81 Million Login Attempts Hit Microsoft 365 Accounts Over Two Weeks, 78 Breached

A large-scale password-spraying operation hit Microsoft 365 environments with more than 81 million login attempts over a two-week window, successfully breaching 78 accounts across 64 organizations. The campaign, documented by managed security firm Huntress, ran between June 12 and June 26, 2026, and represents a 155-fold spike in spraying activity compared to baseline.

How the Attack Bypassed MFA

The attackers chose their authentication method carefully. Instead of using a standard browser-based login — which would trigger an MFA prompt — they authenticated via the Azure CLI's Resource Owner Password Credentials (ROPC) OAuth endpoint. ROPC sends credentials directly to Microsoft's /token endpoint, bypassing the interactive MFA prompt entirely. The technique works whenever an organization's Conditional Access policies have gaps: MFA rules scoped to specific apps rather than all cloud apps, policies stuck in report-only mode, or no MFA enforced at all.

As Huntress described it: "ROPC sends the password straight to the /token endpoint with no interactive MFA prompt." That single gap turned multi-factor authentication into single-factor for affected tenants.

Scale and Attribution

The entire operation originated from an IPv6 address range owned by LSHIY LLC (AS32167). Huntress disclosed findings to the provider's abuse portal, though the identity of the threat actor behind the campaign has not been confirmed. The credential set used in the spray came from prior data breaches — attackers cross-referenced known username-password combinations against Microsoft 365 accounts.

Across the broader Huntress customer base, organizations are now averaging 1,964 failed login attempts per Microsoft tenant each month — a figure that illustrates how routine credential stuffing and spraying have become against cloud platforms.

What Organizations Need to Fix

The attack exploited a configuration problem, not a Microsoft vulnerability. The immediate remediation steps are:

• Enforce MFA on all cloud apps, not selected ones. Scoped policies leave gaps ROPC can walk through.
• Block legacy authentication protocols including ROPC. In Azure AD Conditional Access, create a policy that blocks authentication flows that don't use modern auth.
• Move Conditional Access policies out of report-only mode. A policy that only reports never stops anything.
• Review sign-in logs for Azure CLI authentication events from unexpected IP ranges, particularly IPv6 blocks.

Microsoft itself recommends disabling the ROPC grant in app registrations that don't strictly require it and enabling the Microsoft Authenticator's number-matching feature to defeat real-time phishing.

The research was published by BleepingComputer, citing Huntress's disclosure.