Loading story…
A large-scale password spray campaign targeted Microsoft 365 environments through Azure CLI logins, generating more than 81 million authentication attempts and compromising at least 78 accounts across 64 organizations, according to Huntress. The attackers abused the deprecated OAuth Resource Owner Password Credentials (ROPC) flow to validate stolen username-password pairs and obtain user-delegated tokens, relying on previously breached credentials that had not been rotated.
The activity was observed between mid and late June and in some cases succeeded even where MFA and Conditional Access were enabled, because policies were misconfigured or did not fully cover Azure CLI ROPC authentication. Huntress said most attempts originated from the IPv6 range 2a0a:d683::/32, associated with LSHIY LLC (AS32167), and reported a more than 155-fold increase in credential-spray volume across its customer base over six months. Defenders were urged to enforce MFA for all users, cloud apps, and client app types, and to restrict Azure CLI access for non-admin users.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Huntress reported the observed login activity to hosting provider LSHIY LLC, which was linked to most of the attack traffic via AS32167. According to the report, Huntress received no response.
Huntress said the campaign activity continued through June 26, 2026. Across that broader window, most observed activity came from the IPv6 range 2a0a:d683::/32 associated with LSHIY LLC (AS32167).
On 2026-06-22, the Azure CLI password spray campaign surged, compromising 30 user accounts across 23 businesses in a single day. Huntress said 15 of those organizations believed Conditional Access policies enforcing MFA would protect them, highlighting policy gaps around the ROPC flow.
During the observed campaign window, attackers made more than 81 million login attempts against Microsoft 365 environments through Azure CLI and compromised at least 78 Microsoft accounts across 64 organizations. The campaign succeeded in some environments with MFA and Conditional Access enabled because policies were misconfigured or did not fully cover the ROPC flow.
Huntress observed the start of a large-scale automated password spray campaign targeting Microsoft Azure CLI logins and abusing the deprecated OAuth Resource Owner Password Credentials (ROPC) flow. The activity relied on previously breached username/password combinations to validate credentials and obtain user-delegated tokens.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
10 references tracked. Mallory keeps watching after this page renders.
cysecurity.news
Open sourcescworld.com
Open sourcescworld.com
Open sourcecybersecuritynews.com
Open sourcethehackernews.com
Open sourcebleepingcomputer.com
Open sourcelinuxsecurity.com
Open sourcehuntress.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Huntress reported a large phishing operation that used **Railway** cloud infrastructure to compromise Microsoft 365 accounts at hundreds of organizations by abusing Microsoft's legitimate device authorization flow. The campaign harvested and replayed OAuth access and refresh tokens, allowing attackers to maintain access for up to 90 days without needing victims' passwords and in many cases without being stopped by MFA. Researchers identified at least **344-350 victim organizations** across the U.S., Canada, Australia, New Zealand, and Germany, with activity accelerating sharply in early March and continuing at a rate of more than 50 compromises per day even after initial disruption efforts. The operation used highly varied, likely **AI-generated** lures delivered through email, QR codes, file-share themes, compromised websites, multi-hop redirects, and `workers.dev` pages to evade filtering and scale quickly. Huntress linked the activity to the **EvilTokens** phishing-as-a-service platform, which advertised Office 365 capture links, SMTP delivery, B2B sender services, AI-assisted phishing workflows, and open redirects. In response, Huntress pushed Conditional Access protections to about **60,000 Microsoft cloud tenants**, blocked additional attack attempts, and urged defenders to prioritize identity-layer monitoring, token revocation, blocking Railway-owned infrastructure, restricting device code authentication, and enabling **Continuous Access Evaluation**.
Jun 29, 2026
Microsoft disclosed a large-scale phishing campaign that targeted more than **35,000 users** at over **13,000 organizations** across **26 countries**, with most victims in the United States and concentrations in healthcare, life sciences, financial services, professional services, and technology. The operation used code-of-conduct and compliance-themed emails delivered through legitimate email services, including abuse of platforms such as Amazon SES, to make messages appear trustworthy and help them pass common email authentication checks. Victims received PDF attachments containing links that led through fake CAPTCHA and document-review pages before landing on spoofed Microsoft sign-in portals. Microsoft said the attackers used an **adversary-in-the-middle** phishing flow to capture credentials and authentication tokens in real time, allowing them to bypass weak multifactor authentication and gain immediate account access. The company described the activity as one of the most sophisticated code-of-conduct-themed credential theft campaigns it has observed and said it reflects broader trends including CAPTCHA-gated phishing, QR-code phishing, and phishing-as-a-service ecosystems such as **Tycoon 2FA**, **Kratos**, and **EvilTokens**. Microsoft urged organizations to strengthen defenses with Defender for Office 365, SmartScreen-enabled browsers, phishing awareness training, stronger authentication, conditional access policies, and automated attack disruption in Defender XDR.
Jun 29, 2026
A new phishing technique called **ConsentFix** has emerged, targeting Microsoft account users by exploiting the Azure CLI OAuth authentication flow. Discovered by Push Security, this attack is a sophisticated evolution of the earlier ClickFix scam, leveraging social engineering to trick victims into providing OAuth 2.0 authorization codes. Attackers compromise legitimate websites that rank highly in Google search results, presenting visitors with a fake Cloudflare CAPTCHA widget that requests a business email address. If the email matches a target list, the victim is guided through a process that mimics legitimate Microsoft login procedures, ultimately leading them to open a real Microsoft URL and copy a URL containing an OAuth token. Unlike previous ClickFix attacks that required users to execute malicious commands on their devices, ConsentFix operates entirely within the browser, making it harder for traditional endpoint security tools to detect. By capturing the OAuth token, attackers gain full access to the victim's Microsoft account via the Azure CLI, bypassing both passwords and multi-factor authentication (MFA). This method circumvents email-based anti-phishing controls and highlights the growing sophistication of consent phishing attacks targeting cloud authentication mechanisms.
Jul 3, 2026