Security firm Huntress reported a 155x increase in password spraying attacks in the first half of 2026, driven largely by a campaign targeting Microsoft’s Azure CLI that generated more than 81 million login attempts and 78 account compromises in a single two-week window in mid-June. The traffic originated from an IPv6 range operated by hosting provider LSHIY LLC under a bring-your-own-IP arrangement.

The striking finding: most compromised organizations had multi-factor authentication (MFA) deployed. Attackers succeeded anyway by abusing Resource Owner Password Credentials (ROPC), a legacy OAuth login flow that bypasses MFA prompts entirely.

Executive Summary

Password spraying — trying one common password against many accounts, slowly enough to dodge lockout rules — is one of the oldest tricks in the attacker playbook. What Huntress documented in H1 2026 is that trick industrialized: a 155-fold volume increase, with a single campaign against Azure command-line logins producing 81 million attempts in two weeks. The attackers sharpened the technique by recycling valid username-and-password pairs from old breaches that were never rotated, making each attempt far more likely to land than a blind guess.

The deeper story is not password hygiene but policy scoping. Of 23 affected businesses Huntress analyzed, eight had no MFA at all — but the other 15 did, and were breached anyway because their Conditional Access policies (Microsoft’s rules engine for when to demand MFA) excluded the specific sign-in path the attackers used. The abused path, ROPC, is a deprecated OAuth grant that sends the username and password straight to the token endpoint with no interactive prompt where an MFA challenge could occur.

For any organization running Microsoft Entra ID — and for the infrastructure providers hosting them — the takeaway is blunt: MFA that is deployed but incompletely scoped provides the feeling of protection without the fact of it.

MFA You Bought Isn’t MFA You’re Getting

The most commercially significant number in the Huntress data is not the 155x surge — it is that 15 of 23 breached organizations had MFA deployed and it simply did not apply to the attack. Their Conditional Access policies were limited to certain applications or user groups, trusted ‘safe’ network locations, or sat in report-only mode, a testing setting that logs violations without blocking them. Each of those is a reasonable-sounding operational compromise, usually made to avoid locking out legitimate users or breaking a line-of-business app.

This reframes the identity-security market. The gap is no longer ‘do you have MFA?’ — adoption is widespread — but ‘can you prove every authentication path enforces it?’ That favors vendors and managed service providers selling policy auditing, attack-path validation, and identity posture management over those selling MFA seats. It also shifts liability conversations: an organization that attests to having MFA for cyber-insurance purposes, while ROPC sits unprotected, may find that attestation contested after a breach.

ROPC: The Legacy Door That Skips the Guard

Resource Owner Password Credentials is an OAuth grant designed years ago as a migration bridge: it lets an application collect a username and password directly and exchange them for an access token, with no interactive login screen. No login screen means no place to insert an MFA prompt. The grant is deprecated in OAuth 2.1, yet it remains available in many Microsoft Entra tenants — often because some old script or application still depends on it, and nobody wants to be the person who breaks it.

That is the economics of legacy authentication in miniature. The cost of leaving ROPC enabled is invisible until an incident; the cost of disabling it is an immediate, attributable helpdesk headache. Attackers systematically arbitrage that asymmetry. As Huntress’s Andrew Brandt put it, ROPC is technically ‘an impersonation method’ — a reused password that still works becomes an active session, no second factor required.

BYOIP and IPv6 Turn Blocking Into Whack-a-Mole

The campaign’s infrastructure choices matter as much as its authentication trick, and they land squarely on the hosting industry. The attackers used a bring-your-own-IP (BYOIP) service — a legitimate offering that lets a hosting customer route traffic through a provider using address space the customer owns. When LSHIY terminated the activity, the spraying resurfaced from FranTech-hosted IPv6 ranges, then from 3xK Tech on IPv4. Combine provider-hopping with IPv6’s effectively unlimited address pool and IP-based blocklists become a losing game: defenders block a range, attackers announce a new one.

For hosting and connectivity providers, this is a growing abuse-desk and reputation problem. BYOIP customers bring their own address space and, with it, their own history — providers that vet BYOIP onboarding lightly are effectively renting their network’s reputation to whoever shows up. Expect pressure, commercial if not regulatory, for stronger BYOIP due diligence and faster abuse response as these campaigns keep routing through legitimate infrastructure.

81 Million Attempts, Zero Follow-Through — and Why That’s Ominous

Huntress observed no post-compromise activity after the successful logins — no lateral movement, no data theft. Their assessment is that the operators were likely validating credentials for resale on dark-web markets. That points to a maturing supply chain: one group industrializes the guessing, verifies which credentials actually work, and sells confirmed access to others who specialize in monetization through business email compromise or ransomware.

The practical consequence for defenders is counterintuitive, and Huntress states it directly: do not prioritize response by spray volume. The most heavily sprayed tenants were often the least compromised. The right triage signal is credential validity — whether any attempt actually succeeded — not how much noise the attacker made. A quiet, successful login against a stale account is worth more attention than a million failures.

Background

Password spraying has been a staple of credential attacks for over a decade precisely because it exploits policy, not software: lockout rules watch for many failures on one account, while spraying spreads failures thinly across many. Its effectiveness has been amplified by the steady accumulation of breach dumps — billions of real username-and-password pairs that attackers replay against organizations where rotation never happened. Meanwhile, the industry’s answer, multi-factor authentication, has gone from rarity to near-mandate, pushed by cyber insurers and frameworks alike.

The unresolved seam between those two trends is legacy authentication. Protocols and grants that predate MFA — ROPC among them — persist inside cloud identity platforms like Microsoft Entra ID for backward compatibility, and each one is a path where a password alone still suffices. Campaigns like the one Huntress documented are best understood as the market discovering, at industrial scale, exactly where those seams are.

Source: Password spraying attacks surge 155x as hackers exploit MFA gaps — a BleepingComputer article, sponsored and written by Huntress Labs, detailing the H1 2026 password-spraying surge and the LSHIY campaign against Azure CLI logins.