--- title: "Microsoft 365 users fall victim to one-in-a-million password spray attack" url: https://daily.dev/posts/microsoft-365-users-fall-victim-to-one-in-a-million-password-spray-attack-rzc1b0v9d source_url: https://www.csoonline.com/article/4192819/microsoft-365-users-fall-victim-to-one-in-a-million-password-spray-attack.html type: article source: "CSO Online" published: 2026-07-03T15:32:15.963Z updated: 2026-07-03T16:00:59.895Z tags: ["microsoft", "authentication", "oauth"] reading_time: 2 upvotes: 0 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Microsoft 365 users fall victim to one-in-a-million password spray attack **[CSO Online](https://daily.dev/sources/csoonline)** · 2 min read · 0 upvotes · 0 comments ## Summary A large-scale automated password spray attack targeted Microsoft 365 accounts, with attackers making 81 million login attempts against Huntress customers between June 12–26, successfully compromising at least 78 accounts. The attack originated from a single IPv6 address range controlled by LSHIY LLC and exploited the OAuth ROPC flow using previously exposed credentials. Success was enabled by misconfigured MFA policies — some organizations enforced MFA only for specific apps or user groups rather than all cloud apps, leaving gaps that attackers exploited via Azure CLI logins. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Hackers target Microsoft 365 accounts with 81 million login attempts](https://daily.dev/posts/hackers-target-microsoft-365-accounts-with-81-million-login-attempts-tnrut3eab) · BleepingComputer · 0 upvotes · 0 comments - [No \(Bad\) CAP: Inside an Ongoing LSHIY Password Spray Attack](https://daily.dev/posts/no-bad-cap-inside-an-ongoing-lshiy-password-spray-attack-pyhmqimyh) · Huntress Blog · 0 upvotes · 0 comments - [Password spraying attacks surge 155x as hackers exploit MFA gaps](https://daily.dev/posts/password-spraying-attacks-surge-155x-as-hackers-exploit-mfa-gaps-itszhorqa) · BleepingComputer · 0 upvotes · 0 comments - [How the LSHIY Password-Spraying Attack Abuses OAuth’s ROPC Grant](https://daily.dev/posts/how-the-lshiy-password-spraying-attack-abuses-oauth-s-ropc-grant-lv08savsh) · Huntress Blog · 0 upvotes · 0 comments --- Tags: [#microsoft](https://daily.dev/tags/microsoft), [#authentication](https://daily.dev/tags/authentication), [#oauth](https://daily.dev/tags/oauth) [View this post on daily.dev](https://daily.dev/posts/microsoft-365-users-fall-victim-to-one-in-a-million-password-spray-attack-rzc1b0v9d)