2a0a:d683"
  selection_azurecli_ropc:
    ClientAppUsed|contains:

      - "Azure CLI"
      - "Microsoft Azure CLI"
    AuthenticationRequirement: "singleFactorAuthentication"
    ResultType: 0
  condition: selection_ip or selection_azurecli_ropc
falsepositives:

  - Legitimate administrative use of Azure CLI from trusted infrastructure
  - Development pipelines using ROPC with service accounts (should be reviewed)
level: high

Sigma rule — Password-spray pattern: high-volume failed sign-ins via Azure CLI

title: Azure CLI Password Spray Pattern - High Volume Failed Sign-Ins
id: 211b-2026-07-01
status: experimental
description: >
  Detects a password-spray pattern against Entra ID via Microsoft Azure CLI:
  a high volume of failed sign-in attempts (ResultType 50158, 50053, or 50128)
  from a single IP or ASN, consistent with the Huntress-reported campaign.
references:

  - https://www.securityweek.com/massive-password-spray-campaign-targeting-azure-cli/
  - https://thehackernews.com/2026/07/azure-cli-password-spray-hits-at-least.html
author: Adverse Trace
date: 2026/07/01
logsource:
  product: azure
  service: signinlogs
detection:
  selection_cli:
    ClientAppUsed|contains:

      - "Azure CLI"
      - "Microsoft Azure CLI"
  selection_failed:
    ResultType:

      - 50158
      - 50053
      - 50128
      - 50056
  timeframe: 1h
  condition: selection_cli and selection_failed | count(IPAddress) by IPAddress > 100
falsepositives:

  - Misconfigured service principal with expired credentials
  - Legitimate automated testing with incorrect credentials
level: medium

YARA rule — N/A

No file-based indicators, malware samples, or distinctive strings are present in the source material. This is a network/authentication-layer campaign; YARA file-scanning is not applicable.

7. Sources

• SecurityWeek — Massive Password Spray Campaign Targeting Azure CLI — https://www.securityweek.com/massive-password-spray-campaign-targeting-azure-cli/ — 2026-07-01
• The Hacker News — Azure CLI Password Spray Hits at Least 78 Microsoft Accounts in 81M+ Attempts — https://thehackernews.com/2026/07/azure-cli-password-spray-hits-at-least.html — 2026-07-01

8. Adverse Trace position

Severity: HIGH. This campaign is active, automated, and has demonstrated success at scale — 78 confirmed account compromises across 64 organisations in a two-week window, with 81+ million attempts. The attack vector (OAuth ROPC against Entra ID / M365) is broadly applicable to EMEA financial services estates that use Microsoft cloud services. The MFA bypass is not a vulnerability in MFA itself — it is a configuration gap where MFA policies do not cover legacy authentication flows. Institutions that assume MFA is enforced without verifying coverage of ROPC are exposed. All technical detail in this advisory is single-sourced (Huntress via SecurityWeek and The Hacker News); verify before enforcement. No named threat actor is identified; attribution is limited to infrastructure association with LSHIY LLC (AS32167) and is unconfirmed. Adverse Trace will continue to monitor for independent corroboration, Microsoft advisory output, and additional IOC enrichment. Clients should immediately audit Conditional Access policies for ROPC coverage and hunt Entra ID sign-in logs for Azure CLI authentication events from the observed IPv6 range.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.