TLDR Tech / InfoSec
Azure CLI Password Spray Hits Microsoft Accounts
An automated password spray attack, originating from an IPv6 range controlled by LSHIY LLC, targeted Azure CLI login attempts, comprising 78 accounts across 64 organizations. This attack leveraged the deprecated ROPC OAuth flow to bypass Conditional Access and weak MFA, utilizing old leaked credentials. Huntress recommends implementing strict MFA for all users and applications and limiting Azure CLI access to non-administrators.
Read the full story