Huntress reported a 155x surge in password spraying during the first half of 2026, driven in part by the LSHIY campaign targeting Microsoft Azure CLI and abusing legacy ROPC authentication. The attacks used IPv6 BYOIP infrastructure, exposed gaps in Conditional Access coverage, and succeeded where MFA did not apply to the specific sign-in flow. #LSHIY #AzureCLI #ROPC #MicrosoftAzure #Entra #LSHIYLLC
Keypoints
- Huntress observed a 155x rise in password spraying attacks in early 2026.
- The LSHIY campaign targeted Microsoft Azure CLI and Entra resources.
- Attackers abused legacy ROPC flows to bypass MFA protections.
- BYOIP and IPv6 infrastructure made blocking the attacks more difficult.
- Many affected organizations had MFA gaps in Conditional Access policies.