Password attacks increase 155 times – MFA loopholes open the door to Microsoft 365

Cyberattacks based on so-called password spraying have increased dramatically in 2026. Security company Huntress states that during the first half of the year it registered a 155-fold increase in credential spraying attacks.

A large-scale campaign against Microsoft's cloud environments also shows how attackers can bypass organizations' security controls without actually breaking multi-factor authentication.

In just two weeks, Huntress registered over 81 million login attempts towards customer environments. At least 78 Microsoft accounts at 64 organizations were compromised.

• 

  SPONSORED

  
  

• 

  OWN CONTENT

  
  

• 

  ADVERTISEMENT

  
  

• 

  ADVERTISEMENT

  
  

In several cases, the problem was not that MFA was missing.

The problem was that MFA didn't cover the right authentication flows.

81 million login attempts in two weeks

The extensive campaign was observed between June 12 and 26, 2026, and targeted Microsoft Azure CLI, the command-line tool used for administering Azure resources.

The attackers used automated login attempts on a very large scale, including usernames and passwords that had previously been exposed in data breaches but were still valid.

In total, more than 81 million related login attempts were recorded during the period.

Despite the enormous volume, the attackers managed to compromise at least 78 accounts at 64 organizations.

Huntress' statistics, however, show a much broader trend. Credential spraying attacks against the company's customer base increased 155 times in the first half of 2026.

The attackers didn't need to crack MFA

One of the most striking parts of the attack is that several of the affected organizations were already using multi-factor authentication.

However, the attackers did not need to defeat the MFA technology.

Instead, they exploited gaps in how organizations' Conditional Access policies had been configured.

The attack used, among other things, Resource Owner Password Credentials, ROPC, a legacy OAuth authentication flow where username and password can be sent directly to a token endpoint.

ROPC has been deprecated in OAuth 2.1 and lacks support for modern authentication mechanisms like MFA in the current flow.

The result is that an organization may experience MFA being enabled while still leaving some authentication paths unprotected.

MFA is not enough if the policy has gaps

Huntress analyzed 23 businesses that were affected by the campaign.

Eight of these lacked MFA altogether.

At the remaining 15 businesses, the MFA configuration did not cover the attackers' login attempts.

Among the problems were Conditional Access policies that only covered certain applications or user groups, exceptions for trusted locations, and policies that were in reporting mode and therefore did not actually block authentication.

It illustrates a central challenge for modern identity environments.

Just because an organization has implemented MFA does not automatically mean that all users, applications, and authentication methods are protected.

Password spraying is different from traditional brute force

In a traditional brute force attack, the attacker tests large numbers of passwords against a single account.

Password spraying works differently.

Instead, the attacker tests a limited number of common or previously compromised passwords against a large number of user accounts.

By spreading the attempts across many identities, the attacker can reduce the risk of traditional account lockouts and security mechanisms being activated.

Once valid credentials are found, they can be used for continued access, data theft, Business Email Compromise, or further identity attacks.

In the current campaign, observed Huntress However, there was no subsequent activity from the successfully compromised accounts. One possible explanation raised by the security firm is that the attackers may have verified working credentials for resale.

IPv6 makes blocking more difficult

The attack infrastructure also shows how threat actors are changing their methods.

A large portion of the traffic originally came from an IPv6 range connected to the internet service provider LSHIY LLC.

IPv6 offers a very large address space, which can make traditional IP-based blocking significantly more difficult.

Additionally, when the original infrastructure was shut down, Huntress observed how activity shifted to other networks and providers.

For security teams, this development means that static block lists and individual IP addresses are becoming less effective as a primary defense.

Huntress recommends stricter identity checks

For organizations using Microsoft's cloud services, Huntress points to several measures.

Organizations should, among other things:

• require MFA for all users, cloud applications, and client types
• review and minimize exceptions in Conditional Access
• block authentication methods that cannot meet MFA requirements
• phase out ROPC where it is still used
• restrict Azure CLI to users who don't need the tool
• improve password hygiene and consider password-free authentication methods
• Prioritize incidents where valid credentials are identified, rather than solely based on the number of failed logins

Identity is becoming an increasingly important attack surface

Developments in 2026 show how cyberattacks are increasingly targeting identities and authentication flows rather than traditional technical vulnerabilities.

This also means that investments in MFA alone are not a guarantee of strong identity protection.

For companies that use Microsoft 365, Entra ID and Azure, the configuration of Conditional Access is therefore at least as important as the actual implementation of multi-factor authentication.

155 times more password spraying attacks in six months is a clear signal: organizations need to ask not only whether MFA is enabled, but whether it truly protects every path into the environment.