--- title: How the LSHIY Password-Spraying Attack Abuses OAuth’s... description: A massive password-spraying campaign against Microsoft's Azure CLI, tracked from an IPv6 range controlled by hosting provider LSHIY, drove a 155x increase in... canonical: https://daily.dev/posts/how-the-lshiy-password-spraying-attack-abuses-oauth-s-ropc-grant-lv08savsh twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: How the LSHIY Password-Spraying Attack Abuses OAuth’s ROPC Grant | daily.dev og:description: A massive password-spraying campaign against Microsoft's Azure CLI, tracked from an IPv6 range controlled by hosting provider LSHIY, drove a 155x increase in... og:url: https://daily.dev/posts/how-the-lshiy-password-spraying-attack-abuses-oauth-s-ropc-grant-lv08savsh og:image: https://api.daily.dev/og/posts/lV08sAVSh.png og:image:alt: How the LSHIY Password-Spraying Attack Abuses OAuth’s ROPC Grant og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # How the LSHIY Password-Spraying Attack Abuses OAuth’s ROPC Grant **[Huntress Blog](https://daily.dev/sources/huntress-blog)** · 6 min read · 0 upvotes · 0 comments ## Summary A massive password-spraying campaign against Microsoft's Azure CLI, tracked from an IPv6 range controlled by hosting provider LSHIY, drove a 155x increase in credential spraying attacks observed in the first half of 2026, including over 81 million login attempts and 78 compromised accounts in a two-week window in mid-June. The attackers abused OAuth's deprecated Resource Owner Password Credentials (ROPC) grant, which mints a user-delegated token directly from valid credentials, bypassing MFA and Conditional Access Policies entirely. After LSHIY terminated the abused IP range following disclosure, the threat actor pivoted to FranTech-hosted IPv6 ranges and Tor exit nodes, though volume dropped significantly. Mitigations recommended include disabling ROPC, restricting Azure CLI access for non-admin users, and properly scoping Conditional Access Policies to cover all users, apps, and client types. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is the ROPC OAuth grant and why is it dangerous for Azure CLI security? Resource Owner Password Credentials (ROPC) is a deprecated OAuth flow, originally meant to help migrate legacy apps to OAuth back in 2012, that mints a user-delegated token directly from a username and password submitted to a tenant's /token endpoint. Because it only requires valid credentials, attackers can use it to completely bypass multi-factor authentication and Conditional Access Policies, making it effectively an impersonation method rather than a true authorization flow. ROPC is deprecated in OAuth 2.1. _Teams hardening Azure AD against credential attacks can track OAuth flow deprecations like this via daily.dev._ ### How large was the LSHIY password-spraying campaign against Azure CLI? The campaign generated more than 81 million related login attempts and led to 78 account compromises within a single two-week window in mid-June, contributing to a 155x increase in credential spraying attacks observed in the first half of the year. It originated from an IPv6 range (2a0a:d683::/32) tied to hosting provider LSHIY LLC, using a bring-your-own-IP (BYOIP) offering to rotate addresses and evade lockout detection like Microsoft's Smart Lockout. _Security teams tracking large-scale credential attacks against Azure can follow campaign details like this on daily.dev._ ### How can I protect my organization from ROPC-based password spraying attacks on Azure? Disable ROPC and any applications that rely on it, restrict the Azure CLI application for non-admin users, and require MFA or blocking for All Users, All Cloud Apps, and All Client App types unconditionally rather than scoping it to specific user groups. Also use a Conditional Access setting like userStrongAuthClientAuthNRequired to enforce strong client authentication, and prioritize response by credential validity rather than raw spray volume. _Anyone configuring Conditional Access Policies against credential attacks can find practical mitigation steps like these on daily.dev._ ## Similar posts on daily.dev - [No \(Bad\) CAP: Inside an Ongoing LSHIY Password Spray Attack](https://daily.dev/posts/no-bad-cap-inside-an-ongoing-lshiy-password-spray-attack-pyhmqimyh) · Huntress Blog · 0 upvotes · 0 comments - [Password spraying attacks surge 155x as hackers exploit MFA gaps](https://daily.dev/posts/password-spraying-attacks-surge-155x-as-hackers-exploit-mfa-gaps-itszhorqa) · BleepingComputer · 0 upvotes · 0 comments - [Microsoft 365 users fall victim to one-in-a-million password spray attack](https://daily.dev/posts/microsoft-365-users-fall-victim-to-one-in-a-million-password-spray-attack-rzc1b0v9d) · CSO Online · 0 upvotes · 0 comments - [Hackers target Microsoft 365 accounts with 81 million login attempts](https://daily.dev/posts/hackers-target-microsoft-365-accounts-with-81-million-login-attempts-tnrut3eab) · BleepingComputer · 0 upvotes · 0 comments --- Tags: [#azure](https://daily.dev/tags/azure), [#authentication](https://daily.dev/tags/authentication), [#oauth](https://daily.dev/tags/oauth) [View this post on daily.dev](https://daily.dev/posts/how-the-lshiy-password-spraying-attack-abuses-oauth-s-ropc-grant-lv08savsh) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"How the LSHIY Password-Spraying Attack Abuses OAuth’s ROPC Grant","url":"https://daily.dev/posts/how-the-lshiy-password-spraying-attack-abuses-oauth-s-ropc-grant-lv08savsh","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/how-the-lshiy-password-spraying-attack-abuses-oauth-s-ropc-grant-lv08savsh"},"datePublished":"2026-08-18T16:16:32.301Z","dateModified":"2026-08-18T16:27:24.423Z","description":"A massive password-spraying campaign against Microsoft's Azure CLI, tracked from an IPv6 range controlled by hosting provider LSHIY, drove a 155x increase in...","image":"https://media.daily.dev/image/upload/s--qPvKM23u--/f_auto/v1722860399/public/Placeholder%2009","thumbnailUrl":"https://media.daily.dev/image/upload/s--qPvKM23u--/f_auto/v1722860399/public/Placeholder%2009","isAccessibleForFree":true,"articleSection":"Huntress Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Huntress Blog","logo":"https://media.daily.dev/image/upload/s--kDC1MDsj--/f_auto,q_auto/v1780213277/logos/huntress-blog?_a=BAMAMiWQ0","url":"https://daily.dev/sources/huntress-blog"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/how-the-lshiy-password-spraying-attack-abuses-oauth-s-ropc-grant-lv08savsh","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"azure,authentication,oauth","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Huntress Blog","item":"https://daily.dev/sources/huntress-blog"},{"@type":"ListItem","position":3,"name":"How the LSHIY Password-Spraying Attack Abuses OAuth’s ROPC Grant"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/how-the-lshiy-password-spraying-attack-abuses-oauth-s-ropc-grant-lv08savsh#faq","mainEntity":[{"@type":"Question","name":"What is the ROPC OAuth grant and why is it dangerous for Azure CLI security?","acceptedAnswer":{"@type":"Answer","text":"Resource Owner Password Credentials (ROPC) is a deprecated OAuth flow, originally meant to help migrate legacy apps to OAuth back in 2012, that mints a user-delegated token directly from a username and password submitted to a tenant's /token endpoint. Because it only requires valid credentials, attackers can use it to completely bypass multi-factor authentication and Conditional Access Policies, making it effectively an impersonation method rather than a true authorization flow. ROPC is deprecated in OAuth 2.1. Teams hardening Azure AD against credential attacks can track OAuth flow deprecations like this via daily.dev."}},{"@type":"Question","name":"How large was the LSHIY password-spraying campaign against Azure CLI?","acceptedAnswer":{"@type":"Answer","text":"The campaign generated more than 81 million related login attempts and led to 78 account compromises within a single two-week window in mid-June, contributing to a 155x increase in credential spraying attacks observed in the first half of the year. It originated from an IPv6 range (2a0a:d683::/32) tied to hosting provider LSHIY LLC, using a bring-your-own-IP (BYOIP) offering to rotate addresses and evade lockout detection like Microsoft's Smart Lockout. Security teams tracking large-scale credential attacks against Azure can follow campaign details like this on daily.dev."}},{"@type":"Question","name":"How can I protect my organization from ROPC-based password spraying attacks on Azure?","acceptedAnswer":{"@type":"Answer","text":"Disable ROPC and any applications that rely on it, restrict the Azure CLI application for non-admin users, and require MFA or blocking for All Users, All Cloud Apps, and All Client App types unconditionally rather than scoping it to specific user groups. Also use a Conditional Access setting like userStrongAuthClientAuthNRequired to enforce strong client authentication, and prioritize response by credential validity rather than raw spray volume. Anyone configuring Conditional Access Policies against credential attacks can find practical mitigation steps like these on daily.dev."}}]} ```