Massive Azure Password Spray Hits 78 Accounts in 81M+ Attempts

Michael Miller · 2026-07-01

Cybersecurity researchers have uncovered a massive, ongoing password spray attack targeting Microsoft's Azure command-line interface (CLI). This automated campaign has already compromised dozens of accounts, with over 81 million attempts logged so far. It's a stark reminder that even cloud giants aren't immune to brute-force tactics. The attack, tracked by security firm Huntress, originates from a specific IPv6 address range (2a0a:d683::/32) controlled by LSHIY LLC (AS32167), an internet infrastructure provider. Between June 12 and June 26, the threat actors launched a relentless wave of password guesses against Azure CLI endpoints. The goal? To gain unauthorized access to Microsoft accounts and potentially move laterally within compromised environments. ### How Password Spraying Works Password spraying is different from traditional brute-force attacks. Instead of trying many passwords against a single account, attackers try a few common passwords against many accounts. This approach helps them avoid triggering account lockouts or raising alarms. Here's what makes it so effective: - It uses widely known passwords like "Password123" or "Welcome1" - It targets multiple accounts simultaneously, spreading the risk - It exploits weak or reused credentials across an organization In this case, the attackers focused on Azure CLI, a tool used by developers and IT admins to manage cloud resources. By compromising these accounts, they could gain deep access to cloud environments, potentially exfiltrating data or deploying ransomware. ### The Scope of the Attack According to Huntress, the attack was "massive, ongoing, and automated." The IPv6 range used suggests a sophisticated infrastructure, possibly rented or compromised. The 81 million-plus attempts highlight the scale of modern cyber threats. Even a small success rate can lead to significant breaches. > "Between June 12 and June 26, the threat actors conducted a sustained campaign against Azure CLI endpoints," the researchers noted. "This is not a random event but a targeted effort to exploit cloud management interfaces." ### Protecting Your Azure Environment If you use Azure CLI or manage cloud resources, here are practical steps to defend against password spray attacks: - Enable multi-factor authentication (MFA) for all accounts - Use strong, unique passwords for each account - Monitor login attempts for unusual patterns, especially from unknown IP ranges - Restrict Azure CLI access to trusted networks or VPNs - Regularly review account activity and revoke unused credentials These measures won't stop every attack, but they make it much harder for attackers to succeed. Password spraying relies on weak defenses, so strengthening your authentication can shut it down. ### Why This Matters for Businesses This attack isn't just a technical issue; it's a business risk. Compromised cloud accounts can lead to data breaches, financial losses, and reputational damage. For small and medium businesses, the impact can be devastating. The good news is that basic security hygiene goes a long way. Think of it like locking your front door. A determined thief might still break in, but a simple lock stops most casual attempts. Similarly, MFA and strong passwords stop most automated attacks. ### The Bigger Picture Password spray attacks are on the rise because they work. Attackers are constantly refining their methods, targeting cloud services like Azure CLI that have broad access. Staying ahead requires vigilance and proactive security measures. As the digital landscape evolves, so do the threats. But with the right tools and habits, you can protect your accounts and data. This attack is a wake-up call for anyone using cloud services to review their security posture. ### Final Thoughts The Azure CLI password spray attack shows how persistent and creative cybercriminals have become. By understanding the tactics they use, you can better defend against them. Stay informed, stay secure, and don't let a weak password be your downfall. Remember, security is a journey, not a destination. Every step you take to harden your defenses makes a difference.