Multi-factor authentication is one of the best controls most organizations have. It is also not magic, and this campaign is a crisp reminder of the difference.

According to Huntress, researchers documented an automated password-spray campaign aimed at Microsoft’s Azure command-line interface that generated more than 81 million login attempts between June 12 and 26, compromising at least 78 accounts across 64 organizations. The attacker relied on previously breached but never-rotated credentials, then bypassed multi-factor authentication in many environments by authenticating through the ROPC OAuth flow — a path that several organizations’ Conditional Access policies failed to cover. Huntress traced the activity to infrastructure provider LSHIY LLC, and says it stopped after that provider terminated the responsible accounts.

Two old problems wearing a trenchcoat

Strip away the eye-watering numbers and this attack is a combination of two failures we already know well. The first is credential hygiene: the passwords weren’t cracked in real time, they were old, breached, and never changed. A credential exposed in some prior leak and left untouched is a loaded weapon sitting on the table.

The second is the more instructive one. ROPC — the Resource Owner Password Credentials flow — is a legacy OAuth grant that trades a username and password directly for a token, and in many configurations it doesn’t trigger the interactive MFA prompt users expect. If an organization’s Conditional Access policies don’t explicitly account for that flow, MFA can be technically “on” while a whole authentication path quietly waltzes around it. The attacker here didn’t defeat MFA so much as find the door it wasn’t guarding.

What to do about it

• Block legacy authentication: Disable ROPC and other legacy auth flows via Conditional Access unless you have a specific, documented need — and if you do, scope it tightly.
• Rotate breached credentials: Check accounts against known-exposed credential data and force resets; a password in a breach corpus is not a password anymore.
• Audit Conditional Access coverage: Confirm your policies apply to every authentication path, not just the interactive browser login, and test for gaps.
• Alert on spray patterns: Watch for high-volume failed logins across many accounts and sign-ins against the Azure CLI or automation endpoints that don’t fit normal use.
• Prefer phishing-resistant MFA: Move toward FIDO2/passkeys where possible so that even a valid password plus a legacy flow isn’t enough.

The outrage

Eighty-one million login attempts is not stealth; it is a battering ram. That a campaign this loud ran for two full weeks and quietly popped dozens of accounts across dozens of organizations says something uncomfortable about how many tenants aren’t watching their own front door — and how many have MFA switched on in a way that leaves a legacy side entrance propped open.

The maddening part is that none of the fixes here are exotic. Turn off legacy auth. Rotate credentials that turn up in breaches. Make sure the policy you think is protecting everyone actually applies to everyone. “We have MFA” is a good start, not a finish line — and attackers are extremely happy to keep testing the difference until the number of open side doors hits zero.