Huntress has observed a 155x increase in password spraying attacks in the first half of 2026. Brute force is old news, but the spin driving that spike is new.

One major contributor was a campaign targeting Microsoft's Azure CLI, the command-line tool admins use to manage Azure and Entra resources. The traffic originated from an IPv6 range controlled by internet hosting provider LSHIY LLC.

The campaign started months earlier, but in mid-June alone Huntress observed more than 81 million related login attempts and 78 account compromises in a two-week window.

The auth flow that time forgot

A typical password spraying attack follows a familiar pattern:

  • 1. Reconnaissance:The attacker collects valid usernames via LinkedIn, company websites, data breach dumps, and phishing to create a target list.

  • 2. Build password list:The attacker assembles a short list of breached passwords, common passwords such as "Password123," company name variants, or seasonal terms.

  • 3. Spray across accounts:The attacker tries one password against every account on the target list. Heeding lockout thresholds, they wait before moving to the next password in a low and slow approach.

  • 4. Gain a foothold:If granted access, the attacker pivots to lateral movement, business email compromise (BEC), data exfiltration, or further credential theft.

The LSHIY campaign combined password-spraying scale with the reuse of valid username-and-password pairs from previous breaches that were never rotated. That made each successful attempt more valuable than a typical guess.

The attacker also abused Resource Owner Password Credentials (ROPC), a legacy OAuth grant deprecated in OAuth 2.1. ROPC was introduced to help applications migrate from direct authentication schemes to OAuth.

ROPC doesn’t support modern authentication flows like MFA or SSO. Instead, it sends the username and password straight to the /token endpoint, with no interactive MFA prompt. For an attacker, a reused password that still works can become an active session.

This matters because many of the compromised businesses had implemented multi-factor authentication (MFA) via a Conditional Access Policy (CAP), but the MFA was not configured to cover this specific flow that attackers used.

As Andrew “Spike” Brandt, Principal Threat Intelligence Incident Commander at Huntress, put it:

“Even though we call it an authorization method, it’s technically an impersonation method.”

Huntress saw no post-compromise activity after the successful logins tied to the LSHIY campaign. Rich Mozeleski, Staff Product Manager at Huntress, suspects the attacker may have been validating credentials for resale on the dark web.

LSHIY later terminated the attacks from the original IP range and confirmed that the attacker had been using its bring-your-own-IP (BYOIP) offering.

Hacker tradecraft’s evolving daily, so let’s break it down on Tradecraft Tuesday!

Join us monthly for an in-depth look at attacker tradecraft—no sales or product talk involved. Sign up for the series today or catch up on previous episodes. No tricks, just tradecraft.

Register for Tradecraft Tuesday## It’s an IPv6 BYOIP party

BYOIP is a legitimate service that lets an ISP's customers route traffic through the provider using IP ranges they own themselves. BYOIP lets attackers move between IP ranges and providers, complicating blocking and detection. That flexibility can help attackers evade IP-based detection and account-lockout controls.

Attacks from the LSHIY campaign originated from IPv6 range 2a0a:d683::/32. IPv6 gives attackers an enormous pool of addresses to work with, making it harder for defenders to rely on blocking a small set of IPs.

After LSHIY shut down the original activity, the spray attempts first shifted to FranTech-hosted IPv6 ranges. Subsequent activity appeared from 3xK Tech using IPv4. The ease of switching providers turns infrastructure blocking into a familiar whack-a-mole problem for defenders.

These arrangements are easy to swap between providers, which creates a familiar "whack-a-mole" threat hunting scenario for defenders.

Scope is the soft spot

The LSHIY campaign doesn’t appear to target a particular industry. Instead, it takes advantage of organizations where password controls or multi-factor authentication (MFA) policies leave gaps attackers can exploit.

Huntress analyzed 23 affected businesses. Eight had no MFA in place. Of the remaining 15, MFA didn’t apply to the attacker’s sign-in attempts because policies were limited to certain apps or user groups, relied on trusted locations, or remained in report-only mode.

The findings show that even with MFA, organizations need to review how their Conditional Access policies are scoped and enforced. A policy can appear to require MFA while still leaving out specific users, applications, or sign-in methods.

Fine-tuning conditional access without locking out legitimate users is hard, and that difficulty is part of why this keeps working for attackers.

Shut off the tap

The following mitigation strategies close the gaps these attacks rely on:

  • Enforce password hygiene, consider passwordless options

  • Disable ROPC (or apps that rely on it) from your system

  • Restrict the Azure CLI application for non-admin users

  • Don't prioritize response by spray volume, since the most heavily sprayed tenants are often the least compromised. Prioritize by credential validity instead.

  • Require MFA for all users, all cloud apps, and all client app types, with no exclusions. Block authentication methods that can’t satisfy an MFA requirement, including the legacy ROPC grant.

  • Use a strong Conditional Access setting like userStrongAuthClientAuthNRequiredto enforce strong authentication at the client level and block ROPC.

As Mozeleski put it, "Appropriately configured and managed conditional access is a superpower."

Attackers can switch providers and IP ranges faster than defenders can block them. Shut this down by making sure a password alone cannot open the door: keep passwords strong, limit Azure CLI access to people who need it, and apply Conditional Access across all users, cloud apps, and client app types.

Tradecraft Tuesday: No Products. No Pitches. Just Hacks.

Tradecraft Tuesday provides cybersecurity professionals with an in-depth analysis of the latest threat actors, attack vectors, and mitigation strategies. Each weekly session features technical walkthroughs of recent incidents, comprehensive breakdowns of malware trends, and up-to-date indicators of compromise (IOCs).

Participants gain:

  • Detailed briefings on emerging threat campaigns and ransomware variants
  • Evidence-driven defense methodologies and remediation techniques
  • Direct interaction with Huntress analysts for incident response insights
  • Access to actionable threat intelligence and detection guidance

Advance your defensive posture with real-time intelligence and technical education specifically designed for those responsible for safeguarding their organization’s environment.

Sponsored and written by Huntress Labs.