As reported by Security Affairs, Huntress researchers have been tracking an aggressive, automated password spray campaign — dubbed LSHIY — targeting Microsoft Azure CLI environments since mid-June 2026. With 81 million login attempts and at least 78 confirmed compromised accounts across 64 organizations, this campaign is a textbook example of low-and-slow credential attacks scaling into industrial-grade threats.

Cloud Security Alert: As reported by Security Affairs, Huntress researchers have been tracking an aggressive, automated password spray campaign — dubbed LSHIY — targeting Microsoft Azure CLI environments since mid-June 2026.

Why This Campaign Deserves Serious Attention

Password spray attacks are not new. But the targeting of Azure CLI specifically is a calculated tactical choice that defenders need to understand. Azure CLI is a command-line interface used heavily by developers, DevOps engineers, and cloud administrators — users who often have elevated permissions, access to service principals, and the ability to provision resources. A single compromised CLI-authenticated account is rarely a low-value target.

What makes LSHIY particularly notable is the scale-to-success ratio. At 81 million attempts yielding 78 compromised accounts, the success rate appears low in percentage terms — but that framing is misleading. Each compromised account in an Azure environment potentially represents access to storage blobs, key vaults, CI/CD pipelines, and inter-tenant data flows. The attackers clearly understand that quality of access matters more than quantity.

Shield53 Perspective: When attackers target CLI tooling rather than web portals, it's a signal they're hunting for accounts with programmatic access — service principals, automation accounts, and developer identities that are rarely protected by the same MFA rigor as standard user logins.

Who Is Most at Risk

This campaign isn't scattershot — it's targeting organizations with meaningful Azure footprints. The industries and deployment profiles most exposed include:
Who Is Most at Risk
Software development firms and MSPs where developers regularly authenticate via CLI with broad subscription access
Mid-market enterprises that have adopted Azure for infrastructure but may lack mature identity governance
Organizations with federated or hybrid identity where on-premise password policies are weaker than cloud enforcement
Teams using service accounts or shared credentials for CLI automation — a common but dangerous practice

The Broader Threat Landscape Signal

LSHIY fits within a larger trend we've been monitoring at Shield53: adversaries are increasingly moving away from exploiting software vulnerabilities and toward identity exploitation at scale. Cloud CLI tools, APIs, and OAuth flows have become the preferred attack surface because they are authentication-heavy, often under-monitored, and connected to high-value resources.

The 64-organization scope also suggests this is not a targeted espionage campaign but rather opportunistic credential harvesting — likely for initial access brokering, cryptomining infrastructure deployment, or data exfiltration for resale. The automation behind 81 million attempts points to a well-resourced threat actor with access to distributed infrastructure capable of evading IP-based rate limiting.

Shield53 Recommendations

Immediate Actions

  • Enforce MFA on all Azure CLI authentication paths — including service principals and automation accounts. Conditional Access policies should require MFA even for non-interactive sign-ins where possible.
  • Audit your Azure sign-in logs NOW for anomalous CLI authentication attempts — look for high-volume failed logins, logins from unfamiliar IPs or ASNs, and successful logins following a burst of failures.
  • Review and rotate credentials for all service principals that authenticate via CLI, especially those with Contributor or Owner roles.
  • Enable Microsoft Entra ID Protection (formerly Azure AD Identity Protection) and configure risk-based Conditional Access policies to automatically block or challenge high-risk sign-in events.

Longer-Term Hardening

  • Transition CLI authentication to Managed Identities or Workload Identity Federation where possible — eliminating shared secrets entirely.
  • Implement Named Locations and IP allowlisting for CLI-based administrative access to restrict authentication to known corporate egress points.
  • Deploy Microsoft Sentinel or equivalent SIEM alerting on spray-pattern indicators: multiple failed logins across many accounts from a single IP range within short time windows.
  • Conduct a privileged access review — many organizations accumulate over-permissioned developer accounts that were never properly offboarded or scoped down.

Password spray campaigns succeed because organizations tolerate weak password hygiene on non-human identities and underestimate the attack surface of developer tooling. LSHIY is a reminder that in the cloud era, your CLI authentication is as critical as your perimeter firewall — and deserves the same defensive investment.