A large-scale Azure password spraying attack is targeting organizations by abusing a legacy authentication method that can bypass improperly configured multi-factor authentication (MFA). Researchers have observed more than 81 million login attempts over two weeks, with attackers successfully compromising dozens of Microsoft accounts across 64 organizations.
Azure CLI Under Attack
Cybersecurity company Huntress is tracking what it describes as a massive, automated password spraying campaign targeting the Microsoft Azure command-line interface (Azure CLI).
During the past two weeks, researchers recorded approximately 81 million login attempts against customer environments. The campaign has already resulted in the compromise of 78 Microsoft accounts across 64 organizations, and Huntress warns that the attacks continue to grow in scale.
The company also reports that credential spraying activity has surged dramatically, increasing 155-fold over the past six months.
Unlike targeted intrusions aimed at specific sectors, this campaign appears to rely on widely available credentials from previously leaked username and password combinations. According to Huntress, the attackers are selecting victims based on the prevalence of passwords in compromised credential lists rather than industry or business type.
Legacy Authentication Lets Attackers Bypass MFA
The attackers are exploiting OAuth Resource Owner Password Credentials (ROPC), a deprecated authentication protocol originally designed for trusted applications and legacy systems.
Because ROPC only requires a username and password, it can allow authentication without triggering multi-factor authentication if organizations have not properly secured or disabled the authentication flow.
Huntress found that many affected organizations believed their MFA protections were sufficient. However, their Microsoft Entra ID Conditional Access Policies did not apply to the specific authentication method being abused.
As a result, attackers were able to gain access even in environments where MFA had already been deployed.
Attack Infrastructure Complicates Detection
Researchers traced most of the malicious login attempts to AS32167, an autonomous system associated with internet infrastructure provider LSHIY LLC in Hong Kong.
The campaign primarily uses the IPv6 address range 2a0a:d683::/32. However, geolocation data has proven inconsistent, with some addresses appearing to originate from the United States while others resolve to China. Those discrepancies make IP-based detection and filtering more difficult for defenders.
Why MFA Failed
Huntress analyzed 23 organizations affected by the campaign to understand how attackers bypassed existing security controls.
Only eight organizations had no MFA policy in place. The remaining 15 organizations had implemented MFA through Microsoft Entra ID Conditional Access Policies, but configuration gaps prevented the protections from working as intended.
Researchers identified several recurring issues:
- Five organizations enabled MFA only for selected user groups, such as administrators, leaving standard user accounts unprotected.
- Four organizations enforced MFA only for specific applications, including Microsoft Admin Portals or VPN services, rather than across All Cloud Apps, leaving Azure CLI authentication outside the policy.
- Four organizations required MFA only when users logged in from locations outside the United States. Inaccurate IP geolocation allowed attackers to evade those restrictions.
- Two organizations configured their MFA policies in report-only mode, meaning the policies monitored activity without actually enforcing authentication requirements.
According to Huntress, these configuration weaknesses created opportunities for attackers to authenticate successfully despite MFA being enabled.
How Organizations Can Protect Azure Environments
Researchers warn that the deprecated ROPC authentication flow can completely bypass poorly configured Conditional Access Policies.
To reduce the risk of compromise, organizations should:
- Require MFA for all users without exceptions.
- Apply MFA to all cloud applications, including Azure CLI.
- Enforce authentication policies across every supported client application type.
- Restrict Azure CLI access to administrators and users who genuinely require it.
- Review Conditional Access Policies regularly to eliminate configuration gaps.
Conclusion
The latest Azure password spraying attack highlights how outdated authentication methods and incomplete MFA configurations can undermine otherwise strong security controls. Although many affected organizations had already implemented multi-factor authentication, policy gaps surrounding the legacy ROPC protocol allowed attackers to authenticate successfully. Regularly auditing Conditional Access Policies, disabling legacy authentication where possible, and enforcing MFA across all users and applications remain essential steps for defending Microsoft Azure environments.
0 responses to “Azure Password Spraying Attack Exploits Legacy Login Method to Bypass MFA”