An aggressive password-spraying campaign recently targeted Microsoft 365 environments, generating over 81 million login attempts within a two-week period. This campaign, observed by managed cybersecurity company Huntress between June 12 and June 26, 2026, successfully compromised 78 Microsoft accounts across 64 organizations. The attackers leveraged previously exposed username and password combinations and exploited a specific authentication mechanism to bypass multi-factor authentication (MFA).

Chronology of the Attack

The threat actors initiated their widespread password-spraying attempts between June 12 and June 26, 2026. They utilized Microsoft's Azure command-line interface (CLI) to conduct login attempts. Azure CLI is a tool designed for managing Azure cloud resources, including virtual machines, application deployments, and database management. The attackers' strategy involved authenticating via the Resource Owner Password Credentials (ROPC) OAuth mechanism.

Crucially, the campaign peaked on June 22, 2026. Huntress's investigation revealed that many of the compromised businesses had implemented MFA through a Conditional Access Policy (CAP). However, the MFA was not configured to cover the specific ROPC flow used by the attackers, allowing them to bypass this critical security layer. ROPC is considered problematic as it does not inherently support modern authentication flows like MFA or Single Sign-On (SSO). This allowed the attackers to send passwords directly, circumventing the intended MFA protection.

Impact of the Breaches

The campaign led to the compromise of 78 Microsoft accounts across 64 organizations. While the full extent of data compromised in each incident is not detailed in the available reports, successful account compromise in Microsoft 365 environments can lead to significant data theft, email compromise, and further lateral movement within the victim's network.

The fact that MFA, a widely recommended security measure, was bypassed in numerous instances underscores a critical configuration weakness that many organizations may unknowingly possess. The use of exposed credentials from past breaches highlights the persistent danger of credential reuse across various online services. This incident serves as a stark reminder that even with MFA enabled, specific authentication flows or misconfigurations can create exploitable gaps for determined attackers.

How to Protect Yourself and Your Organization

Organizations and users should take immediate steps to review their Microsoft 365 security configurations:

1. Audit Conditional Access Policies: Ensure that Conditional Access Policies in Azure AD (now Microsoft Entra ID) explicitly enforce MFA for all authentication flows, including legacy protocols or less common mechanisms like ROPC, where applicable. Prioritize modern authentication methods that natively support MFA. 2. Monitor Azure AD Sign-in Logs: Regularly review Azure AD sign-in logs for unusual login patterns, especially those originating from Azure CLI or involving the ROPC flow. Look for successful logins from unexpected locations, devices, or using unusual client applications. 3. Implement Phishing-Resistant MFA: While any MFA is better than none, phishing-resistant MFA methods (e.g., FIDO2 security keys) are superior to SMS-based or app-push notifications, which can be vulnerable to social engineering or MFA bypass techniques. 4. Enforce Strong, Unique Passwords: While this attack leveraged stolen credentials, robust password policies, and the use of unique, complex passwords for each service remain foundational. Password managers can aid in this. 5. Educate Users on Phishing: Remind users about the dangers of phishing, as initial credential compromise often starts with social engineering. 6. Review and Disable Legacy Authentication: Actively work to identify and disable legacy authentication protocols in your Microsoft 365 environment where they are not strictly necessary, as these often lack modern security controls like MFA enforcement.

This campaign highlights that a defense-in-depth strategy is crucial, and even seemingly secure configurations require continuous auditing to identify and close potential attack vectors.