Security firm Huntress has reported a 155-fold increase in password spraying attacks in the first half of 2026. The standout campaign targeted Microsoft’s Azure CLI — the tool admins use to manage Azure and Entra ID — and generated over 81 million login attempts in just two weeks, compromising at least 78 accounts across 64 organisations.

The attack bypassed MFA entirely

The attackers didn’t use clever malware. They combined recycled passwords from old data breaches with a legacy OAuth flow called ROPC (Resource Owner Password Credentials) that sends credentials straight to Microsoft’s token endpoint — completely bypassing interactive MFA prompts. Of 23 affected organisations Huntress analysed, 15 had MFA configured but it wasn’t covering the right login flows. Eight had no MFA at all.

This mirrors what we see across Australian small business environments every week. MFA gets switched on during initial setup, ticked off the compliance checklist, and never audited again. The most common gaps we encounter: policies that only cover admins, “trusted location” exemptions that leave the entire office network unprotected, and legacy authentication protocols left enabled because one old app still needs them. If your MFA policy has exclusions, you have a gap — and this campaign proves attackers know exactly where to find it.

What to do now

Three things to check today. First, run a Conditional Access audit in Entra ID and confirm MFA applies to all users, all cloud apps, and all client app types — not just the ones someone remembered to add. Second, disable the ROPC grant type unless you have a documented business reason for keeping it (you almost certainly don’t). Third, restrict Azure CLI access to the people who actually need it and block legacy authentication protocols across the board.

If you’re not sure what your Conditional Access policies actually cover, All IT Services can run a security posture review and close the gaps before an attacker finds them.