Significant Rise in Password Spraying Attacks Exploiting MFA Gaps

Password spraying attacks have experienced a staggering increase of 155 times in the first half of 2026, highlighting a formidable challenge for organizations striving to protect their digital assets. This surge, primarily driven by a campaign targeting Microsoft's Azure CLI, reveals vulnerabilities particularly in the configuration of multi-factor authentication (MFA) systems.

Understanding the Spike in Attacks

Huntress Labs reported that one of the chief catalysts for this escalation was a concerted offensive initiated months ago, which became notably active in mid-June. In this month alone, over 81 million malicious login attempts were recorded, resulting in 78 account compromises over a two-week period. The attacks originated from a specific range of IPv6 addresses managed by the internet hosting provider LSHIY LLC.

Mechanics of Password Spraying Attacks

A typical password spraying attack follows a systematic procedure:

• Reconnaissance: The attacker gathers valid usernames from sources like LinkedIn, company websites, and leaked data.
• Password List Construction: A short list of commonly used or previously breached passwords is compiled.
• Spraying: The attacker attempts each selected password across the target account list, following a cautious strategy to avoid detection.
• Gaining Access: Once access is obtained, the attacker may pursue further malicious activities such as data theft and business email compromise.

The LSHIY campaign intensified the impact of password spraying by leveraging reused username-password combinations from prior breaches, thus increasing the effectiveness of their efforts.

Exploiting Legacy Authentication Flows

One significant vector exploited during these attacks was the Resource Owner Password Credentials (ROPC), a deprecated authentication method in OAuth 2.1. Unlike standard authentication flows that include an interactive MFA component, ROPC sends credentials directly to the token endpoint, allowing attackers to bypass the additional security measures that MFA offers. Consequently, this methodology enabled attackers to initiate active sessions through reused passwords.

Despite the presence of MFA in various organizations, many had not tailored their Conditional Access Policies (CAPs) to address the vulnerabilities that were being exploited. This oversight became evident as successful logins recorded during the LSHIY campaign showed minimal post-compromise activity, suggesting that the intent of the attackers might be to validate credentials for future sales on the dark web.

Analysis of Affected Organizations

Huntress analyzed 23 businesses affected by the LSHIY campaign and found the following:

Among the 15 organizations that had MFA, it was apparent that their MFA policies were not applicable during the sign-in attempts performed by attackers. The lapses in coverage frequently arose from limitations tied to specific applications, user groups, or geographic locations, emphasizing the need for organizations to meticulously review their MFA configurations.

Mitigation Strategies

In light of these developments, security experts recommend that organizations implement several strategies to fortify their defenses:

• Enforce Strong Password Hygiene: Employees should be trained to use complex, unique passwords that are changed regularly.
• Disable ROPC: Organizations should eliminate reliance on applications that utilize this legacy authentication method.
• Restrict Azure CLI Access: Limiting Azure CLI access solely to administrative personnel helps minimize the attack surface.
• Universal MFA Requirements: All users should be required to use MFA across all applications and device types without exceptions.
• Enhance Conditional Access Policies: Employing rigorous settings like userStrongAuthClientAuthNRequired helps to enforce robust authentication methods and eliminate ROPC.

As highlighted by Rich Mozeleski, a Staff Product Manager at Huntress, an appropriately configured Conditional Access system can serve as a significant defensive measure against such attacks.

The Impact of IPv6 Addressing

Another aspect to consider is the role of IPv6 addressing in the escalation of these attacks. The wide range of addresses available through the IPv6 protocol complicates enforcement of IP-based blocking and detection systems, rendering traditional defenses less effective. Following the initial LSHIY activity, the attackers switched to different service providers, leading to a continual rotation of IP ranges that defenders struggle to keep pace with.

The dynamism of IP address allocation illustrates the need for organizations to fortify other layers of security rather than relying on solely blocking known malicious IPs.

Conclusion

As the landscape of cyber threats continues to evolve, the profound surge in password spraying attacks underlines the vulnerabilities inherent in password management and multi-factor authentication systems. Without diligent attention to security policies and practices, organizations expose themselves to significant risks that can be exploited by skilled adversaries. By reassessing Conditional Access configurations and adopting advanced security protocols, organizations can better protect themselves from future incursions.

Key Takeaways

• Password spraying attacks increased by 155 times in early 2026.
• 81 million login attempts and 78 account compromises reported from the LSHIY campaign.
• Many organizations had gaps in MFA coverage, undermining their defenses.
• Recommended mitigation strategies include strengthening password policies and disabling ROPC.
• IPv6 addressing presents unique challenges in blocking malicious IP traffic.