The 155x Surge - Huntress's H1 2026 Finding
Huntress observed a 155x increase in password spraying attacks in the first half of 2026. Brute force is old news, but the spin driving that spike is new. One major contributor was a campaign targeting Microsoft's Azure CLI, the command-line tool admins use to manage Azure and Entra resources. The traffic originated from an IPv6 range controlled by internet hosting provider LSHIY LLC. The campaign started months earlier, but in mid-June alone Huntress observed more than 81 million related login attempts and 78 account compromises in a two-week window. That is not a brute-force surge; it is a spray at scale, and it exposed how easily MFA gaps can be exploited when authentication flows are not uniformly protected.
The LSHIY Campaign - Azure CLI Password Spraying from IPv6
A typical password spraying attack follows a familiar pattern: reconnaissance, building a password list, spraying across accounts, and gaining a foothold. The LSHIY campaign combined password-spraying scale with the reuse of valid username-and-password pairs from previous breaches that were never rotated. That made each successful attempt more valuable than a typical guess. The attacker also abused Resource Owner Password Credentials (ROPC), a legacy OAuth grant deprecated in OAuth 2.1. ROPC was introduced to help applications migrate from direct authentication schemes to OAuth, but ROPC does not support modern authentication flows like MFA or SSO. Instead, it sends the username and password straight to the /token endpoint, with no interactive MFA prompt. For an attacker, a reused password that still works can become an active session.
This matters because many of the compromised businesses had implemented multi-factor authentication (MFA) via a Conditional Access Policy (CAP), but the MFA was not configured to cover this specific flow that attackers used. Andrew "Spike" Brandt, Principal Threat Intelligence Incident Commander at Huntress, put it plainly: "Even though we call it an authorization method, it's technically an impersonation method." Huntress saw no post-compromise activity after the successful logins tied to the LSHIY campaign. Rich Mozeleski, Staff Product Manager at Huntress, suspects the attacker may have been validating credentials for resale on the dark web.
LSHIY later terminated the attacks from the original IP range and confirmed that the attacker had been using its bring-your-own-IP (BYOIP) offering. Attacks from the LSHIY campaign originated from IPv6 range 2a0a:d683::/32. IPv6 gives attackers an enormous pool of addresses to work with, making it harder for defenders to rely on blocking a small set of IPs. After LSHIY shut down the original activity, the spray attempts first shifted to FranTech-hosted IPv6 ranges. Subsequent activity appeared from 3xK Tech using IPv4. The ease of switching providers turns infrastructure blocking into a familiar whack-a-mole problem for defenders.
MFA Gaps - How Conditional Access Policies Leave Blind Spots
The LSHIY campaign doesn't appear to target a particular industry. Instead, it takes advantage of organizations where password controls or multi-factor authentication (MFA) policies leave gaps attackers can exploit. Huntress analyzed 23 affected businesses. Eight had no MFA in place. Of the remaining 15, MFA didn't apply to the attacker's sign-in attempts because policies were limited to certain apps or user groups, relied on trusted locations, or remained in report-only mode. The findings show that even with MFA, organizations need to review how their Conditional Access policies are scoped and enforced. A policy can appear to require MFA while still leaving out specific users, applications, or sign-in methods. Fine-tuning conditional access without locking out legitimate users is hard, and that difficulty is part of why this keeps working for attackers.
Mitigation - Closing the Tap on Password Spraying
The following mitigation strategies close the gaps these attacks rely on:
- Enforce password hygiene, consider passwordless options
- Disable ROPC (or apps that rely on it) from your system
- Restrict the Azure CLI application for non-admin users
- Don't prioritize response by spray volume, since the most heavily sprayed tenants are often the least compromised. Prioritize by credential validity instead.
- Require MFA for all users, all cloud apps, and all client app types, with no exclusions. Block authentication methods that can't satisfy an MFA requirement, including the legacy ROPC grant.
- Use a strong Conditional Access setting like userStrongAuthClientAuthNRequired to enforce strong authentication at the client level and block ROPC.
As Mozeleski put it, "Appropriately configured and managed conditional access is a superpower." Attackers can switch providers and IP ranges faster than defenders can block them. Shut this down by making sure a password alone cannot open the door: keep passwords strong, limit Azure CLI access to people who need it, and apply Conditional Access across all users, cloud apps, and client app types.
Conclusion - The Credential-First Defense Problem
Password spraying will keep evolving, but the structural weaknesses that made the H1 2026 surge possible are addressable. The LSHIY campaign demonstrated that even organizations with MFA are not immune if Conditional Access policies are poorly scoped and legacy auth flows like ROPC are left enabled. The real lesson is that a password alone should never open the door. Strong password hygiene, disabled ROPC, restricted Azure CLI access, and uniformly enforced MFA across every user, cloud app, and client app type are the defense fundamentals that matter. Huntress's tradecraft Tuesday series continues to break down these evolving attacker tactics, no sales, no product talk—just the tradecraft that helps defenders stay a step ahead.
