Password Spraying Attacks Explode 155x as Hackers Bypass MFA via Legacy OAuth
Huntress reports a 155-fold increase in password spraying attacks during the first half of 2026, with one major contributor being a campaign targeting Microsoft's Azure CLI. The traffic originates from an IPv6 range controlled by hosting provider LSHIY LLC, and in mid-June alone researchers observe more than 81 million login attempts and 78 account compromises in just two weeks.
Password spraying works by trying one common or breached password against many valid usernames, moving slowly to avoid lockout thresholds. The LSHIY campaign amplifies this technique by reusing valid username-and-password pairs from earlier breaches that victims never rotate, making each successful attempt more valuable than a typical guess. Attackers also abuse the Resource Owner Password Credentials (ROPC) grant, a legacy OAuth mechanism deprecated in OAuth 2.1 that sends credentials straight to the /token endpoint without any interactive MFA prompt.
This matters because many compromised organizations have MFA in place through Conditional Access Policies, but they do not configure those policies to cover the ROPC flow that attackers exploit. As a result, a reused password that still works becomes an active session that bypasses MFA entirely. Organizations should block legacy authentication flows, enforce credential rotation after breaches, and ensure Conditional Access coverage extends to all token endpoints.