Password spraying attacks surge 155x as hackers exploit MFA gaps

Huntress has observed a 155x increase in password spraying attacks in the first half of 2026. Brute force is old news, but the spin driving that spike is new.

One major contributor was a campaign targeting Microsoft's Azure CLI, the command-line tool admins use to manage Azure and Entra resources. The traffic originated from an IPv6 range controlled by internet hosting provider LSHIY LLC.

The campaign started months earlier, but in mid-June alone Huntress observed more than 81 million related login attempts and 78 account compromises in a two-week window.

June 2026 password-spraying spike tied to the LSHIY campaign.

The auth flow that time forgot

A typical password spraying attack follows a familiar pattern:

1. Reconnaissance: The attacker collects valid usernames via LinkedIn, company websites, data breach dumps, and phishing to create a target list. 2. Build password list: The attacker assembles a short list of breached passwords, common passwords such as "Password123," company name variants, or seasonal terms. 3. Spray across accounts: The attacker tries one password against every account on the target list. Heeding lockout thresholds, they wait before moving to the next password in a low and slow approach. 4. Gain a foothold: If granted access, the attacker pivots to lateral movement, business email compromise (BEC), data exfiltration, or further credential theft.

The LSHIY campaign combined password-spraying scale with the reuse of valid username-and-password pairs from previous breaches that were never rotated. That made each successful attempt more valuable than a typical guess.

The attacker also abused Resource Owner Password Credentials (ROPC), a legacy OAuth grant deprecated in OAuth 2.1. ROPC was introduced to help applications migrate from direct authentication schemes to OAuth.

ROPC doesn’t support modern authentication flows like MFA or SSO. Instead, it sends the username and password straight to the /token endpoint, with no interactive MFA prompt. For an attacker, a reused password that still works can become an active session.

... continue reading