A massive 155x spike in password spraying attacks has been observed in H1 2026, with hackers leveraging legacy authentication flaws to bypass MFA protections. A single campaign involving 81 million login attempts has sent shockwaves through the cybersecurity industry.
- Password spraying attacks saw a massive 155x increase in the first half of 2026.
- Hackers targeted Microsoft's Azure CLI using legacy ROPC authentication methods.
- A single campaign generated over 81 million login attempts in just two weeks.
- Gaps in Conditional Access Policies (CAP) allowed attackers to bypass MFA.
The cybersecurity landscape is facing a massive upheaval. According to a report by Huntress, password spraying attacks have surged by an incredible 155x during the first half of 2026. Unlike traditional brute-force attacks that hammer a single account, these sophisticated campaigns use a 'low and slow' approach to avoid detection, targeting thousands of accounts simultaneously with common passwords.
A particularly devastating campaign was identified targeting Microsoft's Azure CLI. This campaign, linked to the hosting provider LSHIY LLC, saw more than 81 million login attempts and 78 confirmed account compromises within a mere two-week window in mid-June 2026. The attackers utilized an expansive IPv6 range, making traditional IP-based blocking nearly impossible.
Why This Matters
BozokMedia analysis shows that the core vulnerability lies not in the lack of security tools, but in the misconfiguration of existing ones. Many organizations have implemented Multi-Factor Authentication (MFA), yet they leave doors wide open through legacy protocols. Attackers are specifically exploiting Resource Owner Password Credentials (ROPC), an older OAuth grant that does not support modern interactive MFA prompts.
"Even though we call it an authorization method, it’s technically an impersonation method." - Andrew “Spike” Brandt, Principal Threat Intelligence Incident Commander at Huntress.
The Mechanics of the Attack
The attack follows a calculated four-step process: Reconnaissance (gathering usernames from LinkedIn/breaches), Password Building (creating lists of common passwords), Spraying (testing one password across many accounts), and Gaining a Foothold (moving laterally within the network). By using reused credentials from previous breaches, attackers significantly increase their success rate compared to random guessing.
| Attack Vector | Brute Force | Password Spraying |
|---|---|---|
| Targeting Strategy | Single User, Multiple Passwords | Multiple Users, Single Password |
| Detection Risk | High (Triggering Lockouts) | Low (Evading Thresholds) |
| Primary Goal | Account Access | Mass Credential Validation |
Furthermore, the use of BYOIP (Bring Your Own IP) services allows attackers to rotate through massive IPv6 pools. This creates a 'whack-a-mole' scenario for defenders, where blocking one IP range is useless as the attacker simply shifts to another provider, such as FranTech or 3xK Tech.
Historical Background
While password spraying is not a new concept, the scale has evolved with the rise of cloud-native environments. As enterprises migrate to platforms like Azure and Entra ID, the reliance on legacy authentication flows—often left enabled for compatibility—has provided a massive, unintended attack surface for modern threat actors.
Frequently Asked Questions
1. How can I protect my organization from password spraying?
The most critical step is to disable ROPC and legacy authentication methods, and ensure that Conditional Access Policies are strictly scoped to cover all users and all application types.
2. Why doesn't MFA stop these attacks?
MFA only works if it is required for the specific authentication flow being used. If an attacker uses a legacy flow that doesn't support MFA, they can bypass your security entirely.
