Executive Summary
Between June 12 and June 26, 2026, Huntress observed a massive, automated password-spraying campaign targeting Microsoft 365 environments, specifically the Azure command-line interface (CLI). The campaign originated from the IPv6 address range 2a0a:d683::/32, controlled by the internet infrastructure provider LSHIY LLC (AS32167), with geolocation telemetry pointing toward China despite some IP mislabeling in the U.S. Over 81 million failed login attempts were recorded, resulting in at least 78 successful compromises across 64 organizations.
The attack specifically targeted the OAuth Resource Owner Password Credentials (ROPC) flow. This legacy authentication method bypasses interactive Multi-Factor Authentication (MFA) prompts by sending credentials directly to the /token endpoint. Analysts discovered that while many targeted organizations had Conditional Access Policies (CAP) in place, misconfigurations—such as applying MFA only to specific apps, excluding non-admin users, or trusting specific geographic locations—allowed the threat actor to gain unauthorized access. The campaign highlights a 155-fold increase in password-spray volume observed over the past six months.