The large-scale Azure CLI password-spraying campaign demonstrates how incomplete multifactor authentication and Conditional Access policies can leave cloud accounts exposed despite appearing secure.

Between June 12 and June 26, attackers reportedly made more than 81 million login attempts and compromised at least 78 Microsoft accounts across 64 organizations. The campaign used previously leaked username and password combinations and targeted organizations across different industries rather than focusing on one particular sector.

The attackers abused the legacy Resource Owner Password Credentials authentication flow through Azure CLI. This flow is incompatible with normal MFA challenges and can bypass Conditional Access policies that do not cover all users, cloud applications, client types, and authentication methods.

The incident does not show that MFA is ineffective. It shows that MFA protection can fail when it is applied only to administrators, selected applications, untrusted locations, or interactive browser logins.

Organizations should require MFA for all users, all cloud applications, and all relevant client types. Azure CLI access should be restricted to users who genuinely require it, while legacy authentication flows should be blocked wherever possible.

Security teams should review Microsoft Entra sign-in logs for repeated Azure CLI failures, successful logins following password-spraying activity, unusual IPv6 sources, unfamiliar locations, and accounts using credentials that have not been changed for extended periods.

Compromised or suspected accounts should have passwords reset, active sessions and refresh tokens revoked, and recent mailbox, OneDrive, Teams, and cloud activity reviewed.

The key lesson is that deploying MFA is not the same as enforcing it everywhere. Attackers do not need to defeat a security control when they can simply find the authentication path where it was never applied.

Cybersecurity researchers have warned of a "massive, ongoing, automated password spray attack" aimed at Microsoft's Azure command-line interface (CLI), compromising dozens of accounts in the process. The activity, per Huntress, originates from an IPv6 address range (2a0a:d683::/32) controlled by internet infrastructure provider LSHIY LLC (AS32167). "Between June 12 and June 26, the threat

Source: Azure CLI Password Spray Hits at Least 78 Microsoft Accounts in 81M+ Attempts via The Hacker News — published 01 Jul 2026.