# 81 Million Password-Spray Attacks Target Microsoft 365: The MFA Misconfiguration Crisis


A sophisticated password-spraying campaign unleashed over 81 million login attempts against Microsoft 365 environments in just two weeks, successfully compromising 78 accounts across 64 organizations. The campaign exploited a critical security blind spot: Conditional Access Policies (CAPs) that failed to protect the ROPC (Resource Owner Password Credentials) OAuth flow—a legacy authentication mechanism that bypasses modern multi-factor authentication protections by design.


Security researchers at Huntress, a managed cybersecurity services provider, documented the campaign between June 12 and 26, 2026, revealing not just a large-scale attack but a systematic failure in how many organizations configure cloud access controls.


## The Threat


The attack was straightforward in execution but devastating in impact. Threat actors obtained username and password combinations from past data breaches and used automated tooling to systematically test them against Microsoft 365 environments. What made this campaign particularly successful was its targeting of a specific authentication pathway: the Azure CLI (Command-Line Interface) using the ROPC flow.


Key attack characteristics:


  • 81 million login attempts over a 14-day period
  • Activity peaked on June 22, indicating coordinated timing
  • Successful compromises: 78 accounts across 64 organizations
  • Attack vector: Azure CLI via ROPC OAuth mechanism
  • MFA bypass: Successful authentication despite MFA deployments in many targeted environments

    • Once attackers gained valid credentials through password spraying, they could authenticate to Azure CLI—a critical administrative tool used to manage cloud infrastructure. This access granted them the ability to provision resources, deploy applications, modify databases, and automate cloud operations on behalf of legitimate users.


    ## Background and Context


    Microsoft 365 password-spraying attacks are not new, but the scale and sophistication of this campaign underscore an evolving threat landscape. Organizations have invested heavily in multi-factor authentication deployment, often believing MFA is a silver bullet that prevents account compromise. This campaign demonstrates the dangerous gap between *having* MFA and *properly configuring* MFA.


    The Azure CLI is a critical administrative tool used by organizations worldwide. According to Microsoft's own documentation, Azure CLI enables:


  • Virtual machine provisioning and management
  • Application deployment and configuration
  • Database administration and backup operations
  • Automated cloud operations and Infrastructure-as-Code workflows
  • Access to sensitive cloud resources

    • For an attacker, compromised Azure CLI credentials represent a beachhead into entire cloud environments, potentially affecting thousands of users and sensitive data stores.


    ## Technical Details: The ROPC Problem


    The Resource Owner Password Credentials (ROPC) OAuth flow is a legacy authentication mechanism that predates modern security practices. Unlike interactive authentication flows, ROPC is designed for scenarios where an application needs to collect user credentials directly and submit them to an authorization server.


    Why ROPC bypasses MFA:


    ROPC sends credentials directly to the /token endpoint without triggering interactive authentication prompts. This means:


  • No MFA challenge: The mechanism was designed before modern authentication frameworks required MFA support
  • Direct password transmission: Credentials go directly to Azure's token endpoint, bypassing the interactive prompts where MFA protections would normally engage
  • Legacy application support: ROPC exists primarily for backward compatibility with older applications that cannot handle modern OAuth flows

    • Microsoft's own security guidance recommends against ROPC, but it remains enabled by default in many environments and is still actively used by legacy administrative tools and custom applications.


    ## Campaign Statistics and Scale


    Huntress's research reveals a broader trend in password-spraying activity:


    | Metric | Finding |

    |--------|---------|

    | Overall increase in spray attacks | 155-fold increase in password-spraying attempts |

    | Average attempts per tenant/month | 1,964 failed login attempts |

    | Compromised accounts per organization | Average of 1-2 accounts across targeted organizations |

    | Campaign duration | 14 days (June 12-26) |

    | Attack origin | IPv6 range owned by LSHIY LLC (AS32167) |


    The 155-fold increase in password-spraying activity represents a significant shift in attacker behavior. Rather than targeting a single organization or industry, threat actors are now conducting broad, distributed campaigns that test compromised credentials across massive swaths of the cloud ecosystem.


    ## Organizational Weaknesses: The MFA Configuration Gap


    Huntress's investigation revealed that many compromised organizations *had implemented MFA*—but their configurations contained critical gaps. Organizations commonly misconfigured their Conditional Access Policies in the following ways:


    Common MFA misconfigurations:


    1. MFA applied only to specific applications — CAPs required MFA for popular applications like Outlook or Teams but not for Azure CLI or other administrative tools

    2. MFA enforced only for selected user groups — Policies protected administrators but not service accounts or other privileged users

    3. MFA required only from "untrusted" locations — Organizations allowed traffic from IP addresses appearing to originate from trusted networks, enabling attackers on residential proxies to bypass MFA

    4. Policies in "report-only" mode — Some organizations had implemented CAPs but never enabled enforcement, meaning policies generated alerts but took no action

    5. No MFA policy at all — In some cases, organizations had not implemented Conditional Access Policies to protect Microsoft 365


    The disconnect between deployment and effectiveness highlights a critical gap in cloud security maturity. Many organizations treat MFA deployment as a checkbox item rather than a comprehensive access control strategy.


    ## Implications for Organizations


    This campaign has several critical implications:


    Immediate risks:

  • Attackers with Azure CLI access can modify cloud infrastructure, deploy malware, exfiltrate data, or destroy resources
  • Compromised administrative credentials enable persistence mechanisms that survive credential rotation
  • Cloud resource configurations can be altered to grant lasting access to attackers

    • Broader organizational impact:

  • Password-spraying activity is increasing dramatically, suggesting this may become the default attack methodology
  • Organizations with password reuse patterns face exponentially higher risk
  • Legacy authentication mechanisms like ROPC remain a systemic vulnerability across the cloud ecosystem

    • Supply chain considerations:

  • Attackers with cloud access can potentially compromise organizations' customers and partners
  • Managed service providers (MSPs) with customer tenant access are attractive targets

    • ## Recommendations


    Organizations should implement the following controls immediately:


    Conditional Access Policy hardening:

  • Require MFA for all cloud apps, including Azure CLI and administrative tools
  • Enforce MFA for all user groups, including service accounts and administrative accounts
  • Implement device compliance requirements in addition to MFA
  • Test CAP policies before enabling enforcement to ensure legitimate workflows aren't disrupted

    • Credential hygiene:

  • Inventory all accounts with Azure CLI access
  • Implement passwordless authentication (Windows Hello, FIDO2) for administrative access
  • Review and revoke compromised credentials immediately
  • Implement credential spray detection that alerts on failed authentication patterns

    • Authentication hardening:

  • Disable or restrict ROPC flows where possible
  • Require modern OAuth flows (authorization code, device code) for applications
  • Implement IP-based restrictions for administrative access where feasible
  • Consider restricting Azure CLI access to specific applications through app registration policies

    • Monitoring and detection:

  • Enable Azure Sign-in logs and review for authentication anomalies
  • Implement alerts for successful authentications followed by administrative activities
  • Monitor for bulk Azure resource creation, deletion, or modification
  • Review Office 365 audit logs for changes to access controls

    • Testing and validation:

  • Conduct regular Conditional Access Policy reviews
  • Test CAP policies monthly to ensure they're functioning as intended
  • Verify MFA is enforced for all critical operations
  • Document all authentication flows and ensure they're covered by MFA requirements

    • ---


    ## HackWire Analysis


    This campaign exposes a critical disconnect in cloud security maturity: the assumption that "MFA deployed equals MFA protected." Organizations invest in authentication security without understanding the technical architecture of their own defenses. ROPC remains a dangerous legacy mechanism precisely because it was designed before modern security practices existed—yet it persists in default configurations, often unknown to the very teams managing access controls.


    The 155-fold increase in password-spraying activity is the real story here. This isn't a one-off campaign by a sophisticated nation-state actor; it's industrialized, commodity-level attack activity that's becoming the default playbook for credential-based access. As defenders deploy MFA broadly, attackers have simply shifted tactics to focus on misconfigured implementations and legacy authentication pathways.


    What's particularly concerning is how easily this attack succeeds because organizations focus on MFA as a single control rather than a component of defense-in-depth. The attackers aren't breaking MFA; they're routing around it by using authentication flows MFA doesn't protect. This pattern will repeat: defenders deploy control X, attackers find flow Y that bypasses it, organizations scramble to catch up.


    For cloud security teams, the immediate action is clear: audit Conditional Access Policies ruthlessly. Not just whether they exist, but whether they cover the actual authentication flows your organization uses. Test policies before enforcement, verify they work, and review them monthly. ROPC should be restricted or disabled unless actively needed. Administrative access deserves passwordless authentication, not password-plus-MFA.


    The broader lesson is that cloud security requires architectural understanding, not checkbox compliance. Organizations that treat MFA as "done" are vulnerable. Organizations that treat MFA as one layer in a larger access control strategy—paired with device compliance, IP restrictions, passwordless authentication, and monitoring—will detect and stop these campaigns.


    — HackWire Editorial


    ---


    ## Related Coverage


  • Read more in our [Breaches](https://www.hackwire.news/category/breaches) coverage
  • Cross-reference with [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities) and [Malware](https://www.hackwire.news/category/malware)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)