Executive Summary
A large-scale password spray campaign, attributed to activity from the IPv6 range 2a0a:d683::/32 linked to LSHIY LLC, targeted Azure CLI sign-ins between June 12 and July 2, 2026. The campaign generated over 81 million login attempts, successfully compromising 78 accounts across 64 organizations. The attackers exploited the Resource Owner Password Credentials (ROPC) flow, which bypassed Multifactor Authentication (MFA) because many organizations' Conditional Access policies were scoped too narrowly, excluding Azure CLI or non-interactive sign-in paths.
Simultaneously, significant architectural gaps in AI agent security were identified. This includes CVE-2026-12957, a critical flaw in Amazon Q Developer allowing credential theft, and the 'Poisoned Tenant' campaign where attackers use fraudulent OpenAI organization invites to harvest API keys. These threats highlight a growing 'identity dark matter' where AI agents operate with human-level permissions but lack the runtime monitoring necessary for secure enterprise governance.