Bulk credential validation via ROPC OAuth flow

Duo Tech@duotech

•updated Jul 14, 2026•18•0•22

Detects high-frequency Resource Owner Password Credentials (ROPC) authentication attempts originating from a single IP address against multiple different user accounts within a 15-minute window. This behavior is indicative of a password spraying or brute force campaign targeting cloud authentication services.