I've always had a soft spot for this particular car brand. Our family has owned a few of them over the years, and they've served us incredibly well. In 2023, I bought a new four wheel drive/SUV from t...

Between June 12 and June 26, 2016, an automated password spray attack targeted Microsoft's Azure CLI, compromising 78 accounts across 64 organizations after over 81 million login attempts. The attack leveraged deprecated OAuth 2.0 ROPC (Resource Owner Password Credentials) flows to bypass conditional access policies, even in environments with MFA enabled but not enforced. Most activity originated from IP addresses linked to Lishi LLC, resolving to the U.S. and China, while attackers reused previously breached but unrotated username-password combinations. Eight impacted organizations had no MFA policy at all, while others failed to enforce it for Azure CLI ROPC logins, exposing gaps in conditional access configurations. The campaign indiscriminately targeted accounts based on password prevalence rather than industry or business type, emphasizing the risks of weak or reused credentials. Microsoft’s documentation explicitly warns against ROPC flows due to incompatibility with MFA, reinforcing the need for properly configured and enforced authentication policies.

YouTube video by TV Fórum

YouTube video by TV Fórum

Huntress reported a 155x surge in password spraying during the first half of 2026, driven in part by the LSHIY campaign targeting Microsoft Azure CLI and abusing legacy ROPC authentication. The attacks used IPv6 BYOIP infrastructure, exposed gaps in Conditional Access coverage, and succeeded where MFA did not apply to the specific sign-in flow. #LSHIY #AzureCLI #ROPC #MicrosoftAzure #Entra #LSHIYLLC

YouTube video by MSNBC

YouTube video by 서논 라이브 & 긴영상

YouTube video by MarvelousMaxter

Huntress says attackers made 81M Azure CLI password spray attempts from June 12-26, 2026, using ROPC to bypass weak CAPs.

YouTube video by omnislasherRX7

LSHIY password spray campaign hit Azure CLI with 81M attempts, compromising 78 accounts by bypassing MFA via OAuth ROPC flow.

An aggressive password-spraying campaign against Microsoft 365 produced more than 81 million login attempts in two weeks and compromised 78 Microsoft accounts across 64 organizations. The attacker used valid credentials exposed in past breaches to abuse Azure CLI and the ROPC flow, bypassing MFA where Conditional Access policies were misconfigured. #Microsoft365 #AzureCLI #ROPC #Huntress #LSHIY

Researchers uncovered a massive automated password spray campaign against Microsoft Azure CLI that used the deprecated ROPC flow to bypass Conditional Access policies and compromise 78 Microsoft accounts across 64 organizations. The attacks exploited reused breached credentials and highlighted misconfigured MFA coverage, especially for Azure CLI logins. #Microsoft #AzureCLI #ROPC #LSHIYLLC...