81 Million Login Attempts: Microsoft 365 Password Spray Uses Stolen Dark Web Credentials

A password spray attack is a credential attack that tries a small set of previously exposed passwords across a large number of accounts, deliberately staying below the lockout thresholds triggered by brute-force attempts that hammer a single account repeatedly.

The LSHIY campaign executed this technique entirely through the Azure CLI authentication path. Attackers gathered username and password combinations from dark web credential markets, where billions of login pairs from past breaches are sold in bulk. They submitted those pairs to Microsoft's /token endpoint using the ROPC OAuth flow, which the Azure CLI uses for non-interactive authentication.

The ROPC flow is the critical enabler. Microsoft's own documentation marks ROPC as a "legacy authentication protocol" and recommends against it, but many Azure CLI configurations still permit it. When an ROPC request arrives at the /token endpoint, Microsoft does not redirect the user to an interactive browser session. There is no browser window, no push notification to an authenticator app, and no SMS code prompt. The authentication completes in a single API call. Any Conditional Access Policy scoped to "All Cloud Apps" and "All Client App Types" would catch this flow, but 15 of the 64 affected organizations had MFA policies that missed the Azure CLI client app path entirely.

Huntress confirmed the account-level impact: 78 accounts validated and accessed across 64 organizations in 14 days. The daily compromise rate averaged two to four accounts per day initially. On June 22, 30 accounts across 23 organizations were compromised in a single day, indicating the attacker escalated to a higher-velocity phase using credentials with higher match confidence from the spray results.

The LSHIY campaign used "still valid username and password combinations that had been exposed in past breaches," according to Huntress. That description points directly to dark web credential markets, where stolen login pairs are available at scale from years of accumulated breach data.

The volume of available credentials is not theoretical. A single Elasticsearch cluster discovered in June 2026 contained 24 billion stolen credentials spanning 8.3 terabytes across 36 sources, with records pairing credential pairs directly to known CVE exploit data. A separate compilation tracked 16 billion credentials circulating across 30 dark web databases, covering Google, Apple, Facebook, GitHub, enterprise VPNs, and government platforms. Fresh records enter these compilations weekly from infostealer malware logs.

Corporate Microsoft 365 credentials appear in these datasets for several concrete reasons. Employees reuse personal passwords across work accounts. Phishing campaigns specifically targeting Microsoft 365 login pages have operated continuously since 2020. Infostealer malware deployed through malicious ads, cracked software, and drive-by downloads harvests browser-stored passwords and sends them to attacker-controlled collection infrastructure.

The LSHIY operator selected targets based entirely on password prevalence in compromised combo lists, according to analysis by The Hacker News. The campaign was indiscriminate across industries: finance, healthcare, manufacturing, professional services, and public sector organizations all appeared in Huntress's affected-customer data. Sector was irrelevant. Having a Microsoft 365 tenant with any account whose password appeared in a dark web dump was the only selection criterion for this campaign.

Huntress attributes all observed attack traffic to infrastructure registered to LSHIY LLC, an autonomous system operating under AS32167 with the IPv6 prefix 2a0a:d683::/32. Geographic analysis of the IP range shows resolution primarily to U.S. exit points, with some traffic resolving to Chinese infrastructure, though network-level attribution alone does not establish the threat actor's actual location or identity.

The campaign's technical profile does not match the signature of a nation-state operation. Nation-state actors conducting credential operations typically select targets by sector, rotate infrastructure frequently, and embed campaign activity within broader intrusion objectives. The LSHIY campaign ran the same technique from the same ASN for 14 days without modification. Huntress characterizes the activity as financially motivated credential access: validate working username and password pairs for potential resale to initial access brokers, direct account exploitation, or downstream extortion.

What the LSHIY operation demonstrates is that sophisticated tradecraft is not required to breach enterprise Microsoft 365 environments. The ROPC bypass has been publicly documented for years. Credential dumps with millions of valid corporate logins are available for purchase under $100 on dark web markets. Azure CLI is installed and accessible in the majority of enterprise development and IT environments. Combining these three elements, a publicly documented bypass technique, purchased credentials, and a widely deployed client app, was sufficient to compromise 78 accounts before the attack ended.

Activity from the LSHIY LLC IPv6 range ended on July 2, 2026, according to Huntress. The stopping of observable activity does not mean compromised accounts have been remediated. Organizations that have not audited their Azure CLI sign-in logs for the June 12 to July 2 window may still have active attacker access.

The confirmed figures come from Huntress's managed security customer base, representing a fraction of total Microsoft 365 tenants globally. 78 accounts across 64 organizations were compromised in the 14-day observation window. The daily attack volume started at two to four accounts per day, peaked at 12 accounts on June 19, then surged to 30 accounts across 23 organizations on June 22 alone.

Huntress observed a 155-fold increase in password-spraying attacks across its entire customer base in 2026. The average organization now receives 1,964 failed login attempts per tenant each month, a volume high enough to bury individual spraying events in standard security alert queues. Organizations relying on login failure counts to detect credential attacks will not see LSHIY-style sprays in their dashboards because the per-account failure rate is too low to trigger standard thresholds.

The scope of exposure extends beyond Huntress customers. Microsoft 365 has approximately 345 million paid seats across millions of organizations globally. The LSHIY campaign targeted accounts indiscriminately based solely on credential availability. Any organization with a Microsoft 365 tenant whose users appear in dark web credential dumps, which is statistically the majority of enterprise organizations given the scale of 2025 and 2026 breach data, faces the same structural exposure.

Eight of the 64 affected organizations had no MFA policy at all. The remaining 56 had MFA implemented but with configuration gaps: MFA scoped to specific apps rather than all cloud apps, MFA limited to administrator accounts, trusted-location exceptions that weakened requirements for off-network users, and policies left in report-only mode that logged activity without enforcing protection.

Detection requires reviewing Microsoft Entra ID sign-in logs for specific signals that distinguish ROPC-based password spraying from normal user activity. Standard failed-login alerts will not surface this attack because the spray volume per individual account is too low to trigger typical lockout thresholds.

Pull sign-in logs from the Microsoft Entra admin center or via the Microsoft Graph API. Filter for authentications where "Client App" is listed as "ROPC" or where "Azure CLI" appears with "AuthenticationMethodsUsed" omitting interactive MFA. The source ASN for the confirmed LSHIY campaign is AS32167 with IPv6 prefix 2a0a:d683::/32. Any successful authentication from this range during June 12 through July 2, 2026 is a confirmed compromise indicator requiring immediate response.

Microsoft Sentinel customers can query the SigninLogs table with a filter for ClientAppUsed equals "Azure CLI" where ResultType equals 0 (successful sign-in) and GrantControls is empty or "None." This surfaces all ROPC authentications that bypassed MFA enforcement regardless of source IP, giving you a full picture of your legacy authentication exposure, not just the LSHIY campaign.

For post-compromise activity, check accounts with any successful ROPC sign-in during the June 12 to July 2 window for secondary artifacts: new email forwarding rules, OAuth application consent grants added after the compromise date, new external contacts, and SharePoint or OneDrive download volumes inconsistent with the user's normal pattern. Attacker activity after initial access typically generates these artifacts within 24 to 48 hours.

For broader context on OAuth-based authentication bypass patterns in Microsoft 365, our prior analysis of the ConsentFix OAuth attack chain covers overlapping detection methods applicable to this credential spray attack path.

Closing the configuration gap the LSHIY campaign exploited requires six specific changes to Microsoft 365 and Azure AD, all achievable without third-party tools.

Microsoft 365 password spray attacks using stolen credentials represent a structurally persistent risk that worsens as more breach data accumulates on dark web markets. The LSHIY campaign required no zero-day exploit, no custom malware, and no social engineering. It required a list of credentials available for purchase and knowledge of the ROPC flow, which has been publicly documented since 2018.

The 155-fold increase in password-spraying attacks Huntress observed across its customer base in 2026 reflects a supply-side collapse in attacker economics: credential dumps have become so large, so cheap, and so frequently refreshed with fresh infostealer logs that the barrier to running this class of attack has reached near-zero. Any threat actor with under $100 and basic knowledge of Azure CLI can replicate what the LSHIY campaign executed.

The exposure is specific. Your organization's Microsoft 365 accounts are statistically likely to appear in at least one dark web credential compilation given the scale of 2025 and 2026 breach data. The question your security team needs to answer today is whether your Conditional Access Policies explicitly block ROPC authentication flows across all client app types. If the answer is unclear, that uncertainty is itself a critical security finding that needs immediate resolution.

Run the Entra sign-in log query for ROPC authentications this week. Block Azure CLI for non-administrative users this week. Require MFA for all cloud apps and all client types this week. These three changes close the structural gap the LSHIY campaign exploited and eliminate the attack path for every future campaign using this same technique.