--- title: Password spraying attacks surge 155x as hackers exploit... description: Huntress reported a 155x surge in password spraying attacks in H1 2026, driven largely by a campaign targeting Microsoft Azure CLI that generated over 81... canonical: https://daily.dev/posts/password-spraying-attacks-surge-155x-as-hackers-exploit-mfa-gaps-itszhorqa twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Password spraying attacks surge 155x as hackers exploit MFA gaps | daily.dev og:description: Huntress reported a 155x surge in password spraying attacks in H1 2026, driven largely by a campaign targeting Microsoft Azure CLI that generated over 81... og:url: https://daily.dev/posts/password-spraying-attacks-surge-155x-as-hackers-exploit-mfa-gaps-itszhorqa og:image: https://api.daily.dev/og/posts/ITsZhoRqA.png og:image:alt: Password spraying attacks surge 155x as hackers exploit MFA gaps og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Password spraying attacks surge 155x as hackers exploit MFA gaps **[BleepingComputer](https://daily.dev/sources/bleepingcomputer)** · 6 min read · 0 upvotes · 0 comments ## Summary Huntress reported a 155x surge in password spraying attacks in H1 2026, driven largely by a campaign targeting Microsoft Azure CLI that generated over 81 million login attempts and 78 account compromises in a two-week window. Attackers exploited the legacy ROPC OAuth grant, which bypasses MFA by sending credentials directly to the token endpoint, and reused valid but never-rotated username-password pairs from prior breaches. Traffic originated from BYOIP IPv6 ranges (LSHIY LLC, later FranTech and 3xK Tech), letting attackers evade IP-based blocking. Of 23 analyzed businesses, 8 had no MFA and 15 had MFA gaps due to limited policy scope, trusted-location exceptions, or report-only mode. Recommended mitigations include disabling ROPC, restricting Azure CLI access, enforcing Conditional Access across all users/apps/client types, and prioritizing response by credential validity rather than spray volume. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How does the ROPC OAuth grant let attackers bypass MFA in Azure sign-ins? Resource Owner Password Credentials (ROPC) is a legacy OAuth grant that sends a username and password directly to the token endpoint without any interactive MFA or SSO prompt. Because Conditional Access policies often aren't scoped to cover this flow, a valid reused password alone can generate an authenticated session, even when MFA is technically enabled elsewhere for that account. _Teams hardening Azure sign-in flows against ROPC gaps can follow ongoing coverage on daily.dev._ ### Why did password spraying attacks increase 155x in the first half of 2026? Huntress observed a 155x increase in password spraying attacks in the first half of 2026, largely fueled by a campaign against Microsoft Azure CLI that produced more than 81 million login attempts and 78 account compromises within a two-week window in mid-June. The campaign combined reused breached credentials with abuse of the legacy ROPC OAuth grant, which lacks MFA support, and rotated through BYOIP IPv6 and IPv4 ranges from providers like LSHIY, FranTech, and 3xK Tech to dodge IP-based blocking. _Security teams tracking credential-stuffing and MFA-bypass trends can follow analysis like this on daily.dev._ ### What Conditional Access misconfigurations left organizations vulnerable to this Azure CLI password spraying campaign? Of 23 businesses analyzed, 8 had no MFA at all, and the remaining 15 had Conditional Access policies that didn't actually block the attack because they were limited to specific apps or user groups, relied on trusted-location exceptions, or were still running in report-only mode. Recommended fixes include requiring MFA for all users, apps, and client types with no exclusions, and explicitly disabling the ROPC grant. _Admins auditing Conditional Access scope gaps can track similar incident breakdowns on daily.dev._ ## Similar posts on daily.dev - [Hackers target Microsoft 365 accounts with 81 million login attempts](https://daily.dev/posts/hackers-target-microsoft-365-accounts-with-81-million-login-attempts-tnrut3eab) · BleepingComputer · 0 upvotes · 0 comments - [Microsoft 365 users fall victim to one-in-a-million password spray attack](https://daily.dev/posts/microsoft-365-users-fall-victim-to-one-in-a-million-password-spray-attack-rzc1b0v9d) · CSO Online · 0 upvotes · 0 comments - [No \(Bad\) CAP: Inside an Ongoing LSHIY Password Spray Attack](https://daily.dev/posts/no-bad-cap-inside-an-ongoing-lshiy-password-spray-attack-pyhmqimyh) · Huntress Blog · 0 upvotes · 0 comments - [More Attackers Are Logging In, Not Breaking In](https://daily.dev/posts/more-attackers-are-logging-in-not-breaking-in-9v6pmdhfh) · Dark Reading · 1 upvotes · 0 comments --- Tags: [#azure](https://daily.dev/tags/azure), [#authentication](https://daily.dev/tags/authentication), [#oauth](https://daily.dev/tags/oauth) [View this post on daily.dev](https://daily.dev/posts/password-spraying-attacks-surge-155x-as-hackers-exploit-mfa-gaps-itszhorqa) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Password spraying attacks surge 155x as hackers exploit MFA gaps","url":"https://daily.dev/posts/password-spraying-attacks-surge-155x-as-hackers-exploit-mfa-gaps-itszhorqa","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/password-spraying-attacks-surge-155x-as-hackers-exploit-mfa-gaps-itszhorqa"},"datePublished":"2026-08-19T14:00:39.009Z","dateModified":"2026-08-19T14:04:38.450Z","description":"Huntress reported a 155x surge in password spraying attacks in H1 2026, driven largely by a campaign targeting Microsoft Azure CLI that generated over 81...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/8ea7b318938a480655d6f8aa4d09a7d6?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/8ea7b318938a480655d6f8aa4d09a7d6?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"BleepingComputer","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"BleepingComputer","logo":"https://media.daily.dev/image/upload/s--as8nJ3qy--/f_auto,q_auto/v1774959951/logos/bleepingcomputer?_a=BAMAMiWQ0","url":"https://daily.dev/sources/bleepingcomputer"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/password-spraying-attacks-surge-155x-as-hackers-exploit-mfa-gaps-itszhorqa","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"azure,authentication,oauth","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"BleepingComputer","item":"https://daily.dev/sources/bleepingcomputer"},{"@type":"ListItem","position":3,"name":"Password spraying attacks surge 155x as hackers exploit MFA gaps"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/password-spraying-attacks-surge-155x-as-hackers-exploit-mfa-gaps-itszhorqa#faq","mainEntity":[{"@type":"Question","name":"How does the ROPC OAuth grant let attackers bypass MFA in Azure sign-ins?","acceptedAnswer":{"@type":"Answer","text":"Resource Owner Password Credentials (ROPC) is a legacy OAuth grant that sends a username and password directly to the token endpoint without any interactive MFA or SSO prompt. Because Conditional Access policies often aren't scoped to cover this flow, a valid reused password alone can generate an authenticated session, even when MFA is technically enabled elsewhere for that account. Teams hardening Azure sign-in flows against ROPC gaps can follow ongoing coverage on daily.dev."}},{"@type":"Question","name":"Why did password spraying attacks increase 155x in the first half of 2026?","acceptedAnswer":{"@type":"Answer","text":"Huntress observed a 155x increase in password spraying attacks in the first half of 2026, largely fueled by a campaign against Microsoft Azure CLI that produced more than 81 million login attempts and 78 account compromises within a two-week window in mid-June. The campaign combined reused breached credentials with abuse of the legacy ROPC OAuth grant, which lacks MFA support, and rotated through BYOIP IPv6 and IPv4 ranges from providers like LSHIY, FranTech, and 3xK Tech to dodge IP-based blocking. Security teams tracking credential-stuffing and MFA-bypass trends can follow analysis like this on daily.dev."}},{"@type":"Question","name":"What Conditional Access misconfigurations left organizations vulnerable to this Azure CLI password spraying campaign?","acceptedAnswer":{"@type":"Answer","text":"Of 23 businesses analyzed, 8 had no MFA at all, and the remaining 15 had Conditional Access policies that didn't actually block the attack because they were limited to specific apps or user groups, relied on trusted-location exceptions, or were still running in report-only mode. Recommended fixes include requiring MFA for all users, apps, and client types with no exclusions, and explicitly disabling the ROPC grant. Admins auditing Conditional Access scope gaps can track similar incident breakdowns on daily.dev."}}]} ```