Latest / The Digital Warfare Podcast / Digital Warfare Podcast Daily Brief #123 July 01, 2026
Transcript
- Digital Warfare: You're listening to the Digital Warfare Podcast. Today we are covering a large-scale password spray campaign targeting Microsoft Entra ID accounts through Azure Command Line Interface Logins and legacy OAUTH flows. And the key issue is not that organizations lacked multi-factor authentication. Many had MFA enabled. The issue is that authentication policies were not applied broadly enough to stop the attack. Huntress researchers tracked a sustained password and token spray campaign between June 12 and June 26, 2026. During that 14-day window, attackers attempted more than 81 million logins against customer tenants and successfully compromised at least 78 Microsoft accounts across 64 organizations. The campaign initially produced only a few daily compromises. Then, on June 22nd, activity surged to 30 compromised identities across 23 businesses in a single day. That spike tells us this was not random background noise. It was an organized credential abuse operation. The attackers were not guessing passwords blindly. They were replaying old username and password combinations exposed in previous breaches. In other words, credentials that should have been rotated long ago were still usable. The attack focused heavily on Azure CLI authentication and the OAUTH resource owner password credentials flow, known as R O P C. That matters because ROPC exchanges a raw username and password directly for an access token. There is no normal interactive login page, no browser based authorization step. And in poorly configured environments, no MFA challenge. This is where many organizations failed. Conditional access policies often enforce MFA at the authorization endpoint, but ROPC targets the token endpoint directly. If policies are not scoped correctly, The attacker may obtain a valid user-delegated access token without triggering the controls defenders assumed were protecting the account. Huntress found several common configuration mistakes. MFA applied only to selected cloud apps. MFA applied only to privileged groups. MFA enforced only outside trusted locations. Policies left in report-only mode, legacy grant flows still allowed, each gap created space for the attacker, and Azure CLI became the path through it. The infrastructure behind the campaign also matters. Much of the observed activity originated from IPv6 ranges associated with LSHIYLLC, infrastructure that third-party telemetry has repeatedly linked to Chinese origin. In some cases, geolocation inconsistencies caused attacking IPs to appear as United States traffic, allowing them to bypass trusted location logic. That is a critical lesson. Location-based trust is fragile. If identity controls depend too heavily on IP geography, attackers will exploit the uncertainty. The impact depends on the compromised account. A low-privilege Microsoft 365 user may expose email, files, and internal conversations. A developer or administrator may expose Azure resources, service principles, automation credentials, storage accounts, cloud workloads, and identity configurations. Once attackers obtain tokens, The intrusion moves from password guessing to authenticated cloud access. And authenticated access is always harder to distinguish from legitimate activity. So what should organizations do immediately? First, treat Azure CLI and ROPC as high-risk authentication surfaces. Second, require MFA or block access across all users, all cloud apps, and all client app types. Third, disable legacy grants and authentication flows wherever possible. Fourth, Test conditional access using Microsoft's What-If simulator to identify exclusions, report-only policies, and client types not covered by enforcement. Fifth, monitor entra-ID sign-ins for Azure CLI activity, abnormal token grants, impossible travel, unexpected IPv6 sources, and successful logins following large volumes of failed attempts. The strategic lesson is direct. MFA only protects what policy enforcement actually covers. If legacy flows, token endpoints, or command line clients sit outside those controls, attackers do not need to bypass MFA. They simply route around it. This has been your Digital Warfare Daily Brief. Stay secure. We'll see you tomorrow.