Password spraying attacks surge 155x as hackers exploit MFA gaps
Huntress has observed a 155x increase in password spraying attacks in the first half of 2026, with a campaign targeting Microsoft's Azure CLI being a major contributor.
Intelligence analysis by Llama
A typical password spraying attack involves reconnaissance, building a password list, spraying across accounts, and gaining a foothold. The LSHIY campaign combined password spraying scale with the reuse of valid username-and-password pairs from previous breaches that were never rotated.
Imagine you're trying to guess a combination lock on a safe. You try one combination, then another, and another. If you get it right, you can open the safe and get what's inside. But if you keep trying and trying, it can get really hard to keep track of all the combinations you've tried. That's kind of like what's happening with password spraying attacks. Hackers are trying lots of different combinations to see if they can get into a safe (or a computer system).
Analysis
The Auth Flow That Time Forgot
A typical password spraying attack follows a familiar pattern: reconnaissance, building a password list, spraying across accounts, and gaining a foothold. However, the LSHIY campaign combined password spraying scale with the reuse of valid username-and-password pairs from previous breaches that were never rotated, making each successful attempt more valuable than a typical guess.
The attacker also abused Resource Owner Password Credentials (ROPC), a legacy OAuth grant deprecated in OAuth 2.1. ROPC was introduced to help applications migrate from direct authentication schemes to OAuth. ROPC doesn’t support modern authentication flows like MFA or SSO. Instead, it sends the username and password straight to the /token endpoint, with no interactive MFA prompt. For an attacker, a reused password that still works can become an active session.
IPv6 BYOIP Party
BYOIP is a legitimate service that lets an ISP's customers route traffic through the provider using IP ranges they own themselves. BYOIP lets attackers move between IP ranges and providers, complicating blocking and detection. That flexibility can help attackers evade IP-based detection and account-lockout controls.
Scope is the Soft Spot
The LSHIY campaign doesn’t appear to target a particular industry. Instead, it takes advantage of organizations where password controls or multi-factor authentication (MFA) policies leave gaps attackers can exploit. Huntress analyzed 23 affected businesses. Eight had no MFA in place. Of the remaining 15, MFA didn’t apply to the attacker’s sign-in attempts because policies were limited to certain apps or user groups, relied on trusted locations, or remained in report-only mode.
Shut Off the Tap
The following mitigation strategies close the gaps these attacks rely on: enforce password hygiene, consider passwordless options, disable ROPC (or apps that rely on it) from your system, restrict the Azure CLI application for non-admin users, and require MFA for all users, all cloud apps, and all client app types, with no exclusions.
Key points
- Huntress has observed a 155x increase in password spraying attacks in the first half of 2026.
- The LSHIY campaign targeted Microsoft's Azure CLI and combined password spraying scale with the reuse of valid username-and-password pairs from previous breaches that were never rotated.
- The attacker abused Resource Owner Password Credentials (ROPC), a legacy OAuth grant deprecated in OAuth 2.1.
- BYOIP lets attackers move between IP ranges and providers, complicating blocking and detection.
- The LSHIY campaign doesn’t appear to target a particular industry, but instead takes advantage of organizations where password controls or multi-factor authentication (MFA) policies leave gaps attackers can exploit.
If organizations prioritize reviewing and enforcing multi-factor authentication (MFA) policies, they can prevent attackers from exploiting gaps in password controls and reduce the risk of password spraying attacks.
If organizations fail to review and enforce multi-factor authentication (MFA) policies, attackers can continue to exploit gaps in password controls and launch successful password spraying attacks.
