Password spraying attacks surge 155x, exploiting legacy authentication flaws

Password spraying attacks have seen a significant 155x increase in the first half of 2026, driven by a novel campaign targeting Microsoft's Azure CLI, according to Huntress. This surge highlights the exploitation of outdated authentication methods, even in environments with modern security measures, with further coverage provided by Bleeping Computer.

The campaign, originating from an IPv6 range provided by LSHIY LLC, leveraged reused credentials and the legacy Resource Owner Password Credentials (ROPC) OAuth grant, which bypasses multi-factor authentication (MFA) and single sign-on (SSO). Attackers used valid usernames and previously breached passwords, attempting them against accounts to gain unauthorized access. While many compromised organizations had MFA implemented, their Conditional Access Policies (CAPs) were not configured to cover the ROPC flow, leaving a critical vulnerability. The attackers' ability to quickly switch IP ranges and providers, including FranTech and 3xK Tech, made traditional IP-based blocking ineffective.

Huntress observed that the attacks were not industry-specific but exploited gaps in password controls and MFA policies, affecting 23 businesses, eight of which lacked MFA entirely. The findings underscore the need for organizations to meticulously review and scope their MFA policies to cover all sign-in methods and user groups.

Source: Bleeping Computer