Azure CLI password-spraying hits 78 Microsoft 365 accounts

A widespread and ongoing password-spraying campaign has successfully compromised dozens of Microsoft 365 accounts by exploiting misconfigured security settings, cybersecurity researchers report. The attack, which generated over 81 million login attempts over a two-week period, targeted the Azure command-line interface and bypassed multifactor authentication protections in many organizations.

The campaign was active between June 12 and June 26, 2026, according to cybersecurity firm Huntress, which observed the activity targeting its customers. During that period, attackers successfully compromised 78 Microsoft user accounts across 64 organizations. The attack volume spiked sharply on June 22, when 30 accounts across 23 businesses were breached in a single day.

Attackers used old username and password combinations, likely sourced from previous data breaches, in a password-spraying technique. This method involves trying a small number of common passwords against a large number of accounts to avoid triggering account lockouts. The attackers then authenticated through a deprecated OAuth mechanism called Resource Owner Password Credentials (ROPC). This legacy flow sends credentials...